Lopp's Wrench Attack Archive Doubles to 702 After AI-Assisted Search
Researcher Pizza Bitcoiner used AI-assisted agentic searches to surface 375 cases missing from Jameson Lopp's archive, pushing the documented physical Bitcoin attack count past 700 and exposing a decade-long documentation gap.
Researcher Pizza Bitcoiner used agentic AI searches to surface 375 cases missing from the record, exposing a decade-long documentation gap in physical Bitcoin attack data.
Key takeaways
- Jameson Lopp's physical Bitcoin attack archive crossed 702 documented incidents as of October 16, 2026, after researcher Pizza Bitcoiner used AI-assisted agentic searches to surface 375 previously missing cases across local-language sources in 72 countries.
- The doubling reflects a decade-long documentation gap, not a surge in attack frequency. The 702 figure is a floor: Pizza Bitcoiner's pipeline runs weekly and will keep adding cases.
- The dataset's most direct implication is that visible Bitcoin ownership carries measurable physical risk. OPSEC, multisig, and privacy practices are threat-model requirements, not edge-case precautions.
Jameson Lopp, co-founder and Chief Security Officer of Casa, announced on October 16, 2026, that his physical Bitcoin attack archive had crossed 700 documented incidents, more than doubling after researcher Pizza Bitcoiner used AI-assisted agentic searches to uncover hundreds of cases that had never made it into the English-language record. The threat has been badly undercounted for over a decade.
Per Bitcoin.com News, Lopp posted on X:
"Good news: the Bitcoin Wrench Attack archive just got a lot more accurate. Bad news: we just doubled the total number of known attacks to over 700. Kudos to Pizza Bitcoiner for finding hundreds of new attack reports via agentic searches."
https://x.com/lopp/status/2111086239541612843 (verify URL resolves before publish)
What the AI Pipeline Actually Found
Pizza Bitcoiner's separate database covers January 2020 through mid-October 2026, documenting approximately 669 to 670 verified incidents across 72 countries, with 1,104 source links. Of those cases, 375 were absent from Lopp's earlier collection. The methodology that found them: AI-assisted searches across local-language news outlets, court records, and police reports that traditional English-language research had never reached.
Per Bitcoin.com News, Pizza Bitcoiner responded to Lopp's acknowledgment directly:
"You are the one I should be thanking for starting it in the first place. I'm very happy to help! My pipeline will be running every week, adding new cases and also updating old ones with new evidence. The data will continue to remain available for download."
The archive now documents incidents dating back to 2014 across GitHub, covering kidnappings, home invasions, violent robberies, and extortion schemes. The term "wrench attack" comes from XKCD strip 538, which illustrates the premise cleanly: physical coercion defeats cryptographic security when a person holds the keys.
The Oct. 11 update to Pizza Bitcoiner's database added 38 cases and removed 3, merging 33 duplicates. That kind of ongoing curation is a sign of methodological discipline, not inflation.
The Documentation Gap Is the Story
The archive's prior count of roughly 350 cases was not an accurate baseline. It was an artifact of research methodology: English-language sources, Google-indexed outlets, and court records accessible to an English-speaking researcher. Local-language newspapers in Brazil, France, Eastern Europe, and Southeast Asia were outside that perimeter. AI changed the perimeter.
This matters for threat modeling. Security frameworks built against a 350-case dataset were calibrated to a sample that was, at minimum, half-empty. The real-world attack surface was always larger. Now there is a dataset beginning to reflect that reality, and it will keep growing as Pizza Bitcoiner's weekly pipeline adds new and retroactive cases.
2025 was already a record year for documented wrench attacks, with Lopp's tracker recording 70-plus incidents for the year. France alone accounted for roughly 41 documented cases between January and September 2026, per the archive. These are not abstract statistics; they are a distribution of physical violence concentrated on people whose Bitcoin ownership was traceable to their identity.
The falsifiable thesis here: the 700-plus figure represents a genuine documentation gap closing, not methodological overcounting. If independent audits of the 375 newly added cases show substantial duplication or out-of-scope inclusion above roughly 20% of the additions, the doubling headline would indicate inflation rather than discovery. The October curation removing 3 cases and merging duplicates points toward rigor. Watch for that audit signal as the dataset matures.
What a Larger Dataset Demands
As this archive becomes more complete and more widely cited, it should pressure custody toolmakers to ship better duress-resistance features. Lopp's own standing advice is direct: the most effective wrench attack defense is ensuring the holder cannot immediately comply under duress. Time-locked multisig, geographically distributed keys, and decoy wallet configurations accomplish that by leaving nothing to hand over.
The risk is not evenly distributed. It concentrates on people whose on-chain activity is traceable to a physical identity: conference speakers, social media posters with named wallets, company executives with public Bitcoin disclosures.
Nostr pseudonymity, coin privacy practices, and OPSEC hygiene are not theoretical freedoms. The 702 cases give them a documented body count. The Brazil self-custody seizure case earlier this year is a different category of threat, but it comes from the same root: visible ownership creates a target.
The next milestone to watch is whether the growing dataset begins influencing product roadmaps at custody companies and whether it appears in formal security research beyond the Bitcoin community.
Sources
- Lopp's Physical Bitcoin Attack Archive (live dataset)
- GitHub source repository: jlopp/physical-bitcoin-attacks
- Pizza Bitcoiner's database: https://bitcoin-wrench-attacks.zaup.org/ (verify URL resolves before publish)
- Lopp X announcement, October 16, 2026: https://x.com/lopp/status/2111086239541612843 (verify URL resolves before publish)
- Pizza Bitcoiner X reply, October 16, 2026: https://x.com/pizza_bitcoiner/status/2111089752690544741 (verify URL resolves before publish)
Frequently Asked Questions
Does the archive doubling mean wrench attacks have doubled in frequency?
No. The increase reflects better documentation through AI-assisted searches of non-English sources, court records, and police reports that prior research never reached. Attack frequency may have risen (2025 was a record year by documented count), but the jump from roughly 350 to 702 cases in the archive is primarily a methodology correction, not evidence of a sudden doubling in attack rates.
How is Pizza Bitcoiner's database different from Lopp's archive?
Pizza Bitcoiner's database covers January 2020 through present across 72 countries and is maintained with a weekly AI pipeline, currently documenting approximately 669 to 670 verified incidents with 1,104 source links. Lopp's archive dates to 2014 and covers the full historical range. The two overlap substantially; roughly 375 of Pizza Bitcoiner's cases were previously absent from Lopp's collection.
What concrete steps reduce wrench attack exposure?
The most effective measure is structural: hold bitcoin in a multisig setup with geographically distributed keys so that immediate compliance under duress is physically impossible. Beyond custody structure, reducing visible ownership matters. Avoid linking a real name or face to on-chain activity, minimize public discussion of holdings, and treat OPSEC as a baseline, not a premium option.
