Wrench Attack

A wrench attack is the use of physical force, threats, or coercion to make someone reveal a password, seed phrase, or PIN — defeating even unbreakable cryptography by attacking the person rather than the math. The name comes from a widely shared 2009 xkcd comic that pointed out the futility of ever-stronger encryption against an attacker willing to use a cheap wrench. In security literature the same idea is called rubber-hose cryptanalysis: the cheapest attack on a $5 wrench beats the most expensive attack on a 256-bit key.

Why it has become a Bitcoin problem

As cold storage, multisig, and hardware wallets have made remote theft genuinely hard, criminals have shifted to the human attack surface: if you cannot break the code, you break the person. Researchers tracking these incidents have documented hundreds of physical attacks on cryptocurrency holders — home invasions, kidnappings, staged deliveries — and the pattern persists because Bitcoin is high-value, portable, and irreversible once transferred. A victim coerced into signing a transaction has little recourse: there is no chargeback, no freeze order that reaches a UTXO, and often no way to prove duress after the fact. Targeting usually begins with information: public boasting, visible mining operations, leaked exchange databases, or a delivery record tying expensive hardware to a home address.

The first defense is silence

Because cryptography offers no protection here, the cheapest and most effective layer is privacy: practice rigorous OPSEC so that no one knows you hold Bitcoin in the first place. That means not discussing holdings publicly or socially, being deliberate about what ships to your home address and in whose name, keeping mining noise and heat signatures discreet, and treating "how much do you have?" as a question that never gets a true answer. Compartmentalization helps: the identity that posts about Bitcoin online should not be trivially linkable to the person and address where you sleep.

Structural defenses

The second layer makes coercion unprofitable even when privacy fails. Geographically distributed multisignature setups mean the attacker in your living room cannot reach enough keys to move funds no matter what you surrender — the honest answer "I physically cannot send it from here" is the point. Timelocks delay spending so an attack cannot conclude quickly, raising the attacker's risk. Decoy or duress wallets holding plausible-but-small balances give you something to hand over. Whatever the design, everyone in the household should know the plan, because the coercion rarely limits itself to the keyholder. The goal is not to win a confrontation — comply, stay alive, lose only what the structure allows — but to ensure that force cannot extract everything.

The physical layer still matters, and it is mundane on purpose: solid doors and locks, exterior lighting, cameras that record off-site, and a dog are deterrents that work against exactly the opportunistic end of this threat. So does breaking the delivery trail — mining hardware shipped to a parcel depot or business address, in packaging that does not advertise its contents, never creates the "expensive machines live here" record that a porch camera or a curious courier otherwise produces. And rehearse the plan: everyone in the house should know that the correct response to force is compliance within the structure — hand over the decoy, state truthfully that the rest cannot be moved from here, and let the architecture do its job.

Put it in the threat model

A realistic wrench-attack scenario belongs in every holder's threat model, even though it is uncomfortable to contemplate. For most people the honest assessment is that the risk is low but the consequence is severe, which argues for the cheap defenses — privacy, quiet self-custody, no public trail — universally, and the structural ones in proportion to what you actually hold. The sovereign posture is not paranoia; it is the same discipline a good machinist applies to a spinning lathe: respect the failure mode, design so that one mistake is not catastrophic, and never advertise where the valuables are kept.