{"id":66609,"date":"2026-06-15T06:09:23","date_gmt":"2026-06-15T03:09:23","guid":{"rendered":"https:\/\/lwallet.com.ua\/?p=66609"},"modified":"2026-07-07T06:13:08","modified_gmt":"2026-07-07T03:13:08","slug":"wrench-attack-how-to-protect-your-crypto","status":"publish","type":"post","link":"https:\/\/lwallet.com.ua\/en\/wrench-attack-how-to-protect-your-crypto\/","title":{"rendered":"Physical attacks on crypto holders: how to protect yourself from a wrench attack"},"content":{"rendered":"\r\n\r\n\r\n

Wrench attack<\/strong> is a physical attack on a cryptocurrency holder intended to force them to hand over access to a wallet. In crypto, people usually talk about hackers, phishing, and smart-contract vulnerabilities. But there is a threat that a standard wallet setup cannot stop: a person with a wrench standing at your door. Protection is possible, but it requires a completely different approach.<\/p>\r\n\r\n\r\n\r\n

2025 set a record for physical attacks on crypto holders: 72 verified incidents, a 75% year-on-year increase \u2014 kidnappings, home invasions, torture, and even murders. In 2026, the situation became even worse: France alone recorded 41 kidnappings in four months.<\/p>\r\n\r\n\r\n\r\n

This is not limited to Europe or the United States. In Kyiv, a man was killed over 3 bitcoins. In Vienna, a 21-year-old Ukrainian was killed over cryptocurrency.<\/p>\r\n\r\n\r\n\r\n

The victims are not only millionaires. A Bloomberg investigation found teachers, firefighters, and ordinary people with moderate wallet balances among those targeted. It is enough for someone to learn that you hold cryptocurrency.<\/p>\r\n\r\n\r\n\r\n

This article explains how physical attacks work, who becomes a target, and which practical steps can reduce the risk. There are no abstract recommendations here \u2014 they are of little practical use. Instead, we will focus on measures that can actually help in such situations.<\/p>\r\n\r\n\r\n\r\n

What is a wrench attack, and why is it no longer a meme?<\/h2>\r\n\r\n\r\n
\r\n
\"What<\/figure>\r\n<\/div>\r\n\r\n\r\n

The term became widely known through an xkcd comic published in 2009. The idea is simple: why break encryption if you can beat the key owner with a $5 wrench until they reveal the password? In academic circles, this is called rubber-hose cryptanalysis. Marcus Ranum introduced the term back in 1990, but it entered the crypto world along with large sums of money and real-world violence.<\/p>\r\n\r\n\r\n\r\n

Ukraine has its own version of the phrase: the \u201csoldering iron attack.\u201d The principle is the same: the attacker targets the person, not the technology.<\/p>\r\n\r\n\r\n\r\n

Why has cryptocurrency become an ideal target for this type of crime?<\/p>\r\n\r\n\r\n\r\n

Irreversible transactions.<\/strong> A bank transfer can be blocked, disputed, or reversed through a chargeback. A crypto transaction is finalized within minutes. Once it is confirmed on-chain, recovering the funds is technically impossible.<\/p>\r\n\r\n\r\n\r\n

Self-custody.<\/strong> When you store cryptocurrency in your own wallet \u2014 hardware, mobile, or desktop \u2014 you control the private keys. You are your own bank. There is no call center to freeze the account and no fraud department to intervene. The seed phrase you know or store provides full and immediate access to all funds.<\/p>\r\n\r\n\r\n\r\n

Rapid laundering.<\/strong> After receiving cryptocurrency, criminals move it through a network of wallets, mixers, and cross-chain bridges. They convert it into stablecoins and distribute it across different networks. In some cases, stolen funds pass through dozens of addresses within hours. The trail can be traced, but recovering the money is almost impossible.<\/p>\r\n\r\n\r\n\r\n

There is another factor that is rarely discussed: attacks correlate with the price of Bitcoin. Jameson Lopp, who has maintained a database of physical attacks since 2014, identified a clear pattern. Attacks increase during bull markets: wallet balances rise, interest in crypto grows, and there are more potential targets. During the 2024\u20132025 bull run, the number of attacks reached a peak.<\/p>\r\n\r\n

[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n

A wrench attack works because cryptocurrency combines immediate access to funds, irreversible transactions, and the absence of an intermediary who can intervene. As long as at least one of these conditions remains, the threat will persist.<\/p>\r\n

[\/vc_message]<\/p>\r\n\r\n

Statistics: the scale of the problem in numbers<\/h2>\r\n\r\n\r\n
\r\n
\"Wrench<\/figure>\r\n<\/div>\r\n\r\n\r\n

Jameson Lopp, CSO of Casa, has maintained an open GitHub database of physical attacks on crypto holders since 2014. It currently contains more than 225 confirmed cases. Lopp himself acknowledges that the real number is much higher. Many victims do not contact the police because they fear another attack or do not trust law-enforcement agencies to handle crypto-related cases. Some incidents are recorded as ordinary robberies without any mention of cryptocurrency.<\/p>\r\n\r\n\r\n\r\n

Blockchain auditor CertiK compiled separate data for 2025 in its Skynet Wrench Attacks Report<\/a>: 72 verified cases of physical coercion worldwide. That is 75% more than the 41 incidents recorded in 2024. According to TRM Labs, the actual total is closer to 60\u201370 even when counting only cases reported by the media.<\/p>\r\n\r\n\r\n\r\n

By category, kidnappings increased from 15 to 25 cases (+66%), while physical assaults rose from 4 to 14 (+250%). Total losses increased from $28.3 million in 2024 to $40.9 million in 2025. CertiK notes that this figure is substantially understated because of unreported cases and private settlements.<\/p>\r\n\r\n\r\n\r\n

Europe became the leading region, accounting for more than 40% of all incidents. France ranked first with 19 confirmed attacks in 2025. North America\u2019s share fell from 36.6% to 12.5%, but that does not mean it became safer. Physical attacks are simply spreading to other regions as well. Asia remained stable at 33.3%, with a concentration of cases involving tourists and expats in Thailand and Hong Kong.<\/p>\r\n\r\n\r\n\r\n

The pace accelerated in 2026. France alone recorded 41 crypto-related kidnappings in the first four months of the year \u2014 one every 2.5 days.<\/p>\r\n\r\n\r\n\r\n

Cases: from $200,000 to hundreds of millions<\/h2>\r\n\r\n\r\n
\r\n
\"Real<\/figure>\r\n<\/div>\r\n\r\n\r\n

Each of these stories illustrates a different type of threat, a different scale, and different lessons.<\/p>\r\n\r\n\r\n\r\n

Kyiv, Ukraine, July 2024<\/h3>\r\n\r\n\r\n\r\n

A 29-year-old foreign national was kidnapped near his home in Kyiv\u2019s Solomianskyi district. Four attackers aged 24\u201329 had planned the operation in advance: they tracked the victim\u2019s address and waited for him to return home around midnight. They stole 3 BTC \u2014 approximately $207,000 at the time. The victim was strangled, and his body was taken to a forest. All four suspects were arrested and face life imprisonment.<\/p>\r\n\r\n\r\n\r\n

The key point in this case is that the amount was relatively modest: three bitcoins. But that was enough to lead to murder.<\/p>\r\n\r\n\r\n\r\n

Vienna, Austria, November 2025<\/h3>\r\n\r\n\r\n\r\n

A 21-year-old Ukrainian was attacked in the underground parking garage of the SO\/Vienna hotel. Two attackers \u2014 aged 19 and 45, both Ukrainian \u2014 beat him and forced him to hand over passwords to two crypto wallets, which they then emptied. His body was found in a burned Mercedes with Ukrainian license plates in Vienna\u2019s Donaustadt district. According to some local media reports, the victim may have been the son of Kharkiv\u2019s deputy mayor, although this has not been officially confirmed. The suspects were arrested in Ukraine.<\/p>\r\n\r\n\r\n\r\n

David Balland, Ledger, France, January 2025<\/h3>\r\n\r\n\r\n\r\n

The Ledger co-founder was kidnapped together with his wife. While he was being held captive, the attackers cut off part of his finger and sent a photograph to business partners as part of a ransom demand. His rescue was carried out by GIGN, the elite tactical unit of the French Gendarmerie. This case became a turning point in the discussion of crypto-industry security in France.<\/p>\r\n\r\n\r\n\r\n

Paris, Paymium, May 2025<\/h3>\r\n\r\n\r\n\r\n

The daughter and two-year-old grandson of Pierre Noizat, CEO of the Paymium crypto exchange, were targeted in an attempted kidnapping in broad daylight on Rue Pache in Paris\u2019s 11th arrondissement. The woman was five months pregnant. Three masked attackers jumped out of a van carrying fake Chronopost courier branding. The daughter managed to grab a gun from one of the attackers \u2014 it turned out to be an Airsoft weapon rather than a real firearm \u2014 and throw it away. Bystanders helped stop the attack.<\/p>\r\n\r\n\r\n\r\n

The investigation led to the arrest of 25 people, including 6 minors. Most suspects were aged 16\u201323. According to CoinDesk, they were local operatives hired by a criminal network from Southeast Asia for approximately $10,000 each. A lawyer for one of the suspects described them as \u201cvery young people, lured by money and pulled into a situation that was bigger than them.\u201d<\/p>\r\n\r\n\r\n\r\n

Vancouver, Canada, April 2024<\/h3>\r\n\r\n\r\n\r\n

Four attackers wearing Canada Post uniforms and COVID masks broke into a family home and held the occupants captive overnight. The father and mother were subjected to waterboarding \u2014 a simulated drowning technique in which a cloth is placed over the victim\u2019s face and water is poured over it to create a sensation of suffocation. The daughter was raped. About $1.5 million in Bitcoin was stolen. The details became public only after court documents were released in late 2025. The key fact: the father had boasted about high crypto earnings within the Chinese community.<\/p>\r\n\r\n\r\n\r\n

United States: the Remy St. Felix gang<\/h3>\r\n\r\n\r\n\r\n

This case shows how an organized crypto robbery operation works from the inside. Remy St. Felix, a 25-year-old from Florida, led a group that started with SIM-swap attacks \u2014 stealing phone numbers to intercept SMS codes \u2014 and later moved on to home invasions. Between 2022 and 2023, the group carried out a series of attacks in Florida, Texas, and North Carolina: victims were restrained with zip ties, threatened with weapons, and forced to transfer cryptocurrency. The group stole more than $3.5 million in total.<\/p>\r\n\r\n\r\n\r\n

St. Felix was sentenced to 47 years in prison. It was the longest sentence in a cryptocurrency-related criminal case in US history. A total of 12 members of the group were convicted. After sentencing, St. Felix attacked a prosecution witness in custody and received an additional sentence of 6 years and 10 months.<\/p>\r\n\r\n\r\n\r\n

UAE, 2025<\/h3>\r\n\r\n\r\n\r\n

Crypto entrepreneur Roman Novak and his wife were lured to a fake business meeting and murdered. The criminals tried to gain access to wallets that they believed contained hundreds of millions of dollars. The wallets turned out to be empty or inaccessible, but that did not prevent the killing.<\/p>\r\n\r\n\r\n\r\n

France, 2026: a systemic crisis<\/h3>\r\n\r\n\r\n\r\n

Forty-one kidnappings in four months. In April, GIGN stormed a house where the mother and 11-year-old son of a crypto entrepreneur were being held \u2014 the attackers demanded \u20ac400,000. In March, a couple in their fifties lost $1 million in BTC after criminals posing as police officers invaded their home. In February, a judge and her mother were kidnapped to pressure the judge\u2019s crypto-entrepreneur partner. An entire family \u2014 grandparents, parents, and grandchildren \u2014 was taken hostage by five criminals at a holiday home in Anglet.<\/p>\r\n\r\n

[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n

The victims of wrench attacks are not only Forbes-listed millionaires. Many victims have no public profile and hold moderate amounts. It is enough for criminals to learn by any means that you hold cryptocurrency.<\/p>\r\n

[\/vc_message]<\/p>\r\n\r\n

How criminals find their victims<\/h2>\r\n\r\n\r\n
\r\n
\"How<\/figure>\r\n<\/div>\r\n\r\n\r\n

Ten years ago, a wrench attack was usually a crime of opportunity: someone learned that an acquaintance held cryptocurrency and decided to take it. Today, it is a planned operation involving intelligence gathering, surveillance, and specialization.<\/p>\r\n\r\n\r\n\r\n

KYC data leaks: the \u201cKnow Your Customer\u201d paradox<\/h3>\r\n\r\n\r\n\r\n

Jameson Lopp uses a play on words: KYC \u2014 Know Your Customer \u2014 turns into \u201cKill Your Customer.\u201d Databases created to combat money laundering become a source of targets for physical attackers.<\/p>\r\n\r\n\r\n\r\n

In May 2025, Coinbase disclosed a major data breach. Criminals bribed outsourced support agents working through TaskUs and obtained data belonging to approximately 69,000 customers: names, home addresses, phone numbers, photographs of passports and driver\u2019s licenses, account balances, and transaction histories. The attackers demanded $20 million. Coinbase instead announced a bounty for the same amount. The total cost of the incident was estimated at $400 million.<\/p>\r\n\r\n\r\n\r\n

Consider what this means: someone knows your home address, has a photograph of your passport, and knows how much money is held in your exchange account. That is a ready-made package for organizing an attack.<\/p>\r\n\r\n\r\n\r\n

In January 2026, Waltio, a French crypto-tax reporting platform, was hacked. The ShinyHunters group obtained data belonging to approximately 50,000 users: email addresses and summarized information from 2024 tax reports. The data appeared for sale on the dark web before Waltio even became aware of the breach. French law-enforcement agencies openly warned that the information was already being used for physical attacks. Hackers on BreachForums claimed a link between the Waltio breach and three specific kidnappings in France involving total losses of $17.1 million.<\/p>\r\n\r\n\r\n\r\n

There was also a separate incident: in June 2025, French media reported that a tax-agency employee had systematically passed crypto-investor data to criminals. This is an insider threat that technical security cannot stop.<\/p>\r\n\r\n\r\n\r\n

Social media and public activity<\/h3>\r\n\r\n\r\n\r\n

Nick Bax from the SEAL security group explains that victims often expose themselves. A balance screenshot in a crypto chat, a post about a successful trade, a photograph from a conference, or an appearance on a podcast can all reveal information. The Canadian family subjected to waterboarding came to the criminals\u2019 attention because the father had boasted about crypto earnings within the Chinese community.<\/p>\r\n\r\n\r\n\r\n

Criminals monitor these signals and build a profile: how much the person may hold, where they live, when they are at home, who lives with them, and whether they have a security system.<\/p>\r\n\r\n\r\n\r\n

On-chain analytics and blockchain transparency<\/h3>\r\n\r\n\r\n\r\n

Blockchains are transparent by default. If criminals know even one of your addresses \u2014 for example, because you sent funds to someone who later leaked information \u2014 they can track the movement of funds, estimate the total balance, and identify the networks where assets are held. Combining on-chain data with a KYC leak provides a complete picture: name, address, and amount.<\/p>\r\n\r\n\r\n\r\n

Organized groups with specialized roles<\/h3>\r\n\r\n\r\n\r\n

TRM Labs researchers have observed groups operating according to a corporate model. Intelligence: data collection, social-media monitoring, and follow-home tactics \u2014 tracking a target from a crypto conference or ATM to their home. Execution: the attack itself, often carried out by hired local operatives. Laundering: converting cryptocurrency through DEXs, mixers, and bridges. Each link in the chain operates autonomously.<\/p>\r\n\r\n\r\n\r\n

The Paris Paymium case illustrates this model: the 25 people arrested, including 6 minors, were local operatives. According to investigators, the order came from a criminal network in Southeast Asia. The payment for the attempted kidnapping was approximately $10,000 for each operative.<\/p>\r\n\r\n

[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n

You do not need to be a millionaire to become a target. It is enough for information about your cryptocurrency holdings to emerge from any source: an exchange breach, a chat post, or a careless conversation.<\/p>\r\n

[\/vc_message]<\/p>\r\n\r\n

Why a hardware wallet cannot protect you from a wrench<\/h2>\r\n\r\n\r\n\r\n

A hardware wallet, a complex password, two-factor authentication, and address verification on the device screen all work against hackers. None of them work against a person with a knife or a gun.<\/p>\r\n\r\n\r\n\r\n

The seed phrase that controls your entire wallet is a single set of 12 or 24 words. Under physical pressure, you will reveal it. The same is true of the hardware-wallet PIN. In its report, CertiK explicitly calls this a \u201cstructural threat to digital ownership\u201d: the stronger the digital security becomes, the more attractive a physical attack is as a way to bypass it.<\/p>\r\n\r\n\r\n\r\n

The problem is architectural: a standard crypto-wallet setup has a single point of failure. One person knows everything needed to transfer the funds. One seed phrase, one PIN, one device. As long as that remains true, a wrench attack will be the shortest path to your money.<\/p>\r\n\r\n\r\n\r\n

Protection against a physical attack is fundamentally different from protection against hackers. The goal is not to make access more difficult \u2014 an attacker can overcome any level of difficulty given enough time and motivation \u2014 but to ensure that you physically cannot transfer all of the funds, even if you want to.<\/p>\r\n\r\n\r\n\r\n

How to protect yourself: practical tools<\/h2>\r\n\r\n\r\n\r\n

The threat cannot be eliminated completely. But you can build a system in which a wrench attack becomes pointless for the criminal: you cannot hand over assets that are not immediately accessible to you, and the criminal does not know how much you actually hold.<\/p>\r\n\r\n\r\n\r\n

The \u201cboring neighbor\u201d strategy: the most effective protection costs nothing<\/h3>\r\n\r\n\r\n
\r\n
\"OPSEC<\/figure>\r\n<\/div>\r\n\r\n\r\n

Lopp summarized it this way: \u201cThe most effective thing a bitcoiner can do to reduce wrench-attack risk is very difficult: do not talk about bitcoin, at least not under your real name or with your face attached.\u201d This is difficult not technically, but psychologically. People like to share their successes. In crypto, that increases the risk of a physical attack.<\/p>\r\n\r\n\r\n\r\n

What does this mean in practice?<\/p>\r\n\r\n\r\n\r\n

Never disclose the value of your portfolio.<\/strong> Not in chats, not in conversations with friends, and not at meetups. Even indirect signs of wealth \u2014 travel photographs, new cars, and purchases \u2014 help build a profile. Criminals do not need exact figures. It is enough for them to conclude that \u201cthis person has something worth taking.\u201d<\/p>\r\n\r\n\r\n\r\n

Do not publish photographs of hardware wallets.<\/strong> A Ledger or Trezor in an Instagram post, on a desk during a stream, or in an unboxing story is a direct signal: this person uses self-custody, and the key to all of the funds is somewhere nearby.<\/p>\r\n\r\n\r\n\r\n

Keep crypto apps on a separate phone.<\/strong> Your main smartphone \u2014 the one you carry with you \u2014 should not contain MetaMask, Trust Wallet, Phantom, Rabby, or any other crypto app. If the phone is stolen or you are stopped on the street, the primary device will contain nothing that indicates you hold cryptocurrency. Keep the second phone at home in an inconspicuous location.<\/p>\r\n\r\n\r\n\r\n

Use a separate email address for crypto.<\/strong> KYC database leaks occur regularly: Coinbase, Waltio, Ledger through the Global-e leak. If the email used for a crypto exchange is the same as the email on your LinkedIn or Facebook profile, the connection between your identity and crypto assets becomes obvious within seconds. Use an email address that is not linked to any public profile.<\/p>\r\n\r\n\r\n\r\n

Be careful in crypto communities.<\/strong> Telegram chats, Discord servers, and Twitter threads can all be monitored. Anything you write may be captured and used against you. Screenshots spread within minutes. Even a casual message such as \u201cI bought the dip\u201d in a chat with 500 members can make you a target for someone in the group.<\/p>\r\n\r\n\r\n\r\n

Stay discreet at conferences.<\/strong> Crypto events concentrate potential targets in one location. Follow-home tactics \u2014 tracking someone from a conference to their hotel or home \u2014 have been documented in several cases. Do not discuss amounts publicly, and be careful with new acquaintances.<\/p>\r\n\r\n\r\n\r\n

Passphrase \u2014 the 25th word: a hidden wallet that no one knows about<\/h3>\r\n\r\n\r\n
\r\n
<\/figure>\r\n<\/div>\r\n\r\n\r\n

If multisig is the \u201cheavy artillery,\u201d a passphrase is the first line of defense available to every hardware-wallet owner.<\/p>\r\n\r\n\r\n\r\n

How it works.<\/strong> A standard 24-word seed generates one set of keys and addresses. But if you enter an additional password \u2014 a passphrase \u2014 when accessing the wallet, the wallet generates a completely different set of keys. One seed phrase gives you two separate wallets that are not linked in any visible way for an external observer.<\/p>\r\n\r\n\r\n\r\n

Practical use.<\/strong> Keep an amount you are prepared to lose in the wallet without a passphrase \u2014 for example, $300\u2013500. Store the main funds in the hidden wallet protected by the passphrase. If you are coerced, you reveal the seed phrase without the additional phrase. The attacker sees a $500 balance, takes it, and leaves. There is no reason to suspect that a second wallet exists because, technically, it does not exist without the correct passphrase.<\/p>\r\n\r\n\r\n\r\n

All major hardware wallets support passphrases: every Ledger model, every Trezor model, Keystone 3 Pro, Blockstream Jade, BitBox02, and OneKey. Setup takes only a few minutes.<\/p>\r\n\r\n\r\n\r\n

There is an important caveat. An experienced attacker may know that passphrases exist. If the visible wallet contains $500 but the attacker\u2019s intelligence suggests that you should hold more, the pressure may continue. A passphrase should therefore be treated as one layer of security, not as a complete solution. It works best in combination with OPSEC: if the attacker does not know how much you hold, a decoy wallet with a moderate balance looks plausible.<\/p>\r\n\r\n\r\n\r\n

A duress PIN is also worth mentioning. Blockstream Jade allows you to configure a PIN that opens a decoy wallet with a minimal balance. Another PIN can wipe the device completely. The idea is the same: the attacker gains access, but not to the main funds.<\/p>\r\n\r\n

[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n

Store the passphrase separately from the seed phrase. Keep the seed phrase on a metal backup in one location and the passphrase in another. If they are stored together, the entire purpose is lost. Always test recovery of the hidden wallet before transferring serious amounts to it. The basic methods for storing a backup are covered in the article \u201cHow to store a seed phrase: 5 safe methods in 2026\u201d<\/a>.<\/p>\r\n

[\/vc_message]<\/p>\r\n\r\n

Multisig: ensure that you physically cannot hand over the money<\/h3>\r\n\r\n\r\n
\r\n
\"Multisig<\/figure>\r\n<\/div>\r\n\r\n\r\n

This is the most reliable protection against physical coercion available today. Here is why.<\/p>\r\n\r\n\r\n\r\n

Multisig \u2014 multi-signature \u2014 means that several keys are required to sign a transaction, and those keys are physically stored in different places. In a 2-of-3 setup, there are three keys and any two are required for a transfer. One key is stored at home, the second in a bank safe-deposit box in another city, and the third with a trusted person or a provider such as Casa.<\/p>\r\n\r\n\r\n\r\n

Why does this work? Even if an attacker is standing next to you, you physically have access to only one key. You are not refusing to make the transfer. You are physically unable to do it. This is a technical reality that can be verified. The criminal must either hold you for longer \u2014 greatly increasing the risk \u2014 coordinate actions across several locations \u2014 which is even harder \u2014 or leave empty-handed.<\/p>\r\n\r\n\r\n\r\n

It also changes the psychological dynamic. When a victim says \u201cI cannot\u201d rather than \u201cI will not,\u201d the attacker has less incentive to continue applying pressure. They came for quick money and encountered a problem instead.<\/p>\r\n\r\n\r\n\r\n

Available setup options:<\/p>\r\n\r\n\r\n\r\n

Several services simplify multisig setup to the point where you can install an app, connect wallets, and start using the system. They handle the technical layer and retain one key as a backup while leaving control in your hands.<\/p>\r\n\r\n\r\n\r\n

Casa<\/strong> is a US service founded by Jameson Lopp, whom we mentioned earlier. It focuses specifically on protection against physical threats. In a 2-of-3 setup, one key is stored on your mobile device, one on a hardware wallet, and one by Casa. Two of the three are required for a transaction. If a key is lost or compromised, Casa assists with recovery. A 3-of-5 setup is available for larger amounts. Pricing starts at $21 per month or $250 per year, with no KYC required at registration. The service supports Bitcoin, Ethereum, and the USDT and USDC stablecoins.<\/p>\r\n\r\n\r\n\r\n

Unchained<\/strong> is another US service, focused on Bitcoin. Its 2-of-3 setup gives you two keys while Unchained stores the third. Unlike Casa, it requires identity verification \u2014 KYC \u2014 and opens accounts only for US residents. A personal vault costs $250 per year.<\/p>\r\n\r\n\r\n\r\n

You can also create your own setup using Sparrow Wallet, Electrum, or Unchained\u2019s Caravan. This is more difficult and requires technical knowledge, but it provides full control without dependence on a provider or a monthly subscription.<\/p>\r\n\r\n\r\n\r\n

With services such as Casa or Unchained, the app handles coordination: you connect the devices, and the service collects signatures and constructs the transaction. In a self-managed setup, Sparrow, Electrum, or Caravan performs that role on your computer.<\/p>\r\n\r\n\r\n\r\n

In both cases, the keys are stored on hardware wallets. Keystone 3 Pro, Coldcard, BitBox02, Trezor Safe 3, and Trezor Safe 5 offer strong multisig compatibility because they support PSBT \u2014 Partially Signed Bitcoin Transactions \u2014 the standard used by both services and desktop coordinators. Ledger can also be connected, but the process is less convenient.<\/p>\r\n\r\n\r\n\r\n

A good practice is to use devices from different manufacturers for different keys. For example, store one key on a Trezor and another on a Keystone. If a critical firmware vulnerability is discovered in one manufacturer\u2019s devices, the second key remains protected.<\/p>\r\n\r\n

[vc_message color=”warning” message_box_style=”classic” message_box_color=”alert-warning” style=”rounded”]<\/p>\r\n

Multisig does not stop an attack. But it makes the attack pointless: the criminal cannot obtain the money \u201chere and now.\u201d And \u201chere and now\u201d is precisely what they came for.<\/p>\r\n

[\/vc_message]<\/p>\r\n\r\n

Timelocks: a transaction that cannot happen immediately<\/h3>\r\n\r\n\r\n\r\n

Even if you have access to all of the keys, a timelock prevents you from transferring large amounts immediately.<\/p>\r\n\r\n\r\n\r\n

Casa offers Emergency Lockdown, which freezes a wallet and introduces a 72-hour delay before it can be unlocked. Vault solutions from BitGo allow custom delays for transfers above a chosen threshold. Bitcoin also has native CheckLockTimeVerify and CheckSequenceVerify mechanisms that can create transactions that become valid only after a specified period.<\/p>\r\n\r\n\r\n\r\n

The main benefit is that you can honestly tell the attacker that you are physically unable to transfer large amounts immediately.<\/p>\r\n\r\n\r\n\r\n

A prepared scenario: what to do if an attack happens<\/h3>\r\n\r\n\r\n\r\n

The most important rule matters more than any technology: no amount of cryptocurrency is worth your life or health. Do not try to be a hero. Do not attempt to outsmart an armed attacker.<\/p>\r\n\r\n\r\n\r\n

But if you configured your security in advance, you have a truthful explanation:<\/p>\r\n\r\n\r\n\r\n