Discretion and Physical Security for Bitcoin Holders

Physical security for bitcoin means two things: nobody should know that attacking you is worth it, and if someone tries anyway, they shouldn't be able to force anything. You achieve the first with silence and sparing use of your data, the second with keys spread across places, a small everyday wallet and time as protection.

The problem: no encryption helps against a wrench

Nobody can guess the keys to your bitcoin. The mathematics behind them is so strong that it would take billions of years. An attacker who knows this therefore tries another way: they threaten you until you send the coins yourself.

In the bitcoin world this is called a "wrench attack", after a well-known comic: instead of cracking the laptop, you hit the owner with a $5 wrench until they reveal the password. The joke is old; the attacks are real. Bitcoin developer Jameson Lopp has kept a public list of known robberies, burglaries and kidnappings of bitcoin holders for years. In recent years it has grown considerably longer.

France became especially well known: in January 2025, David Balland, co-founder of hardware wallet maker Ledger, was kidnapped and injured. In the same year, further kidnapping attempts followed in France, including on relatives of crypto entrepreneurs. The perpetrators deliberately targeted people they knew or believed to hold a lot of bitcoin.

Where your bitcoin holdings become visible

Almost every attack starts with a piece of information. Most of it you give away yourself without noticing. This table shows the usual leaks:

Conversations and social media

The biggest leak is you. Anyone who proudly says they bought early makes themselves a target, even if they don't actually own that much. Friends pass it on, and after a price rise someone remembers.

On social media this applies twice over. A profile picture with your real name, your town in your profile and posts about your bitcoin journey give a criminal a complete picture. If you want to talk about bitcoin, do it under a pseudonym and without numbers.

With your family, on the other hand, you should talk, because they need access in an emergency. How to bring it up without it being passed on is shown in the article Talking about bitcoin with your partner and family.

Data leaks at providers

Exchanges and wallet makers hold your name, address, phone number and often a copy of your ID. This data is the most valuable thing criminals can find: a list of people who own bitcoin, with their home addresses.

Two examples show that this is not theory:

• Ledger, 2020: about 1.1 million email addresses from a marketing database became public, and for about 272’000 customers also their name, postal address and phone number. The list still circulates today; customers received threatening letters and fake replacement devices.
• Coinbase, 2025: bribed staff at a service provider passed on customer data, including names, addresses, ID images and account balances. According to Coinbase, less than 1% of monthly users were affected.

You can't prevent data leaks, but you can limit what's in them. Use few, reputable providers. Create a separate email address for them that you don't use anywhere else. And don't leave your coins there: a leaked balance of zero is of no interest to anyone. Why an exchange is no place to store bitcoin anyway is shown by the exchange collapses from Mt. Gox to FTX.

The public blockchain

Every bitcoin payment is recorded in the blockchain forever. No names appear there, but anyone who knows one of your addresses sees its balance and can trace payments to and from it.

So: use a new address for every incoming payment. Every modern wallet does this by itself. Don't post an address or a screenshot of a transaction. And remember that the exchange knows which address it sent your coins to.

At home: inconspicuous and not open to extortion

A burglar looks for cash, jewellery and electronics. A hardware wallet alone is useless to them as long as it is protected by a PIN and the seed isn't lying next to it. It gets dangerous when both are in the same place, or when the burglar knows what to look for.

Here is how to go about it:

1. Separate device and seed. The hardware wallet can sit in a drawer. The seed phrase belongs somewhere else, not in the same room.
2. No hints of bitcoin. No bitcoin posters, no stickers on your car or laptop, no hardware wallet boxes in the paper recycling.
3. A safe, but not as a signpost. A safe that is firmly anchored protects against fire and quick theft. But it also shows where valuables are. Don't keep your only backup there.
4. Spread your backups. One copy at home, one in a second place: with a trusted person or in a bank safe deposit box. Which metal survives fire and water and how many copies make sense is shown in the article Storing your seed phrase safely; which custody suits your amount is in the custody guide.
5. Redirect deliveries. Have hardware wallets and metal plates sent to a parcel locker or post office. That way your home address isn't in the maker's customer database.

For the worst case: a setup that makes violence pointless

Discretion lowers the likelihood of an attack. The second part of physical security makes sure an attack achieves little. The goal: under pressure you can't hand over everything, and an attacker realises that quickly.

The small everyday wallet

Keep a wallet app with a small amount on your phone for payments. Your large holdings are kept separately, on a hardware wallet you don't carry with you. Anyone who threatens you on the street finds only the phone.

The passphrase as a second wallet

Many hardware wallets allow a passphrase, often called the "25th word". The seed alone opens a wallet with a small amount; seed plus passphrase opens your real wallet. Under pressure you can hand over device, PIN and seed without the rest becoming visible.

To be honest: this is not perfect protection. If the attacker knows from a data leak how much you bought on an exchange, they may not believe the small wallet. The passphrase works best together with discretion.

Multisig across several places

With a 2-of-3 multisig wallet, three keys sit in three places, and every payment needs two. If at most one is at home, you can't pay from there even if you wanted to. The second key is, for example, in a safe deposit box or with a trusted person, and it takes hours or days before anyone can fetch it.

That time is the protection. An attacker wants to get away fast, not wait for days. What matters is that the setup stays affordable and understandable for you: built too complex, it becomes a danger in itself.

Why discretion matters more every year

What you say today or leave with a provider stays in circulation. As the value of your holdings rises, the same information becomes more valuable to criminals. A conversation that was harmless at €5’000 no longer is at many times that.

How your own holdings could develop according to the model, you can work out here:

Checklist: bitcoin discretion and physical security

1. Stay silent. Don't tell anyone except your closest family about your holdings, and don't give them numbers they don't need either.
2. Clean up online. Delete old posts about bitcoin purchases, keep your town out of profiles, use a pseudonym for bitcoin topics.
3. Share little data. Few providers, a separate email address, coins into your own wallet after buying.
4. Redirect deliveries. Hardware to a parcel locker, dispose of boxes discreetly.
5. Separate device and seed. Seed on metal, in a different place from the device, a second backup outside your home.
6. Keep the everyday wallet small. Carry only what you can afford to lose.
7. Plan for pressure. Passphrase or multisig, depending on the amount, and run through the setup once.
8. Write an emergency plan. Your family must be able to get to the coins in an emergency without strangers finding out. How to do that is shown in Inheriting bitcoin.

Discretion also protects against scammers: anyone who knows you have bitcoin is more likely to send you fake support emails and letters. The scams are covered in Spotting bitcoin scams. You practise seed, passphrase and backups step by step in the academy, stage 2: understand and secure.