Rubber-hose attacks (wrench attacks)

Rubber-hose cryptanalysis is the dark joke that the cheapest way to break strong encryption is to threaten, hurt or kidnap the person who knows the key. Brute-forcing a 256-bit key is hopeless; coercing a human takes one “guess”. In the crypto world the same idea is called a wrench attack, and it has become very real as people hold large amounts of value in keys they control alone.

In January 2025, Ledger co-founder David Balland and his wife were kidnapped from their home in central France. The kidnappers demanded a crypto ransom (reported as €10 million), cut off one of his fingers and sent a video of it to put pressure on his colleagues. French special forces rescued the couple and arrested about ten people. Jameson Lopp, CTO of Casa, keeps a public list of these attacks, and it keeps growing.

The defences are about not being a single point of failure. Keep holdings and lifestyle private; use multisig with keys stored in different places so no one person can move funds alone; add time-locks so a large withdrawal cannot happen on the spot; consider a small decoy “duress” wallet; and in organisations, require two people for any large transfer.