In brief
- Use multisig wallets or other techniques to create time delays.
- Practice a script you’d use under coercion (“The wallet is stored at my lawyer’s office and takes 72 hours to unlock.”)
- Keep a decoy wallet on your phone or hot wallet with a few thousand dollars.
- Cover your tracks. Never disclose your holdings or wallet structure in public or online.
In 2009, the webcomic xkcd published a strip that laid out one of the most chillingly simple concepts in cybersecurity: the “$5 wrench attack.” In the comic, a stick figure explains how to bypass sophisticated encryption—not with code or brute force, but by threatening someone with a $5 wrench until they give up their password.
Sadly, the $5 wrench attack is no longer a punchline. Far worse attacks are happening in real life, with alarming frequency. Criminals aren’t bothering to hack private keys or compromise seed phrases—they’re simply knocking on doors, kidnapping crypto holders, and demanding access to wallets, often with violence.
The most recent attack occurred a few days ago in Uganda, when Mitroplus Labs founder Festo Ivaibi was reportedly abducted near his home and forced at gunpoint to transfer crypto worth roughly half a million dollars.
In France, a series of horrific kidnappings and attempted abductions have alarmed the crypto community. Notably, the father of a cryptocurrency entrepreneur was kidnapped in Paris earlier this month, with his finger severed to pressure a ransom payment of €5–7 million in cryptocurrency. He was rescued after a two-day ordeal, and five suspects were arrested. In another incident, the pregnant daughter of a crypto CEO and her child were targeted in a daylight kidnapping attempt in Paris, which was thwarted by passersby. That was one of six attacks that have occurred there since January.
In the United States, three teenagers kidnapped a Las Vegas man in November after he hosted a crypto conference, and drove him 60 miles away into the Mojave Desert, where they demanded access to his cryptocurrency. They left him there after stealing $4 million in digital assets. Two of the suspects, both 16-year-olds from Florida, were recently apprehended and now face multiple felony charges, including kidnapping and robbery.
With Bitcoin reaching all time highs in recent days, that target on your back is bigger than ever. So what can you do when the weakest link in your security setup is you?
A growing class of tools, wallet setups, and physical protocols are emerging to defend against real-world coercion. Here’s how to start thinking like a crypto-savvy but extremely paranoid billionaire.
1. Multisig Wallets
Multisignature wallets require multiple private keys to authorize a transaction. A common setup is 2-of-3: two keys are needed to move funds, but three exist in total. If an attacker gets access to just one—say, by threatening you—then they still can’t drain your holdings.
Tools like Nunchuk and Casa allow users to split keys across locations (one at home, one in a bank vault, and one with a lawyer, for instance), making instant theft impossible.
Potential downside: The attackers can simply force you to beg one of the other keyholders to authorize the transaction.
2. Shamir’s Secret Sharing
A number of wallets, including Trezor Model T, support something called “Shamir’s Secret Sharing,” which sounds like the title of a children’s book but is actually a cryptographic algorithm that splits your recovery seed into multiple shards. You can distribute the shards to people or places you trust. Only a threshold number (for example, 3-of-5) of shards is needed to reassemble the key.
Another option is Vault12, which lets you assign guardians—family, lawyers, or business partners—who help you recover your vault only when needed.
Potential downside: Like multisig wallets, SSS is only as secure as your co-seed holders are coercion-proof.
3. Duress Wallets and Decoys
Lots of wallets, such as Blockstream Jade, support so-called “duress PINs.” Enter one PIN and access your real wallet. Enter another—under duress—and it opens a dummy wallet with a modest balance. It can even wipe the device with a secret emergency PIN.
Plausible deniability can be an excellent ploy if you’re a fast talker.
Potential downside: If an attacker has been stalking you online, then they might know that you’re holding millions, rather than the $267 that shows up in your decoy wallet.
4. Hiding your tracks
A great way to avoid an attack is to not look like a target in the first place. Privacy-preserving tools can reduce your visible footprint on the blockchain. The Monero (XMR) cryptocurrency, for example, uses stealth addresses and ring signatures to make transactions virtually untraceable (getmonero.org). Bitcoin wallets like Wasabi implement CoinJoin, a technique that mixes coins with others to obfuscate origins.
Potential downside: It’s fairly easy to figure out who’s a player in big crypto, whether they try to hide their riches or not.
5. Proximate and Remote Wipe
A number of good hardware wallets, including Trezor and Ledger, offer this feature, which can be invoked in a number of ways, including inputting a special PIN that immediately bricks your wallet. The Samourai wallet, once renowned for its extraordinary security until the Feds shut it down and arrested the founders for suspected money laundering, supported remote wipe via sending a special SMS. If you know what you’re doing, you can find the Samourai software from repositories on the internet and invoke that feature.
Potential downside: Bricking a wallet while someone has a gun to your head is risky; SMS texts can be intercepted.
6. Air-Gapped Hardware Wallets
Your average crypto billionaire keeps their crypto in one or more hardware wallets. And if they keep them in their homes rather than safe deposit banks or secret bat-caves, then they are well hidden. Devices like COLDCARD and Keystone Pro use QR codes or SD cards for signing transactions offline. Even if an attacker has your laptop, then they still need the physical device, PIN, and (usually) another co-signer.
Potential downside: A highly motivated and violent thief likely has ways to force you to access your hardware wallet. We’ve all seen the movies.
7. Wearable Panic Buttons with GPS Tracking
Compact, wearable emergency buttons have been around forever. They were invented for your garden variety, paranoid high net-worth individual, not crypto people. Devices such as Silent Beacon can call any phone number, and send alerts with the user’s GPS location to designated contacts. It also features two-way communication, allowing the victim to talk to their prospective rescuers.
Potential downside: Wearing a panic button signals to a potential bandit that you indeed are protecting something valuable.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.