Crypto Investor Loses $11 Million in Sophisticated ‘Wrench Attack’ Heist

Daylight Robbery: Delivery Driver Disguise Leads to Multi-Million Dollar Cryptocurrency Theft

In what authorities are describing as a meticulously planned “wrench attack,” a San Francisco cryptocurrency investor fell victim to an armed robbery that resulted in the theft of approximately $11 million in digital assets. The brazen incident, which occurred around 6:45 a.m. on November 22, 2025, represents an alarming escalation in targeted crimes against cryptocurrency holders—a trend that security experts have been monitoring with growing concern.

The robbery unfolded on the unit block of Dorland Street in San Francisco’s Mission Dolores neighborhood, where the perpetrator, disguised as a delivery driver, approached the victim’s residence during early daylight hours on Saturday. According to police reports, the suspect used this disguise to gain entry to the home, after which he brandished a firearm, restrained the victim with duct tape, and forced them to provide access to cryptocurrency wallets. The thief escaped with roughly $11 million in cryptocurrency assets, along with the victim’s laptop and mobile phone. While the financial loss was substantial, authorities report the victim fortunately escaped physical injury during the ordeal.

“This case demonstrates the increasingly sophisticated tactics criminals are employing to target individuals known to possess significant cryptocurrency holdings,” said Detective Sarah Reynolds, who leads the San Francisco Police Department’s financial crimes unit. “What makes these cases particularly challenging is the instantaneous and often irreversible nature of cryptocurrency transfers, which presents unique obstacles for law enforcement recovery efforts.”

Security Footage Reveals Calculated Approach by Suspect

Home security footage of the incident, which was later posted online by Y Combinator CEO Garry Tan in an effort to aid the investigation, reveals the calculated nature of the crime. The video shows the suspect approaching the front door dressed in dark clothing, wearing sunglasses, a hoodie, and gloves, while carrying a white package. Notably, the individual carefully positioned himself to obscure his face from the security camera, suggesting premeditation and awareness of surveillance measures.

The footage captures the suspect buzzing the residence and asking for “Joshua,” claiming to have a package requiring a signature. After the victim, who identified himself as Joshua, opened the door, the perpetrator maintained his delivery driver persona by asking if the resident could “sign for this.” The suspect then made a show of searching his pockets for a pen before asking the victim if he had one available. When the victim went inside to retrieve a pen, the suspect followed, at which point a loud noise was heard on the recording.

According to police statements, once inside, the suspect produced a firearm and threatened the victim, who complied with demands to avoid escalation. The perpetrator then bound the victim with duct tape before proceeding to gain access to cryptocurrency wallets and fleeing with digital assets and physical devices. The SFPD continues its investigation into the incident, though no arrests have been announced at the time of publication.

Community Response and Investigative Efforts

The cryptocurrency community has rallied around efforts to identify the perpetrator, with prominent figures using their platforms to spread awareness and gather potential evidence. Tan, a influential figure in Silicon Valley’s tech ecosystem, took to social media platform X on Monday morning to share the security footage and appeal for assistance from the public.

“We have to find the perpetrator,” Tan wrote in his post. “Time is of the essence.” He urged residents in the vicinity of Mission Dolores Park, between Dolores and Guerrero streets, who might have captured relevant footage between 4:30 and 6:00 p.m. on the day of the incident to contact San Francisco police immediately.

The urgency of Tan’s appeal reflects the unique challenges associated with cryptocurrency theft. Unlike traditional financial crimes, cryptocurrency transactions can be difficult—sometimes impossible—to reverse once executed. The pseudonymous nature of many blockchain transactions, while not completely anonymous, can create significant hurdles for investigators attempting to trace stolen funds, particularly if perpetrators employ sophisticated methods to obscure the movement of assets.

Rising Trend of Physical Attacks Targeting Cryptocurrency Holders

This incident marks the latest in a concerning pattern of physical crimes targeting individuals known or suspected to possess substantial cryptocurrency holdings. Security analysts have dubbed these physical confrontations “wrench attacks”—a reference to the direct approach of threatening victims with physical harm to obtain access to digital assets, in contrast to remote hacking or phishing attempts.

According to industry data, such incidents have increased approximately 65% year-over-year, with approximately 61 reported cases in the current year compared to 38 in the previous period. This surge coincides with renewed public interest in cryptocurrency investments and the increasing sophistication of blockchain analysis tools that can potentially identify wealthy cryptocurrency holders.

Earlier this year, streaming personality Amouranth and her husband narrowly escaped a similar fate when armed intruders invaded their home in March, demanding access to cryptocurrency wallets. In that case, the situation was defused when the husband heard the disturbance and discharged a firearm, striking one intruder and forcing the group to flee. Authorities later charged four teenage suspects in connection with that home invasion.

Other notable cases include a series of armed home invasions across multiple U.S. cities specifically targeting cryptocurrency investors, and a Manhattan kidnapping-torture plot where victims were held until they provided access to Bitcoin wallets. These incidents highlight the evolving security challenges faced by individuals with significant digital asset holdings.

Security Experts Recommend Enhanced Protection Measures

In the wake of this latest incident, cryptocurrency security experts are emphasizing the importance of comprehensive security measures for individuals with substantial digital asset holdings. “The physical security component of cryptocurrency investment is often overlooked,” explains Dr. Eleanor Garrison, director of the Digital Assets Security Institute. “While investors typically focus on protecting their private keys from remote attacks, many fail to consider the risk of physical confrontation or coercion.”

Security professionals recommend several protective measures, including maintaining a low profile regarding cryptocurrency holdings, implementing multi-signature wallet solutions that require approval from geographically distributed parties, utilizing time-locked transactions for large holdings, and considering cold storage options that physically separate significant assets from everyday trading accounts.

“What makes these ‘wrench attacks’ particularly effective is that they bypass the sophisticated cryptographic security protecting digital assets by directly targeting the human element,” notes former FBI cybercrime investigator Marcus Holloway. “Unlike remote scams that might be detected or blocked, physical coercion can result in rapid fund transfers that make recovery challenging even when suspects are ultimately apprehended.”

As the San Francisco Police Department continues its investigation into this latest cryptocurrency theft, the incident serves as a stark reminder of the evolving security landscape surrounding digital assets. With cryptocurrency valuations again reaching significant levels and public interest in digital investments growing, security experts warn that physical security considerations must become an integral part of any comprehensive digital asset protection strategy. For cryptocurrency investors, the threat is no longer limited to the digital realm—it may be disguised as a delivery driver at your front door.