Physical Security for Crypto Holders: Wrench Attacks and Privacy

A crypto wrench attack is a physical attack — a robbery, home invasion, kidnapping or threat against family — in which criminals force someone to hand over cryptocurrency or reveal their keys. It gets its name from a simple point: strong encryption doesn't help if someone is threatening you in person until you unlock your wallet.

Because crypto can be transferred quickly and irreversibly, a holder who is known to own a lot of it can become a target in a way that someone with a bank account often isn't. The good news is that most of the protection comes from privacy and from wallet setups that make a single coerced moment less valuable to an attacker. This guide explains how these attacks work and what you can do.

How a Wrench Attack Unfolds

Most physical attacks follow a similar pattern:

1. 1Target selection. The attacker identifies someone they believe holds valuable crypto, often from social media, public appearances, data leaks or careless conversation.
2. 2Information gathering. They find a home address, daily routine, vehicle or family members, sometimes using leaked customer data or public records.
3. 3Approach. The attack may be a street robbery, a staged meeting (for example, an in-person over-the-counter trade), a home invasion or a kidnapping.
4. 4Coercion. The victim is forced to unlock a phone, hardware wallet or exchange account and send funds.
5. 5Laundering. Stolen funds are moved quickly through many addresses or swapped, making recovery hard.

A Composite Example

This is a hypothetical scenario combining common patterns, not a real case.

Imagine Jordan, who has posted for years about crypto under his real name, including screenshots of profitable trades. A customer database from an online store he used is leaked, exposing his home address. Months later, two people posing as delivery workers force their way into his home and demand he unlock his hardware wallet. Because all of his savings sit behind one device and one PIN, everything is taken in minutes.

Each step was preventable: the public bragging, the identity link, and a setup where one coerced PIN unlocked everything.

Warning Signs Checklist

• Strangers who seem unusually interested in how much crypto you hold or where you keep it.
• Requests for in-person trades with large amounts of cash or crypto.
• Unexpected "deliveries," "maintenance visits" or callers asking for you by name.
• Feeling followed, or noticing people around your home or office repeatedly.
• Phishing or fake support messages that seem to know personal details about you — a sign your data may have leaked.
• Messages referencing your holdings or wallet address alongside your real name.

Protect Your Privacy First

Data leaks happen even at reputable companies; customer records from crypto-related services have been exposed in the past. Assume any data you give a company could one day become public. Our guide on how to protect your privacy when using crypto goes deeper.

Wallet Setups That Reduce What Can Be Taken

Split your holdings

Keep only a modest amount in wallets you carry or can access instantly. Store long-term savings separately, ideally in a setup that can't be emptied quickly.

Multisig and geographic separation

A multisig wallet requires several keys to approve a transaction — for example, two of three. If the keys are stored in different locations, an attacker can't complete a transfer from one place in one encounter. Our guide on how to use multisig wallets for shared funds explains how they work.

Time delays

Some custody setups and exchanges support withdrawal delays or allowlists of approved addresses. A delay gives you time to alert others and makes coercion less rewarding.

Decoy and hidden wallets

A passphrase (sometimes called the 25th word) creates a separate hidden wallet from the same seed phrase. Some people keep a small balance in the standard wallet as a decoy. This can help, but be cautious: an attacker who suspects a decoy may become more violent. Read passphrases (the 25th word) explained before using one.

Plan for your family

Make sure trusted relatives know what to do in an emergency without knowing how to access funds themselves. Our guide on inheritance planning for crypto covers secure handover planning.

What to Do If It Happens

1. 1Prioritize safety. Comply if you or others are in danger. No amount of crypto is worth your life.
2. 2Call the police as soon as it's safe and get a report reference.
3. 3Secure what's left. From a safe device, move remaining funds to new wallets with new seed phrases, and change passwords and PINs.
4. 4Record details. Note transaction IDs, addresses, times and any descriptions of the attackers.
5. 5Notify exchanges that may receive the stolen funds; some can freeze deposits if alerted quickly.
6. 6Report it. See how to report a crypto scam and what happens next, and you can flag related addresses or fraud through our submit a request page.

Bottom line

Wrench attacks bypass technology by targeting the person, so the best defenses are privacy, not advertising your holdings, and wallet setups that prevent one coerced moment from unlocking everything. Keep your identity separate from your addresses, split and spread your funds, consider multisig or delays for long-term savings, and remember that your safety always comes first.