The Exported
Playbook

Three conditions converged in France before they converged elsewhere. Leaked datasets, including tax records, tied identified holders to home addresses at national scale. A deep pool of recruitable local labor, reachable through messaging platforms, lowered the cost of assembling crews for single jobs. And a run of publicized cases established, for anyone watching, that coercion pays and that the proceeds move fast. Understand those as inputs rather than culture and the concentration stops looking like geography. It looks like sequencing.

Across the European caseload the operational chain is consistent and simple. Merge leaked and public data into target files keyed to addresses and perceived holdings. Recruit interchangeable local crews over encrypted messaging, often for a single task. Apply coercion where the target is most reachable, usually the residence, sometimes through a lure to a controlled location. Convert and move proceeds on-chain within hours. Every element of that chain already exists in every major market: the leaked data is global, the recruitment channels are global, and the settlement rail is global by design. What differs between countries today is accumulated precedent, not capability.

For principals outside the current hotspot, the planning question is commonly framed as whether the local caseload justifies preparation yet. ERS would reframe it: preparation is cheap before precedent and expensive after it, because after it you are competing for protective capacity with everyone else who waited, and possibly serving as the precedent yourself. A visibility audit, kidnap-prevention training for the principal and family, and a rehearsed household protocol are modest, one-time investments. They are also precisely the measures that degrade this playbook at its cheapest point, target selection, rather than its most dangerous point, the confrontation.

Enforcement is improving in the hotspot, and French units have resolved cases at a high rate. Improved enforcement in one market historically redistributes portable crime rather than retiring it. The H1 data should therefore be read by boards, funds, and family offices in every major market as a leading indicator, not a foreign news item. The playbook has been proven. The export phase is the part you can still get ahead of.

This briefing draws on CertiK's H1 2026 wrench attack reporting as covered by The Record and industry press in July 2026, alongside ERS caseload observation in Europe. We publish aggregate figures only, describe no incident mechanics, and frame readiness without fear. That is editorial policy.