Every other security layer assumes the attacker is remote. This guide covers the ones who aren’t — and the discipline that keeps you off their list in the first place. The core insight: physical attacks are targeted, and targeting requires knowing you’re worth it. OPSEC — operational security, the habit of not leaking that fact — is the real defense; everything else is backup.
Rule One: Targets Are Chosen by What Is Known
- Every KYC database is one breach from public. The 2020 Ledger breach turned a customer list into a public map of “people with hardware wallets, and where they live” — followed by years of threatening letters and doorstep phishing. A home delivery puts a name and a front door on the vendor’s customer list. A pickup point, parcel locker, carrier hold-at-location or PO box keeps the door off that list where the vendor’s courier accepts one; some couriers do not deliver to PO boxes, and the checkout shows what a region supports. A private email on every crypto-adjacent account keeps those lists from tying back to an everyday identity.
- Talk is a leak that needs no breach. Not at the barbecue, not in the group chat, not with a bumper sticker. The correlation attackers need most — this person, this much, this address — is usually assembled from things the victim said freely.
- Pseudonyms are professional practice, not paranoia. Publishing, posting, and community life can all run under a name that isn’t on your mailbox.
At Home
- Metal backups live in boring places — a safe bolted down, or better, somewhere no one associates with valuables. A safe advertises; a mislabeled box does not.
- Split location: seed backup and hardware wallet should not be stealable in the same sixty seconds. One burglary should never yield both.
- An unremarkable crypto machine tells no one anything. A dedicated laptop that lives in a drawer draws no attention; a trading-desk shrine with six monitors does.
The Wrench Attack, Answered Honestly
The “$5 wrench attack” is the meme that ends every security debate: why crack encryption when you can threaten the owner? The honest answer, in the order that matters:
Rule Zero — handing everything over outranks every holding. Under threat, handing over whatever is demanded (decoy, hidden wallet, all of it) costs only money, and the choice is easiest to settle now, while calm. No holding is worth your safety, and documented cases, including the 2025–26 wave of kidnappings in France, show attackers escalating when they believe more exists. Everything below exists to make that bad day unlikely and less expensive, not to create something to defend in the moment.
- OPSEC is the real defense — wrench attacks are targeted, and Rule One keeps you off the list. Nearly every documented case began with the attacker knowing the victim held crypto, from the victim’s own public profile or from leaked records.
- The duress pattern lowers the stakes: a passphrase wallet (the “25th word”) creates a second, hidden wallet behind your standard one. The standard wallet holds a plausible amount to surrender; the passphrase wallet holds the rest. Three honest caveats. The passphrase cannot be recovered: one capital letter wrong opens a different, empty wallet with no error message, and a forgotten passphrase leaves everything in the hidden wallet gone for good. No seed, device or company can restore the passphrase, and an estate plan that doesn’t record that the hidden wallet exists leaves heirs only the decoy (setup and practice unlock: Wallet Backup Standards). Attackers know this pattern too: a decoy only works if it’s consistent with whatever the attacker could know about you, which is why Rule One comes first. And funding the hidden wallet directly from the decoy writes the link onto the chain. A setup made calmly, long before any need, is the one that holds under stress. Rule Zero outranks this pattern at every point: under threat, holding the hidden wallet back is not safe, because attackers who believe more exists escalate.
Travel & Borders
- A seed in the luggage is the whole wallet in the luggage. Kept at home in metal, the seed is out of reach of a search or a lost bag. A hardware wallet without its seed is replaceable: the seed kept at home restores the wallet on a replacement device. In a thief’s hands the device is not harmless: a PIN and a Secure Element slow an attacker down, and on models without a Secure Element (Trezor Model One and Model T) Kraken Security Labs pulled the seed out in 2020 with about 15 minutes of physical access, an attack a passphrase defeats because the passphrase is never stored on the device.
- A boring crossing is an honest one. A travel wallet with pocket money for spending and devices that are clean or freshly set up leave nothing to explain. Border agents in many jurisdictions can lawfully compel device unlocks, and refusing can cost the device, the entry or, in some countries, a criminal charge. Carrying less is lawful; concealing is not. A false answer to a direct question, or an item local law requires declared and left undeclared, is a crime in most countries and turns an inspection into a prosecution.
- Disclosure law is route-specific. Some jurisdictions have disclosure rules that can reach crypto; for someone who holds meaningfully and travels often, that question is worth an hour with a professional who knows the route, not a clever wallet setup.
If Your Address Leaks
Under Rule One, a leak is a matter of when. After one: door discipline (unexpected “deliveries” and “technicians” get politely refused), a camera on the entrance, mail that doesn’t announce crypto vendors, and — if you’re genuinely a known target (public figure, doxxed, previously threatened) — this is the one profile where paid measures like a SIM-swap-protected carrier, a PO-box life, and professional advice earn their keep.
Everything on this page is universal — send anyone the link — pointing people to the source beats forwarding copies (a file passed around is exactly what this site warns about; the link stays canonical and current). For the curious: this site documents Actuator.Finance on PulseChain — the one-page version is How It Works, and Start Here picks your path.