Two brothers from Waller, Texas pleaded guilty on June 18, 2026, to robbing a Minnesota family at gunpoint and stealing more than $8 million in cryptocurrency, in one of the highest-value wrench attack cases in United States history.

Isiah Angelo Garcia, 25, and Raymond Christian Garcia, 24, each entered a single guilty plea to interference with commerce by robbery before U.S. District Judge Ann Montgomery in Minneapolis. The crime took place on September 19, 2025, when the brothers approached the victim outside his home in Grant, Minnesota, as he was taking out his garbage.

---

What Happened

Armed with an AR-15 rifle and a shotgun, the brothers forced their way into the family home, bound multiple family members with zip ties, and held them for more than eight hours. A third party coordinated account information via phone calls during the robbery. The father was forced to transfer funds across multiple accounts before being driven at gunpoint to a remote cabin in Grand Rapids, roughly three hours north of Grant, where the brothers retrieved additional hardware storage devices containing further crypto assets.

The ordeal ended when the victim's son managed to call 911 during the incident. The brothers fled when police arrived. Investigators later traced them through a Wendy's receipt found inside a suitcase left at the scene. The suitcase also contained a disassembled AR-15, ammunition, and clothing. The brothers were arrested in the Houston area.

Both men now face a maximum sentence of 20 years in federal prison and have agreed to pay restitution exceeding $8 million. Sentencing has not yet been scheduled.

"No one should ever feel unsafe in their own home," said FBI Minneapolis Special Agent Christopher Dotson. Acting U.S. Attorney Joseph H. Thompson added: "This is not normal. Minnesotans should not accept wild violence as normal." U.S. Attorney Daniel Rosen also issued a statement, saying his office was committed to holding the Garcias "accountable for the choices they made." The identity and arrest status of the third-party phone coordinator remain unknown, and it is unclear whether that individual faces any charges.

---

Part of a Broader, Accelerating Pattern

The Garcia case is not an isolated incident. It fits a documented and rapidly growing category of crime that security researchers call "wrench attacks," a term for physical coercion used to extract cryptocurrency from a holder. The concept captures a core vulnerability: even the most sophisticated digital security can be bypassed by a physical threat directed at the person holding the keys.

According to CertiK, a blockchain security firm, physical attacks on crypto holders rose 75 percent in 2025 compared to the prior year, reaching at least 72 confirmed incidents and more than $41 million in known losses. Physical assaults specifically jumped 250 percent year over year, according to CoinDesk and CertiK data. Crisis24, a private security research group, tracked at least 231 physical incidents over an 18-month period through mid-2025, resulting in at least 6 deaths and $166 million stolen. Of that total, approximately $128 million was extracted through kidnapping.

CertiK describes the underlying dynamic as a technical paradox: as on-chain hacking becomes harder and more expensive, attackers are shifting their focus to the weakest point in the system, which is the human being holding the keys. "Stronger tech, but the same fragile human layer," the firm noted, as reported by CoinDesk. If current trends continue, CertiK projects roughly 130 physical crypto incidents globally in 2026, with several hundred million dollars in projected losses.

---

The Risk Is Not Limited to the United States

Europe accounts for more than 40 percent of global incidents, with France recording 19 attacks and ranking as the most affected single country. But several cases from South Asia and Africa illustrate how the problem scales differently in regions where institutional recourse is less reliable.

In India, a Gujarat court sentenced 14 people to life imprisonment in September 2025 for the kidnapping of a businessman and the extortion of 752 Bitcoin. Eleven of those convicted were police officers, and a former politician was also among the 14 sentenced. A 2022 case in Pune involved eight attackers, one of them also a police officer, who extracted an estimated $50 million in Bitcoin from a single victim.

In Nigeria, the police force dismissed five inspectors from Rivers State in May 2026 following internal proceedings into kidnapping, extortion, and crypto theft. The officers had allegedly conducted illegal stop-and-searches and coerced victims into revealing wallet credentials. The dismissal echoes the legacy of the #EndSARS movement, in which the now-disbanded Special Anti-Robbery Squad was notorious for targeting tech and crypto workers. That history helps explain why the pattern is structurally persistent rather than a series of isolated incidents.

The involvement of law enforcement in attacks across both countries creates a reporting problem that hardware security and insurance products cannot solve on their own. Lloyd's of London has begun offering specialized coverage that includes wrench attack protection, but that kind of product is not accessible to retail holders in most of sub-Saharan Africa or South Asia. Notably, CertiK and Chainalysis data attribute sub-Saharan Africa's comparatively low aggregate monetary losses to lower individual wealth levels rather than lower incident frequency, meaning holders in those regions face genuine risk even when headline theft figures appear modest.

---

What Holders Can Do

Hardware wallets (physical devices used to store cryptocurrency offline) offer strong protection against remote hacks but provide no defense when a holder is under physical coercion.

Security researchers point to a few practical mitigations. Multisignature wallet setups, which require approvals from multiple separate keys before a transaction goes through, add friction that reduces the immediate value of coercion. Multi-Party Computation (MPC) wallets offer a similar distributed-approval model with no single key that can be seized. Time-locked transactions, decoy wallet features, and geographically distributed seed phrase storage (using decentralized storage networks such as Filecoin, IPFS, and Arweave) can further limit exposure. Crucially, researchers emphasize that publicly disclosing crypto holdings on social media provides targeting information to potential attackers regardless of what jurisdiction a person lives in.

The operational profile of the Garcia case suggests prior knowledge of the victim's holdings, consistent with a pattern that Crisis24 analysts describe as increasingly common among smaller, independent criminal cells in the United States. In the firm's assessment: "Unlike large, coordinated, international syndicates, American cells tend to act with ruthless efficiency and operate independently, making them unpredictable and more challenging to dismantle." The Garcia case, in which a remote coordinator directed a targeted, single-household operation while two brothers carried out the physical component, fits that general profile.