The five-dollar wrench

The joke is older than most of the wallets in use today. In xkcd number 538 (2009), one panel shows what a cryptographer imagines: a cluster of computers grinding on a 4096-bit key for years. The next panel shows what actually happens: "Drug him and hit him with this $5 wrench until he tells us the password."

A seed phrase is the same story. Twelve or twenty-four words, 128 or 256 bits of entropy, a passphrase stretched through 2,048 rounds of PBKDF2. None of that matters to someone standing in your kitchen. They don't attack the maths. They attack the person who knows the words, or the drawer the words are in.

What a wrench attack looks like

Jameson Lopp keeps a public list of physical attacks on bitcoin holders, going back to 2014. Read a page of it and a pattern appears. The attacker already knows the victim holds coins, usually from a leaked customer list, a social media post, a business that takes bitcoin, or a friend of a friend. They turn up at the home, often with the family present. They want the hardware wallet, the words, and the PIN or passphrase, and they want a transfer done while they watch.

Three things decide how it ends:

1. Whether you can hand over everything in one sitting.
2. Whether the attacker can tell that you have.
3. Whether you still exist as a target afterwards.

The cipher on this site changes none of those by itself. A list of numbers on a receipt stops a thief who doesn't know what he's looking at. It doesn't stop one who is holding your arm and asking you which receipt.

The goal: nothing on you, nothing you can access today

The setup that survives a wrench is one where, at the moment of the attack, you can truthfully say that you can't move the money right now, and the attacker can confirm that beating you harder won't change it.

That takes two separate things.

Nothing on you. The seed words don't live at the house, in the phone, or in your memory in a form you can recite. A numbered list from one of our ciphers, kept somewhere else, is one way. Metal plates in a safe deposit box are another. If the words are in the house, the house is the attack.

Nothing you can access today. Even with the seed, the funds shouldn't be spendable in one sitting. That is what time-locks and multisig are for:

• A time-locked recovery path. Liana is a wallet built around this: the primary key spends at any time, and a second key (an heir's, or your own kept elsewhere) only becomes valid after the coins have sat still for a set number of blocks. Spending from the primary path resets the clock. An attacker with the primary key can still spend, so this protects inheritance and loss more than duress, unless the primary key itself is the thing you don't carry.
• Multisig across places. A 2-of-3 wallet with one key at home, one in a bank box, and one with a person or a service in another city can't be emptied from your kitchen. The attacker needs a second location and a second day, and every hour they spend with you raises their risk.
• Spending limits by design. Keep the wallet you can reach from home small enough that handing it over is the plan, and the rest where a day's violence doesn't reach it.

The point is to make the honest answer "I can give you this much, and I physically can't give you the rest tonight," and to have that be verifiably true.

Decoy wallets

BIP-39 gives you a second wallet for free. Every passphrase produces a valid seed, and the standard says so in as many words: "every passphrase generates a valid seed (and thus a deterministic wallet) but only the correct one will make the desired wallet available." Trezor calls the result a hidden wallet, and documents it as a way to keep a small, visible balance that you can surrender while the real one stays behind a passphrase nobody has seen.

A decoy works when:

• It holds enough to be believable. An empty wallet proves you are hiding one.
• Its passphrase is the one you'll give up under stress, and the real one is the one you won't, which means the real one has to be somewhere you can't be made to produce it.
• Nothing on the device, in your records or in your transaction history points at the second wallet.

A decoy fails when the attacker has read the same documentation you have, and most of the people on Lopp's list have. "Show me the hidden wallet" is a known question. Expect it. The decoy buys you a story for someone who doesn't know the trick. For someone who does, you need the first two sections: nothing on you, nothing reachable today.

Memorised words are a liability here

Memorising a seed sounds like the ultimate "nothing on me." Under duress it is the opposite. A memorised seed is on you at all times, it can't be in a bank box in another city, and the only way to stop you producing it is to stop you. The cipher's numbers, kept away from the house, mean the words exist somewhere you can take someone to tomorrow, with time for other things to happen in between.

Reduce the chance of being chosen

Most wrench attacks start with the attacker knowing. The leaked Ledger customer database of 2020, with 272,853 names, postal addresses and phone numbers, is still circulating. Lopp's talk at Bitcoin 2025 on wrench attacks makes the same point from the other direction: the victims were findable.

• Don't tell people. Not at the bar, not in a bio, not with a sticker on the car.
• Don't have hardware or seed material delivered to the house in branded packaging, and don't register it to the home address.
• Keep the amount anyone could reasonably believe you hold at home small, and keep it true.

The rules of this site still apply

We will never ask for a seed word or a passphrase. Never type one into this site or any tool it links to. If anyone, at your door or on a screen, asks for your words, the answer is the same.

Sources