Wrench Attacks: Physical attacks targeting cryptocurrency users (2024) [pdf]

Origin and terminology

• “Wrench attacks” are widely understood as a reference to the XKCD comic about beating passwords out of someone, i.e., old-fashioned robbery applied to crypto.
• Several commenters argue the phenomenon is not new at all: it’s just kidnapping/extortion/mugging with a new label and a new asset type.

Operational security and oversharing

• Strong emphasis on: if you hold meaningful crypto, don’t talk about it. Public bragging, even under pseudonyms, creates targets.
• Discussion of how online oversharing (vs. older “don’t talk to strangers” norms) makes it easy to build a detailed profile from handles and scattered posts.
• Tension highlighted: crypto’s value depends heavily on hype and visible success stories, which pushes holders to evangelize and show off—exactly what undermines their safety.
• Some note that even perfect personal discretion can be undercut by data breaches at exchanges or wallet companies that leak names, addresses, and balances.

Banks vs. self‑custody

• Multiple comments contrast crypto “be your own bank” with traditional banks:
  • Banks add friction (limits, in-person verification) and reversibility, which makes physical extortion less attractive and more traceable.
  • Crypto enables immediate, irreversible transfer of an entire fortune under duress.
• Others note that large-scale theft from banked customers via fraud and identity theft is common too; it just doesn’t require a wrench.

Real-world incidents and escalation risk

• Several recent high-profile kidnappings and mutilations tied to crypto wealth in France, Montréal, and the US are mentioned; many were clumsy, “amateurish” operations.
• Some expect things to get worse, especially after breaches that connect personal identities to on-chain wealth, creating a “breach → physical attack” pipeline.

Traceability and laundering

• Debate over how “traceable” stolen crypto really is:
  • Bitcoin flows are public and “tainted” coins can be flagged.
  • But criminals can move quickly into privacy coins (e.g., Monero) via atomic swaps, or sell wallets on a black market, analogous to stolen art.

Mitigations and tradeoffs

• Suggestions include: keep only small amounts in hot wallets; store most funds in multisig or with institutions; or avoid crypto altogether.
• Some point to ETFs and traditional brokerages as ironically the safest way to hold bitcoin.
• Others note that every step to harden against theft (complex key schemes, extreme secrecy) raises other risks: loss of keys, incapacity, inheritance failure.

Skepticism about novelty

• A few commenters dismiss the need for an academic paper, viewing the findings as obvious: conspicuous nouveau riche + self-custodied liquid wealth = extortion target.
• Others defend studying it systematically, given the growing body count and structural differences between crypto and legacy finance.