The Intersection of Digital and Physical Threats: The Arbitrum AFX Trade Hack and the Surge in 'Wrench Attacks'

On July 22, 2026, the cryptocurrency industry was reminded once again that security is a multi-faceted war. As the AFX Trade protocol on the Arbitrum network suffered a $24 million bridge vulnerability exploit, security firm CertiK released a report stating that the value of assets targeted by physical 'wrench attacks' in the first half of 2026 had surged by over 1,000%. These events suggest that crimes targeting digital assets have moved beyond code vulnerabilities and reached the front doors of their owners.

Around 21:30 UTC on July 22, 2026, a massive asset outflow was detected from the AFX Trade bridge in the Arbitrum ecosystem. According to security firm Blockaid, the attack was not a flaw in the Arbitrum network itself, but specifically targeted a vulnerability in the bridge operated by AFX Trade. The attacker immediately transferred the stolen assets to the Ethereum network and attempted to launder the funds by exchanging them for approximately 12,467 ETH. The key timeline and scale of the AFX Trade bridge attack are summarized as follows.

Amid frequent hacking incidents exploiting technical vulnerabilities, physical threats directly targeting cryptocurrency holders have recently emerged as a new security concern. The first-half 2026 report released by CertiK warns that ownership of digital assets is now directly linked to personal safety in the offline world.

Cryptocurrency wrench attacks are no longer rare, and criminal organizations are evolving into sophisticated methods of physically threatening high-net-worth individuals to seize their assets.

According to CertiK's data, so-called 'wrench attacks,' where digital assets are accessed through physical coercion, are showing a sharp upward trend. A total of 52 incidents were confirmed during the first half of 2026, a 33.3% increase compared to the 39 incidents in the first half of 2025. Even more notable is the scale of the damage; losses, which stood at $10.5 million in the first half of last year, have surged approximately 11.8 times to $124.1 million this year, highlighting the growing severity of these crimes.

Organized Physical Crime and Geographic Concentration

One of the characteristics highlighted in this report is the geographic concentration and organized nature of the crimes. Approximately two-thirds of all confirmed attacks occurred in France, revealing severe security risks in specific regions. The crime patterns showed monthly volatility; in particular, the number of incidents temporarily decreased in February 2026 following a major crackdown by European police, but showed a rebound trend thereafter. The statistical changes in wrench attacks during the first half of 2026 can be clearly seen in the comparison table below.

• January 2026: 15 incidents (a sharp increase compared to 9 in the same period last year)
• February 2026: Temporary decrease to 5 incidents due to police crackdowns
• March 2026: Increased back to 13, demonstrating the resilience of criminal organizations

The market reacted immediately to the news of the security incident. The price of Arbitrum's native token, ARB, fell by approximately 4% immediately after the incident, reflecting dampened investor sentiment. The Arbitrum team is working closely with Blockaid to develop countermeasures to prevent further asset outflows and is focusing on restoring ecosystem trust by recommending strengthened security audits for third-party bridge operating protocols.

CertiK emphasized to cryptocurrency holders that 'Operational Security (OpSec)' has become as important as technical security. The advice is to strictly refrain from exposing information in public places or on social media that could link an individual's identity, residence, or daily routines to their cryptocurrency holdings. For high-net-worth individuals, security is now expanding beyond the use of hardware wallets into the realm of personal physical protection.

Unlike automated and scalable bridge hacks, wrench attacks are manual crimes that carry high risks for the criminals themselves. However, the fact that the damage amount per single incident is growing exponentially shows that criminal organizations perceive cryptocurrency theft as a high-profit business. While bridge hacking still leads in terms of total damage, the growth rate of physical theft is steeper than any other digital crime category.

In the second half of 2026, the strengthening of regulations and investigations by governments against physical extortion crimes is expected to be a key point to watch. In addition, Layer 2 (L2) protocols are likely to face intense pressure to raise security standards for third-party bridges within their ecosystems. Investors have entered a new security phase where they must manage the dual risks of technical flaws and physical threats simultaneously.