AI-powered bots aren’t just logging in anymore. They’re mimicking real users, slipping past identity checks, and scaling attacks faster than ever.

Thousands of companies worldwide trust hCaptcha to protect their online services from automated threats while preserving user privacy.

Now is the time to take control of your security.

Book a demo today.

On March 5, 2026, a UK indie game developer named Alex Amsel posted a four-line tweet announcing he had been physically attacked and stripped of approximately $24 million in stablecoins. He named weapons, kidnapping threats, and rape threats. Within hours, blockchain security firms labeled the on-chain drain an address poisoning incident. Within 24 hours, Amsel corrected the record. There was no address poisoning. There was a man with a weapon, and the chain only showed what came after the wrench did its work.

For a decade, this industry built a security culture around code. Audit budgets. Formal verification. Multisig schemes. Hardware wallets stored offline. Every one of those defenses assumes the threat is on a wire. None of them stop a stranger at the door, a knife at the throat, a finger held over a sink. The attacker no longer needs a vulnerability in the contract. The attacker needs your home address. The data set required to put that address on a clipboard is increasingly available for purchase. The seam has moved.

The shift is documented. According to Jameson Lopp, chief security officer at Casa, who has maintained the most comprehensive open database of physical attacks against crypto holders for over a decade, reported wrench attacks rose 169% in 2025. CertiK has logged 34 verified attacks in the first four months of 2026, a 41% increase over the same period last year, with cumulative losses crossing $100 million. France has absorbed the largest share. 82% of CertiK's 2026 cases occurred in Europe. French prosecutors have charged 88 suspects across 12 active investigations, more than 10 of them minors, in incidents ranging from the January 2025 mutilation of Ledger co-founder David Balland to the February 2026 abduction of a magistrate and her mother for crypto ransom. On January 24, 2026, Chinese entrepreneur Yong Wang was found buried vertically in a shallow pit in the Arnavutköy district of Istanbul, hands and feet bound, mouth sealed. Investigators determined the attackers extracted his wallet access before they killed him. That is the first verified crypto-related homicide of 2026. There will be others.

The Sillytuna case shows the operational playbook in full. The funds bridged to Hyperliquid through Arbitrum, ran through accounts on the privacy-focused DEX Wagyu operated by pseudonymous developer "PerpetualCow," and exited to Monero. Another $1 million bridged into native BTC via LiFi. PerpetualCow publicly claimed to have been asleep while the laundering ran. Approximately $20 million in DAI was consolidated into two attacker-controlled staging wallets within hours of the extraction. The attackers used the blockchain. The blockchain did not enable the attack. The attack happened in a room.

The targeting layer is where the new threat actually lives. KYC databases breach at regular intervals. Conference attendee lists circulate in private Telegram channels. NFT ownership records are public by design. Social media posts about positions, holdings, and net worth get scraped and indexed. In April, Telegram founder Pavel Durov publicly cited the case of a French tax official who allegedly sold crypto holders' personal data to criminal networks. Lopp's name for the regulatory contribution to this pipeline is precise. He calls it Kill Your Customer. Every layer of compliance the industry was forced to adopt is now also a layer of physical risk surface.

The attack pattern is industrialized. French law enforcement describes "structured criminal networks" with repeat offenders moving across cases. Vanessa Perrée, the National Prosecutor for Organized Crime at the French Ministry of Justice, confirmed in April that several of the 88 charged are linked to multiple incidents. The recruitment pipeline runs through Telegram. The execution model is small specialized crews. The laundering model is identical across cases: physical extraction of access, immediate bridge to stablecoin, fast multi-chain routing, conversion to Monero or another privacy asset, offramp through compromised OTC infrastructure. The kill chain is no longer software to fiat. It is body to fiat. The part of the chain that used to be hardest to execute, the conversion to clean money, is now the part the attackers are best at, because they inherited the laundering infrastructure built by the protocol exploiters who preceded them. The five-dollar wrench is not the future of crypto crime. It is the present.

Three addresses inside the Sillytuna kill chain, traced by PeckShield and on-chain analysts in the days after the attack. The wrench happened in a room. The chain only shows what came after.

The Fraudfather's read on the three positions worth your attention this week. A note on the lineup. SOL rotates out. The Position Desk reserves slots for assets making active demands on capital, either threatening to break or threatening to launch. SOL ran from $92 to $97 mid-week and pulled back to $89 with the broader tape on Friday, netting roughly +1% over seven days. That is range-trading inside a wider consolidation, and there is nothing on the chart or the news flow that requires an active position decision this week. The slot opens for Hyperliquid (HYPE), which is named in today’s lead story, sat through Friday's macro selloff with a 0.1% scratch on a -3% market day, and is the asset where CME and ICE just escalated a regulatory war.

Not financial advice. The KillChain is research and commentary, not personalized investment guidance. You're in command of every position. Read accordingly.

Stay Sharp, Stay Solvent