Physical Security, Coercion and Keeping Quiet

Physical security for a bitcoin holder means two things: the people who might hurt you never learn that you hold bitcoin, and anyone who does reach you can’t move most of it quickly. Keep your holdings to yourself, keep part of what it takes to move your savings away from your home and from what you carry, and if you are ever threatened, hand over what is asked, because your life comes first. Cryptography protects your keys from hackers. It can’t protect you from someone standing in front of you, and reported attacks of this kind reached a record in 2025.

The chain analysis lesson showed why a balance linked to your name puts you at risk. This lesson turns that warning into a plan you can follow, and most of it costs nothing but habits.

What a Wrench Attack Is, and How Often It Happens

A wrench attack is any attempt to make you unlock your wallet and send bitcoin by threat or violence: a street robbery, a break-in while you are at home, a kidnapping, or an ambush at an in-person trade. (The Scams That Empty Self-Custody Wallets explains where the name comes from.)

The most complete public record is the list of known physical attacks on bitcoin and other crypto holders kept by Jameson Lopp, a Bitcoin security engineer and co-founder of the multisig company Casa. It also includes thefts of mining machines and bitcoin ATMs. As of early November 2026 it has about 800 entries, starting in December 2014. It more than doubled in October 2026, when Lopp added hundreds of cases found by another project that searches local news in around thirty languages, so the totals reflect how hard people look as well as how often attacks happen. 2025 has the most of any year, 170, and 2026 had reached 146 by late October. Among the entries for 2025 and 2026, France has the most, followed by Taiwan and the United States.

The list counts only attacks that were reported, and many are not. In a 2024 academic study of wrench attacks (Ordekian and colleagues), only two of the eleven attacks its interviewees described had been reported to the police; victims feared that coming forward would make them targets again. Patterns in the known cases:

• About a quarter of the roughly 225 attacks Lopp had catalogued by mid-2025 were home invasions, and about 23% were kidnappings, often after the attackers had watched the victim’s movements.
• About 10% of them involved someone the victim knew: a business partner, a friend or a relative.
• About two-thirds of them succeeded, at least at first. Self-defence rarely worked, and around 3% ended in murder.
• In the news reports the 2024 study collected, a quarter of the attacks happened during in-person trades.

Keep this in proportion. Lopp himself calls wrench attacks “an extreme edge case” and puts bigger risks first, above all trusting third parties with your coins. The answer is calm design: a few habits take away what attackers rely on, which is knowing who you are, where you live and how much you can move in a few minutes.

Step 1: Keep Your Holdings Unknown

Attackers choose their victims. In the 2024 study, every attack the interviewees described targeted someone the attackers believed held crypto, whether they knew it from a friendship, a trade, their own digging or public information. Each way someone can learn about your bitcoin is a way they can choose you.

What you say and post

• Keep amounts to yourself. No balances, screenshots, “my stack” photos or boasts about gains, online or off. If your work makes it obvious that you use Bitcoin, follow the rule one interviewee gave the researchers: “we never disclose the amount”.
• Keep Bitcoin talk away from your real name and face. Lopp calls this the most effective way to lower your risk, and it covers social media, podcasts and forums alike. A pseudonymous account protects you only while nothing links it to you, such as a photo, your town or your employer.
• Tell only the people who need to know, such as your heirs (see inheritance planning). Even people you trust can repeat things, or come under pressure you know nothing about.
• Keep any address linked to your name small. An address you’ve published for donations or invoices shows its balance to anyone.

What companies hold about you

KYC (“know your customer”) is the identity check that regulated exchanges and many other services must carry out: they collect your name, address and ID documents, and keep them. Shops that sell hardware wallets and crypto tax tools hold similar records. Those databases can leak, and several have:

Made public	Whose data	What came out
December 2020	Ledger, a hardware wallet maker	Customer data stolen from its online shop earlier that year was posted publicly: about a million email addresses, and the names, postal addresses and phone numbers of more than 270,000 customers.
May 2025	Coinbase, an exchange	Criminals paid support staff to copy customer records: names, addresses, government ID images, balance snapshots and transaction history. Coinbase reported 69,461 people affected.
January 2026	Waltio, a French crypto tax service	Users’ email addresses with figures from their 2024 tax reports, in many cases including year-end balances.

Leaked data is now one of the ways targets are chosen. In June 2026 three armed, masked men confronted a woman in her yard in northern France; according to reporting from the trial of one of them, she had been singled out through the Waltio data passed around on criminal websites. The men fled with nothing. Lopp sees leaked customer data as one of the reasons for home invasions: between public records and leaks, most people’s home addresses are easy to find.

• Give companies less to lose. Where you can, get bitcoin without KYC, and keep as little as possible with any service that knows your name.
• Have Bitcoin purchases delivered somewhere other than your home, such as a parcel locker or pickup point: hardware wallets, metal backups, even books.
• Use a separate email address for Bitcoin services, as Waltio itself advised after its leak, so a leaked list doesn’t lead straight to your everyday identity.
• Assume old data is out there. If a shop or service you used has leaked, treat unexpected visits, calls and messages about your bitcoin with extra care.

Step 2: Habits at Home and When You Travel

At home

• Open the door only to visitors you expect. Attackers in Lopp’s list have posed as delivery riders and as police. A real courier can come back, and a real officer will understand if you call the station to check, on a number you look up yourself.
• Layer your home security: good locks, an alarm, cameras and, as Lopp suggests, a dog. His list records an attempt in France in October 2026 that failed after a dog barked and the alarm and cameras went off.
• Keep part of what opens your savings out of the house. An intruder can make you open a home safe. If you keep a seed backup at home so it can’t be lost, keep its passphrase or your other multisig keys elsewhere (both come up below). Never keep a seed backup, its passphrase and the hardware wallet together, and label nothing “bitcoin” (seed phrase storage covers locations).
• Agree a plan with the people you live with: who knows what exists, and that everyone’s safety comes before any coins.
• Notice when you are being watched. In France in January 2025, police arrested four men carrying cable ties and tear gas near the home of a tax adviser who held crypto, after his partner found a GPS tracker outside the house and a van had sat nearby for days. If you find a tracker or keep seeing the same car, tell the police.

On the move

• Carry only spending money. A phone wallet suits small amounts. Attackers in Lopp’s list have used victims’ faces or fingerprints to unlock their phones and reach the wallets inside.
• Travel without the keys to your savings: no seed backups and no hardware wallet that can move them. If you must travel with a signing device, Coldcard’s documentation suggests its spending limits for exactly that case (more below).
• Keep your full balance off the devices you carry. A watch-only wallet shows your balance and addresses but can’t sign. At home it is convenient; on a laptop you travel with, it shows anyone who takes it exactly how much to demand.
• Share where you are after you’ve left. The 2024 study recommends not revealing your location before you travel. Leave Bitcoin events discreetly too: Lopp describes an event organiser in Las Vegas who was followed home afterwards and kidnapped.
• Trade with strangers online, not face to face. If a meeting is unavoidable, choose a busy public place (never a hotel room or car park), bring someone, start small and carry only what the trade needs. Buying Bitcoin Without KYC covers peer-to-peer platforms where you never meet.
• Accept food and drink only from people you trust with your life. Lopp’s list has more than a dozen cases of victims drugged, often by someone they had met through a dating app or in a bar.

Step 3: Decoy Wallets, and Their Limits

A decoy wallet (also called a duress wallet) holds an amount you can hand over under pressure while your savings stay hidden. Two common ways to set one up:

• A passphrase wallet. A passphrase (sometimes called the 25th word) is an optional extra word or phrase added to your seed words, as the BIP39 seed standard allows. Each passphrase opens a separate wallet: the words alone open the decoy, the words plus the passphrase open your savings. Seed phrase storage and our 25th word guide show the setup.
• A duress PIN. Some hardware wallets, Coldcard among them, let you set a second PIN that opens a separate wallet with give-away funds. Coldcard can also set PINs that wipe the seed or make the device useless for good.

Both can help. Know their limits before you rely on them:

• Attackers know these features exist. Coldcard’s own design notes point out that the features have to be documented on the internet, where anyone can read about them.
• A decoy has to match what the attacker believes you hold. If a leak showed your exchange withdrawals or your year-end balance, as the Coinbase and Waltio leaks did, a decoy far below that figure won’t convince.
• Anything that shows your total gives it away. Coldcard’s documentation warns that anyone holding your device and its main PIN can load your full balance in another wallet, and a watch-only wallet of your savings does the same.
• The evidence is thin. “There’s not much we can definitively state about the effectiveness of duress wallets/triggers, because we have so little data,” Lopp told Cointelegraph in December 2025. Some attacks in the 2024 study failed because the wallet held nothing or the access given was fake. Lopp knows of a victim whose decoy didn’t convince the attacker, and another who complied at once but was still hurt for hours because the thief assumed more was hidden.
• A forgotten passphrase means a lost wallet. Back it up apart from the seed words and test the backup.

Treat a decoy’s balance as money you are prepared to hand over, and make it believable for your situation. It works best together with the next layer.

Step 4: Make Large Sums Slow to Move

Lopp’s central advice is about speed: “It should be intentionally difficult for you to move large amounts of your net worth.” If you alone, at home, can move everything in a few minutes, so can anyone who forces you.

Multisig protects you through where the keys are

A multisig wallet needs several keys to sign a payment, for example any 2 of 3 (see Multisig Wallets Explained). Against coercion, what counts is where those keys are. If your phone holds one key and the hardware wallet in your desk another, an intruder can still force a payment, because both are in the house.

Spread the keys so that no single place, and nothing you carry, holds enough to spend. For example, keep one key at home, one in a bank safe-deposit box or with a relative in another town, and one with a collaborative custody service: a company that holds a key and co-signs when you ask (Multisig in Practice compares them). A payment then needs either a trip to the second place or the service’s signature, and some services can be set to wait before they sign (below). The 2024 study notes that multisig lets a victim say they can’t move the funds alone. With the keys spread out, that is simply true.

Delays come from a co-signer that waits

Bitcoin’s rules have no built-in way to make a payment wait once you have signed it; the timelocks from the inheritance lesson do a different job, opening an extra way to spend after a delay. Proposals for such a “vault”, like OP_VAULT (BIP 345, now closed), were not part of Bitcoin’s rules as of November 2026. Today a delay comes from a signer that won’t sign quickly:

• A co-signing service with a waiting time. On its paid plans, Nunchuk holds one key in your multisig, the Platform Key, which you can set to wait a fixed time, such as 24 hours or 7 days, before it co-signs, and to co-sign only up to a spending limit. A delay helps only if it can’t be switched off on the spot: in 2024 Nunchuk made shortening the delay itself wait as long as the current delay.
• A device with a spending policy. Coldcard’s spending policy makes the device refuse to sign more than a set amount per transaction, or sooner than a set time after the last one, and can require a code from an authenticator app on your phone. Lifting it needs a separate PIN.
• Distance. A key in another city takes hours or days to fetch.

Delays have limits too: an attacker can hold you until the time runs out, make you phone whoever holds a key, or demand the PIN that lifts a device’s limits. They work best alongside a layer you can hand over at once:

Layer	Where it lives	How fast it can move	Its job
Spending wallet	Your phone	Immediately	Daily payments; small enough to lose
Decoy (optional)	A passphrase or duress PIN	Immediately	A believable amount to hand over
Savings	Multisig with keys in different places, or a co-signer with a delay	Hours or days	Most of your bitcoin, too slow to take by force

Record these choices in the physical security row of your sovereignty plan.

If You Are Threatened: Your Life First

Everything above makes an attack less likely and less rewarding. If one happens anyway, your only goal is to come through it safely.

• Comply. British police put it plainly in their robbery advice: “don’t risk your personal safety. Property can be replaced, you can’t be.” Bitcoin is property. Lopp finds that self-defence rarely succeeds, even with a gun.
• Hand over what you can move straight away. That is what the spending wallet and the decoy are for.
• State facts calmly. If part of your savings really can’t be moved there and then, say so plainly. This is why the slow layer has to be real: an attacker who suspects you are hiding something may keep going.
• Use tricks only if you chose them beforehand. A PIN that wipes or disables the device may go unnoticed at first, but sooner or later the attacker finds the wallet empty, and your seed backup still exists elsewhere. Make that choice when you are calm, never in the moment.

Afterwards

1. Get safe and get help. Call the emergency services and get medical care.
2. Report it. Reporting gives the police a chance to catch the attackers. In the attacks Lopp had looked into by mid-2025, about 60% of the suspects were caught, as far as the news reported.
3. Treat every key, PIN and passphrase you revealed as known. Move what’s left to a new wallet with new seed words, created on a device the attackers never touched.
4. Keep your name out of the news. Some victims have been attacked more than once, likely because news of the first attack made them known, so ask investigators to keep your identity and address private.
5. Check what else they learned, such as addresses or family details. The Scams That Empty Self-Custody Wallets covers the digital clean-up.

Check Your Understanding

1. A friend posts a photo of his hardware wallet under his real name, captioned “1 BTC, safe in cold storage”. His seed words are in a safe. What risk is left, and what should he change?

Answer

Cold storage protects him from hackers, not from people who now know his name and that he holds a bitcoin, which is how attackers choose targets. He should delete the post and assume it has been seen, stop sharing amounts, and make his savings slow to move, for example with multisig keys in more than one place.

2. Your savings are in a 2-of-3 multisig. Your phone holds one key, the hardware wallet in your desk the second, and a collaborative custody service the third. How well does this protect you in a home invasion?

Answer

Poorly. Two keys are in the house, so an intruder can make you sign with the phone and the hardware wallet. Move the hardware wallet away from home, for example to a safe-deposit box or a relative in another town. Your phone can then sign only together with the service, so choose one that waits before it co-signs, such as 24 hours: that makes the last quick route slow. You can then say truthfully that you can’t move the savings on the spot, and hand over a small spending wallet instead.

3. Your name and balance were in a leaked exchange database that showed you withdrawing 1.5 BTC. Your decoy passphrase wallet holds 0.002 BTC. Why might the decoy fail, and what would make your setup stronger?

Answer

An attacker who has seen the leak expects about 1.5 BTC, so 0.002 BTC looks like a trick, and attackers know passphrase wallets exist. Make the decoy an amount that fits what you appear to hold and that you are prepared to lose. Put the rest beyond quick reach, with multisig keys in different places or a co-signer with a delay. If you are ever threatened, hand over what you can: your life comes first.