Thief Posing as Delivery Driver Ties Up Homeowner, Steals $11M in Crypto

In brief A man posing as a delivery driver robbed a San Francisco homeowner of $11 million in crypto Saturday morning, after pulling a gun and binding the victim with duct tape. “Identifying the suspects is usually far more achievable than recovering the stolen crypto,” Cybercrime consultant David Sehyeon Baek told Decrypt. Security researcher Jameson Lopp's database has documented over 55 "wrench attacks" globally this year, averaging one per week. Decrypt’s Art, Fashion, and Entertainment Hub. Discover SCENE A man posing as a delivery driver robbed a San Francisco homeowner of $11 million in crypto Saturday morning after pulling a gun and binding the victim with duct tape. The suspect used the delivery disguise to gain access before brandishing a weapon and restraining the homeowner, then forcing him to hand over his crypto wallet credentials along with a laptop and phone, according to a police report seen by the San Francisco Chronicle . The attack happened around 6:45 a.m. at a residence near 18th and Dolores streets in the Mission Dolores neighborhood, the report says. The incident marks the latest in an alarming surge of “ wrench attacks ,” physical assaults targeting crypto holders, with security researchers warning that such crimes are reaching new levels this year. The report gave no details on injuries or arrests, according to the SF Chronicle . San Francisco police did not immediately respond to requests for comment from Decrypt .  Physical threats surge Cybercrime consultant David Sehyeon Baek told Decrypt that investigators will likely "move on all three fronts at once: devices, blockchain, and victim profiling, rather than choosing one over the others." "In the first 24–72 hours, they'll push hard on the hardware side," Baek explained, noting that authorities will probably attempt to track the stolen phone and laptop while securing remaining assets in exchanges before attackers can move them. "In parallel, they'll try to identify the exact wallets and addresses involved so blockchain specialists can start tracing outflows in real time,” he added. He noted that coerced transfers let attackers move crypto “within minutes,” especially if routed through privacy-focused services, whereas digital-only thefts are more likely to be flagged and frozen by exchanges. Jameson Lopp, co-founder and chief security officer at self-custody platform firm Casa, who maintains a database tracking such incidents, has documented over 60 wrench attacks this year, roughly double the number recorded last year. Recently, Russian crypto promoter Roman Novak and his wife were murdered in the UAE after meeting with men posing as investors who demanded access to his crypto wallets. And on Sunday, Thai police arrested a South Korean man and three Thai nationals for allegedly kidnapping and robbing a Chinese victim of over $10,000 in cash and crypto, according to a local media report . “The hard truth is that identifying the suspects is usually far more achievable than recovering the stolen crypto,” Baek said. Daily Debrief Newsletter Start every day with the top news stories right now, plus original features, a podcast, videos and more. Your Email Get it! Get it!