What Is a Wrench Attack? Physical Coercion Risk in Crypto

By the Guardian team Updated November 2026 5 min read

Quick answer. A wrench attack is physical coercion of a crypto holder: threats, kidnapping or violence to force a transfer or reveal keys. It bypasses technical security, so the defense is custody no one person can unlock, and less exposure.

Watch: What Is a Wrench Attack? Physical Coercion Risk in Crypto 1:36

Video transcript

Strong encryption has one weak point: the person who holds the key.

A wrench attack is physical coercion of a crypto holder: threats, kidnapping or violence to force a transfer or reveal keys.

Many attacks are never reported, but Jameson Lopp's public list records 170 attacks in 2025, up from 106 in 2024, by our count.

France stands out, rising from six listed attacks in 2024 to fifty one in 2026 through October 24. Victims included Ledger co-founder David Balland.

SEAL names founders and treasury staff, but also family, drivers and assistants. Targets surface through onchain data, leaks and crypto conferences.

A hardware wallet fails once the holder can be forced to use it. Cryptography protects keys from algorithmic attack, not from coercion.

The fix is custody no single coerced person can drain. Think three of five multisig, keys in bank vaults, and time delays on large moves.

Add duress procedures like a small surrender wallet, cut public exposure, and harden your home and routine. Then rehearse quarterly.

Guardian designs key custody and approval thresholds before they are built, audits who holds which share, and reviews every multisig transaction before signing.

Read the full article, or talk to Guardian about custody no one person can unlock.

Strong encryption has one weak point: the person who holds the key.

In January 2025, Ledger co-founder David Balland and his partner were kidnapped in France for a crypto ransom, AFP reported. Police freed both.

Physical attacks on crypto holders are rising. Jameson Lopp's public list records 170 in 2025, up from 106 in 2024, by our count.

Wrench Attack Defined

A wrench attack forces a crypto holder, in person, to hand over funds or keys.

The Security Alliance (SEAL) says it "bypasses technical security by directly targeting the person who controls the keys." SEAL traces the name to an xkcd comic: encryption falls more easily to a $5 wrench than to a supercomputer.

Lopp's list covers several forms:

Home invasions demanding transfers, seed phrases or hardware wallets
Kidnappings for a crypto ransom
Robberies during in-person trades
Impersonators, such as fake police or delivery drivers, gaining physical access
Torture or threats to force a transfer or reveal keys

How Fast Attacks Are Rising

Lopp's GitHub list tracks physical attacks on crypto holders, each with a published source. We counted its entries by year on November 5, 2026.

Year	Listed attacks	Of which in France
2021	87	1
2022	87	1
2023	74	3
2024	106	6
2025	170	25
2026, to October 24	146	51

Read it with care:

The list says it is "not comprehensive; many attacks are not publicly reported."
Its scope includes violent attacks on crypto businesses and thefts of mining hardware.
Each entry needs "at least one credible published source."
Some entries cover several victims, such as a couple or a family.

France in 2025

France stands out. Its entries rose from 6 in 2024 to 25 in 2025, and 51 in 2026 to October 24.

Date	What happened	Outcome
January 21	David Balland and his partner kidnapped; a video showed his mutilated finger	Police freed both; most crypto paid was seized and frozen
May 1	A crypto entrepreneur's father abducted in Paris; a finger cut off, per a source	Freed in a police raid
May 13	Attempted abduction in Paris of a crypto exchange CEO's daughter, partner and child	All three escaped with mild injuries

Details are from AFP, via The Local and France 24. Three days after the Paris attempt, the interior minister met crypto business leaders.

Measures discussed included closer work with police, security briefings and anti-laundering training, CoinDesk reported.

Who Gets Targeted

Anyone believed to hold crypto. SEAL's threat model names founders and treasury staff as key-holders.

It also names family, partners, children, drivers and assistants, who can give access or serve as leverage. Two of the French cases above targeted relatives, not the holders.

Targets are found through:

Public onchain data, social media and leaks, which SEAL says make targets easier to identify.
Lifestyle and loose talk.
Crypto conferences and side events, which SEAL calls "particularly attractive hunting grounds."

Leaks can come from companies you trust. In a May 2025 8-K, Coinbase said a threat actor paid contractors or employees in support roles outside the US for customer data.

Coinbase said the data included names, addresses, phone numbers, emails, government ID images, balance snapshots and transaction history. It said no passwords or private keys were involved. The filing does not mention physical attacks.

Why Technical Security Falls Short

SEAL puts it plainly: "Cryptography protects keys from algorithmic attack, not from coercion of the people who hold them."

A hardware wallet, a seed phrase in a safe and a strong password all fail once the holder can be forced to use them.

What works is custody the person under threat cannot unlock alone, quickly or in full.

SEAL's goal is that "no single coerced individual can drain strategic reserves under pressure."

How to Reduce Your Exposure

SEAL's coercion and duress framework sets out the controls. They fall into four groups.

Custody no one person can move

Multisig of at least 3-of-5 or 4-of-7 for any material movement.
Or MPC, where no single key share can spend.
Keys in bank vaults or secure facilities, never at home or the office.
Time delays on large moves, so an attacker must hold control for longer.
Hot wallet limits; SEAL suggests daily caps under $10,000.
For companies: no one person moves more than 1% to 5% of treasury without a second approver.

For signer setup, see our multisig best practices.

Duress procedures

Keep a small "controlled-surrender" wallet, $2,000 to $5,000, you can hand over.
Tie its duress PIN to a silent alert to trusted contacts.
Agree a safe word family members can text to an emergency contact.
Lower limits and raise required approvals while traveling.

During an incident, SEAL puts human safety first. It warns against any action that could escalate violence while someone is under direct threat.

Less public exposure

Remove home addresses, vehicle plates, routines and geotagged photos from public profiles.
Keep the signing identity apart from the public one, with a separate signer phone.
Brief family and staff never to discuss assets or locations.
Consider a trust or LLC to obscure who owns the assets.

Home and routine

Reinforced doors and windows, cameras with remote alerts and a safe room.
Discreet panic buttons at home and in vehicles, linked to a monitoring service.
No visible hardware wallets, recovery sheets or crypto-branded items.
Varied commutes and routines; drivers trained to report surveillance.

Then rehearse. SEAL's checklist calls for quarterly tabletop exercises on coercion and kidnapping, like those in our tabletop scenario library.

For the wider baseline, read OpSec for crypto founders and teams.

How Guardian Helps

Guardian works on the custody side of this risk.

Its institutional practice specifies trust boundaries, privileged roles, approval thresholds and key custody "before they are built rather than audited after."

An OpSec audit maps where keys live, who holds which share and what a quorum requires. It also flags single points of failure and checks whether incident runbooks hold up.

After launch, Managed Security reviews every multisig transaction before it is signed.

Frequently Asked Questions

What is a $5 wrench attack?

The same thing: physical coercion that forces a crypto holder to transfer funds or reveal keys. The name comes from an xkcd comic in which a $5 wrench defeats strong encryption by targeting the person, not the math.

How common are wrench attacks?

Jameson Lopp's public list records 170 physical attacks on crypto holders in 2025 and 146 in 2026 through October 24, by our count on November 5, 2026. The list says many attacks are never reported.

Does multisig stop a wrench attack?

It limits what an attacker can take. If large moves need several signers in different places, or a time delay, coercing one person cannot drain reserves. It does not protect the person, so add personal safety controls.

What should you do during a wrench attack?

SEAL puts human safety first and warns against anything that could escalate violence. It also advises rotating signers, moving funds out of exposed wallets and engaging law enforcement through counsel.

Sources

Design custody no one person can unlock

Guardian specifies approval thresholds and key custody before they are built, rather than auditing them after.

Talk to Guardian Explore institutional security