OAK — OnChain Attack Knowledge

Worked example · 2026-05

Kraken / Coinbase users — coordinated physical-coercion + wallet-compromise theft — 2026-05

Loss
~$6.7M stolen from users connected to Kraken and Coinbase in what was reported as a coordinated physical attack and wallet-compromise operation: 1,554 ETH, 10.5 BTC, and 34.1 cbBTC, with roughly $5.3M subsequently laundered through Tornado Cash. The event sits inside a sharp 2026 surge in physical ("wrench") attacks on crypto holders: CertiK recorded 34 verified physical crypto attacks worldwide in January–April 2026 (~$101M in losses, +41% year-on-year, with ~82% of cases in Europe) — already nearly double the $52.2M attributed to physical attacks across all of 2025.
OAK Techniques observed
OAK-T5.009 (Physical-Coercion Extraction — the coerced/compromised transfer is the extraction primitive; mapped here at the reported strength, since the physical dimension of this specific case is suspected rather than forensically confirmed — cf. the confirmed TeufeurS and Balland cases from which T5.009 was built). OAK-T7 (Laundering — the ~$5.3M routed through Tornado Cash; T7.001 mixer-routed hop). OAK-T8.005 (Operational-Security Procedural Failure — cross-referenced at the victim level: physical-coercion and direct-targeting attacks succeed against individuals whose holdings, identity, and physical location are correlatable, often through prior on-chain or social exposure).
Attribution
pseudonymous on-chain; physical dimension suspected, not conclusively established in public reporting. The theft was characterised as a coordinated physical-attack-plus-wallet-compromise operation, and the laundering trail (consolidation → Tornado Cash) is observable on-chain. The specific perpetrators were not publicly named at the time of reporting; this entry records the incident at the strength the sources support and frames it within the documented 2026 wrench-attack trend rather than asserting a confirmed physical-coercion finding for this individual case.
Key teaching point
This case is the May-2026 anchor for the 2026 wrench-attack surge — the shift of crypto theft offline, from remote exploitation toward physical coercion, home invasion, kidnapping, and direct targeting of holders and their families. The defining structural feature is that the on-chain security model is irrelevant when the attacker controls the person: a perfectly-secured hardware wallet, multisig, or exchange account confers no protection when the holder is physically compelled to authorise a transfer or surrender credentials. The crypto trail remains the detection-and-recovery surface — the ~$5.3M into Tornado Cash is exactly where tracing, exchange-freeze cooperation, and mixer-demixing efforts attach — but prevention moves into the physical-OPSEC domain (minimising public linkage between identity, holdings, and location; avoiding self-disclosure of balances; family security). OAK records the trend because the on-chain laundering and the targeting signals (who is identifiable as a high-balance holder, and how) are within its scope even though the coercion itself is not an on-chain technique.

Summary

In May 2026, users connected to Kraken and Coinbase lost approximately $6.7M in what reporting described as a coordinated physical attack and wallet-compromise operation. The stolen assets — 1,554 ETH, 10.5 BTC, and 34.1 cbBTC — were consolidated and roughly $5.3M was laundered through Tornado Cash, the standard privacy-mixer off-ramp for high-value, attribution-sensitive proceeds.

The incident is one instance of a broader, well-documented 2026 pattern. Per CertiK's wrench-attack tracking, 34 verified physical crypto attacks occurred worldwide in January–April 2026, causing an estimated ~$101M in losses — a ~41% increase year-on-year and already nearly double the $52.2M attributed to physical attacks across all of 2025. Roughly 82% of early-2026 cases were in Europe, and CertiK and others noted an alarming shift toward targeting victims' family members. Coinbase publicly addressed the trend ("Standing Up to Extortionists"), and Bloomberg documented the move of crypto thieves "offline to terrorize investors at home."

This entry treats the $6.7M Kraken/Coinbase event as the concrete, on-chain-traceable anchor for that trend: the assets, the consolidation, and the Tornado Cash laundering are observable, while the physical-coercion dimension is recorded as reported (suspected) rather than as a confirmed forensic finding for this specific case.

Why this is structurally significant

The corpus already contains physical-world-to-crypto cases — the TeufeurS kidnapping (examples/2023-2024-french-streamer-kidnapping-ransom-crypto.md, $2M ransom, $800K frozen) and the hardware-wallet physical-compromise cohort. The 2026 surge generalises and scales that pattern, and the Kraken/Coinbase case marks three structural points:

  1. The attacker controls the human, so the cryptographic perimeter is moot. Unlike key compromise (where the attacker steals key material) or phishing (where the victim is deceived), physical coercion compels an authentic action by the legitimate holder. No on-chain control — multisig, hardware wallet, exchange 2FA — defends against a holder acting under duress. This is the inverse of the corpus's usual "the cryptography was fine, the perimeter wasn't" lesson: here the perimeter is the person.
  2. Targeting is an on-chain-and-social problem. Wrench attacks require the attacker to identify a high-balance holder and locate them. That targeting is frequently enabled by on-chain exposure (large, linkable holdings; doxxable addresses; public association of an identity with a wallet) and social exposure (self-disclosed wealth, conference presence, social-media signalling). The targeting surface is partly on-chain, which is why OAK tracks the trend: reducing identity↔holdings↔location linkage is a defensible mitigation that lives at the boundary of on-chain hygiene and physical OPSEC.
  3. The laundering trail is the recovery surface. The ~$5.3M into Tornado Cash is where tracing and recovery attach. As with TeufeurS (where rapid exchange cooperation froze $800K), the time window between the coerced transfer and the funds entering a mixer or privacy chain is the critical recovery interval. Physical-attack proceeds are still on-chain proceeds.

The European concentration (~82%) and the shift toward targeting family members are trend signals worth recording: they indicate the attacks are becoming organised and are optimising for the path of least resistance (coercing a holder or their relatives) rather than for technical sophistication.

Timeline (UTC)

When Event OAK ref
2026-01 to 2026-04 CertiK records 34 verified physical crypto attacks worldwide (~$101M losses, +41% YoY, ~82% in Europe); shift toward targeting victims' family members (trend context)
2026-05 Coordinated operation targets users connected to Kraken and Coinbase; ~$6.7M stolen — 1,554 ETH, 10.5 BTC, 34.1 cbBTC T5 (value extraction via coercion / wallet compromise)
2026-05 ~$5.3M of the proceeds laundered through Tornado Cash T7 / T7.001 (mixer-routed laundering)
2026 (ongoing) Coinbase publishes "Standing Up to Extortionists"; Bloomberg documents crypto thieves moving offline to target investors at home (operator / press response)

What defenders observed

  • Pre-event (targeting / exposure layer): wrench attacks require identifying and locating a high-balance holder. The defensible mitigation is minimising linkage between identity, holdings, and physical location: avoid public self-disclosure of balances, segregate doxxable identity from large wallets, and treat any public association of a real-world identity with a high-value address as a targeting risk. This is the on-chain-hygiene edge of physical OPSEC.
  • At-event (no cryptographic defense): a holder acting under physical duress produces an authentic transfer or surrenders credentials voluntarily-under-coercion; multisig, hardware wallets, and exchange 2FA do not defend against it. Duress-resistant controls (decoy/duress wallets, time-locked withdrawals, geographically-distributed multisig requiring a remote co-signer, exchange withdrawal delays) are the relevant mitigations because they remove the holder's ability to instantly satisfy the coercion.
  • At-event (laundering signal): consolidation of 1,554 ETH + 10.5 BTC + 34.1 cbBTC followed by ~$5.3M into Tornado Cash is the standard high-value-mixer pattern. Rapid detection and exchange-freeze cooperation in the window before mixing is the recovery lever, as in the TeufeurS case.
  • Post-event (trend): the European concentration and family-member targeting indicate organised, repeatable operations. Exchanges (Kraken, Coinbase) and security firms (CertiK) responded with public guidance and executive-protection measures, signalling that the trend is now a first-order risk for identifiable high-net-worth holders.

What this example tells contributors writing future Technique pages

  • Physical coercion is on-chain-adjacent and belongs in the corpus as a trend, mapped to T5/T7. The coercion itself is not an on-chain technique, but the extraction (T5), the laundering (T7), and the targeting surface (on-chain identity↔holdings↔location linkage) are within scope. Map physical-extortion events as the corpus already does (T5 extraction + T7 laundering), and record the targeting-exposure dimension.
  • Targeting-exposure is a recordable risk field. Whether a victim was identifiable as a high-balance holder — and through what (on-chain doxxing, social disclosure, conference presence) — is the predictive field for wrench-attack risk and the one defenders can actually act on.
  • Duress-resistant controls are the relevant mitigation class. Decoy wallets, withdrawal time-locks, remote co-signers, and exchange withdrawal delays defend against coercion in a way the cryptographic perimeter cannot. Record them as the mitigation set for physical-coercion events.
  • A specific case can anchor a documented trend without over-claiming. Record the on-chain-traceable facts (assets, laundering) at full confidence and the physical-coercion dimension at the strength the sources support; the CertiK trend statistics provide the well-sourced backdrop.

Public references

Discussion

The Kraken/Coinbase $6.7M event is the May-2026 entry point to the year's most important non-technical crypto-crime trend: the migration of theft offline. It belongs with the TeufeurS kidnapping and the hardware-wallet physical-compromise cohort as cases where the predicate act is physical and the crypto layer is the trail rather than the vulnerability. The corpus's consistent treatment — extraction under T5, laundering under T7 — applies here, and the ~$5.3M Tornado Cash trail is the recovery surface.

The reason the trend matters for an on-chain-attack taxonomy is the targeting surface. Wrench attacks are enabled by the attacker's ability to identify and locate a high-balance holder, and that identification is frequently an on-chain and social problem — linkable large holdings, doxxed addresses, self-disclosed wealth. The defensible mitigations therefore straddle on-chain hygiene (break the identity↔holdings↔location linkage) and physical OPSEC (duress-resistant controls, family security). Recording the trend, the CertiK statistics, and a concrete anchor case lets OAK represent a class of loss that is growing fast (≈+41% YoY into 2026, Europe-concentrated, increasingly targeting families) without overstating the physical-coercion finding for any single incident whose details remain partly reported rather than confirmed.

Techniques demonstrated (3)