TL;DR
Your safety comes first. If someone threatens you, give them what they ask for. A multisig helps when your keys aren’t all within reach: keep at least one key away from home, so nobody at your door can force a payment on the spot. Your best protection is still that nobody knows you hold bitcoin.
The name comes from an old xkcd comic: why crack strong encryption when a $5 wrench and a threat will get you the password? With bitcoin, the physical version is real. Robbers who know you hold coins don’t need to hack anything. They need you, and your devices.
Are these attacks really rising?
Yes. Security firm CertiK counted 52 verified wrench attacks worldwide in the first half of 2026, against 39 in the same period of 2025. Home invasions went from one publicly reported case to 20. France alone had 33 of the 52. CertiK warns that many cases are never reported, so the real number is higher.
Jameson Lopp, a long-time bitcoin security engineer, keeps a public list of known physical attacks on GitHub, with a source for every entry. In December 2025 he told Cointelegraph that reported attacks rose 169% in 2025, and that about a quarter were home invasions. The list itself notes it isn’t complete.
Your safety comes first
If you’re threatened, cooperate. No amount of bitcoin is worth an injury, to you or to someone you live with. Don’t try to outsmart an armed person with a clever wallet trick. Afterwards, go to the police, and treat every key and backup the attacker saw as exposed.
What a 2-of-3 multisig does against a wrench
A multisig needs two keys to sign. If only one of them is in your house, a robber at your door can’t get a payment out of you on the spot, because you can’t hand over what you don’t have. You can show them that honestly: one device, and nothing else to sign with.
That only works if you set it up that way. In the setup guide the three seed backups go to three places (where to store three seed backups), but many people keep all three devices at home, next to the signing laptop. Then two keys are within reach, and the multisig adds nothing against a wrench. If physical coercion worries you more than convenience, keep at most one device at home and the others somewhere else, such as an office you control or a safe deposit box.
Spreading keys over people works the same way. If your partner or a relative holds one of the signing keys, someone threatening you alone still gets only one. Multisig with your partner or family covers who should hold what.
What it doesn’t do
- It doesn’t stop an attacker who is willing to wait, or to take you to where the second key is. Keys in other places raise the effort. They don’t make you immune.
- It doesn’t protect the people around you. CertiK’s report notes that attackers also go after a partner, parent or child, who often know less and have more predictable routines.
- It doesn’t help if two keys are at home after all: two devices in a drawer, or one device plus a seed backup in the same house.
- It makes your own spending slower. Every payment now needs a trip. That’s the trade-off you’re choosing.
Decoy and passphrase wallets: honest pros and cons
A decoy is a wallet you can hand over under pressure: a small single-sig wallet with a believable amount in it, or the wallet a device opens without its passphrase. The idea is that the attacker leaves with that and doesn’t know the rest exists.
| Decoy or passphrase wallet | |
|---|---|
| For | Gives you something real to hand over quickly. Costs little to set up. |
| Against | It only works if the attacker doesn’t know about passphrases or multisig, and many do. An empty or tiny wallet can make things worse. In the same interview, Lopp described one victim whose decoy didn’t convince the attacker, and another who handed over everything and was still hurt for hours because the robbers believed more was hidden. |
| In this setup | A passphrase protects against a leaked seed, not against a wrench. If you keep it with each seed, as I do, it isn’t a secret you can withhold. Under threat, don’t gamble on one. |
Lopp’s own conclusion was that there’s not much anyone can say for sure about whether duress wallets work. I agree with that. If you set one up, keep a believable amount in it and think of it as a way to end a confrontation quickly, not as a way to fool someone.
Don’t become a target
Most victims were picked because someone knew, or guessed, that they held crypto. That’s the part you control best.
- Don’t talk about your holdings, not at work, not at parties, not online. No screenshots of balances, no posts about buying the dip.
- Don’t wear or display crypto merchandise, and don’t tell people you run a multisig.
- Assume customer data leaks. Ledger’s 2020 breach exposed names and postal addresses, and in May 2025 Coinbase said bribed support staff had copied customers’ names, home addresses, ID images and balance snapshots. Every exchange account links your name and address to bitcoin.
- Consider having hardware wallets delivered to an address other than your home, such as a work address or a parcel pickup point, if your country allows that.
- Keep the list of where your keys are on paper, in your sealed inheritance letter, not on a computer or phone.
- Make sure the people you live with know the rule: if threatened, comply, then call the police.
Do timelocks help?
Partly, and not in the way people hope. Liana adds a recovery key that can only spend coins after they’ve sat unmoved for a set time. That’s built for inheritance, not for coercion: the everyday key can still spend at any time, so it’s the one an attacker will want.
Bitcoin can also lock coins so nobody can spend them before a certain date. That would frustrate a robber, but it also locks you out in a real emergency, and setting it up safely needs software outside this guide. I don’t use either for coercion and I wouldn’t recommend it to most people.
If it happened to you
- Get safe and call the police. Give them the facts, including that it was about bitcoin.
- Treat every device, PIN, seed and passphrase the attacker saw or took as exposed. In a 2-of-3 one exposed key isn’t enough to spend, but don’t wait.
- Build a new multisig with fresh seeds and move everything to it, as in a seed backup was seen or taken.
- Ignore anyone who contacts you afterwards offering to recover your coins. That’s a scam, and so is anyone asking for seed words.
Common mistakes
- Three devices at home and calling it protection against coercion.
- Relying on a decoy wallet to bluff an attacker.
- Talking about bitcoin with people who don’t need to know.
- A partner who doesn’t know the plan, or that they should simply comply.