8 ms·
Wrench Attacks: Physical attacks targeting cryptocurrency users (2024) [pdf]
- HPsquared 1y ago[dead]
- piker 1y ago[flagged]
- gruez 1y agoWhat's the "unintended consequence" here? That bad guys will try to steal valuable stuff? Is that really "unintended" in any meaningful way? Does it make sense to say that people stealing iPhones is an "unintended consequence" of the iPhone?
- jsheard 1y ago> Does it make sense to say that people stealing iPhones is an "unintended consequence" of the iPhone? To torture the metaphor a bit, crypto is more like an iPhone competitor which markets itself around the supposed benefits of not having anti-theft features like factory reset protection. If you go out of your way to refuse already existing safeguards against your stuff being stolen then you don't really get to be surprised when thieves single you out as an easy mark.
- deleted 1y ago[deleted]
- roenxi 1y agoThe metaphor implies that iPhones aren't routinely stolen. But they are, iPhone theft is actually pretty common. Although the crypto might be relevant being attacked is something that any asset owner has to worry about (even for assets like houses, oddly enough - I suspect big mansions would be something of a thief draw). The attacks are unintended consequences of wealth as opposed to any specific property of crypto - having an equal amount of cash on hand isn't safe either.
- amanaplanacanal 1y agoI suspect most folks don't carry around that much cash, and if they do they certainly don't tell everybody about it.
- imaginator 1y agoJameson Lopp maintains a comprehensive list at https://github.com/jlopp/physical-bitcoin-attacks https://github.com/jlopp/physical-bitcoin-attacks Side joke: with inflation the XKCD $5 wrench attack (https://xkcd.com/538/ https://xkcd.com/538/) is no longer possible.
- qoez 1y agoThe alt text does say "Also, I would be hard-pressed to find that wrench for $5." so I guess even at the time without inflation it wasn't really possible
- apples_oranges 1y agoFor Americans now difficult. Rest of the world can still order cheaply in China ;)
- cluckindan 1y agoMaybe those orders should be limited given how the tools have no other valid use than password extraction
- hansvm 1y agoYou speak with the same sort of hard-earned wisdom of someone who has also snapped a few cheap wrenches in half.
- grues-dinner 1y agoIt could be a second-hand wrench. Or maybe smuggled in without tariffs: a 1-foot, 3-pound wrench is $3.45 on Taobao (including shipping, a pair of gloves and a roll of PTFE tape). It might not be Snap-On but it'll probably survive being hit with a few crypto speculator skulls.
- krisoft 1y agoOr a stolen wrench. If you are already on the path of criminality.
- margorczynski 1y agoI guess the name is in reference to https://xkcd.com/538/ https://xkcd.com/538/
- martinky24 1y agoThey quite literally say this explicitly in the first few paragraphs. No need to guess.
- TheAmazingRace 1y agoThis write up is very interesting to me for one main reason. It underscores how incredibly important it is for anyone dealing in this stuff to do the following… Keep. Your. Mouth. Shut. Pseudo-anonymity, with the emphasis on the pseudo part, is only as good as you. If you truly believe in Bitcoin and all that implies, it really is in your best interest to be quiet and keep it to yourself, and this knife cuts in more ways than you might expect. You don’t have layers of security like at a traditional bank. You are the weakest link wrt private keys and storage. Also, even talking about it amongst folks you think are your friends, like fellow Bitcoin users, isn’t wise either. Hypothetically, if you became exceedingly wealthy on paper, it would be in the interest of others to take you out of the equation so you can’t cash out. If that means a five dollar (or whatever they cost these days) wrench to the head so you stop moving… now that value is locked up in the blockchain! Could this happen to any given bitcoin users with just a few satoshi or whatnot? Very unlikely, but don’t forget that a decade and a half ago, a handful of bitcoins could cost you very little money. Now it has gone up exponentially in value and would make you a big fat target. There are those on /r/bitcoin that think a wrench won’t ever break their wills and spirits. That math is invincible. Don’t think they’ve ever been on the wrong side of one before. Math might be bulletproof, but wetware is very fragile.
- daveguy 1y agoOr just don't mess with bitcoin and other crypto. It's pretty easy to avoid.
- jsheard 1y agoThe tension is between needing to keep your mouth shut (for your own safety) and needing to loudly evangelize crypto at every opportunity (because its value is still mostly predicated on hype and FOMO, which must be maintained). For people to believe the narrative that buying crypto will make them rich, there has to be crypto-rich people shouting about how crypto-rich they are.
- TheAmazingRace 1y agoThat is quite a balancing act, isn’t it?
- thasso 1y agoWhy don't we hear about this happening to people who are equally wealthy in classical (non-crypto) assets? Are they more discreet and harder to make out or are there protections in place at, e.g., banks that limit the efficacy of these kinds of attacks? I guess most wealth people don't have enough of their wealth in liquid assets to be a good target but people with lot's of crypto assets can easily transfer it all.
- Horffupolde 1y agoBecause the public doesn’t relate to these victims.
- acdha 1y agoIt seems like quite a stretch to think the public feels significantly greater affinity to wealthy people who hold stocks, real-estate, and other traditional assets compared to cryptocurrency speculators. It seems like a much more parsimonious explanation that the attacks are more prevalent in the less secure medium since attackers are more likely to succeed. “Be your own bank” makes a cool bumper sticker but it’s like saying “be your own pilot” or “do your own surgery” in terms of complexity and risk. There’s a reason why these things traditionally involve teams of people with various safety precautions baked in to make attacks riskier.
- ofjcihen 1y ago…Are we doing a “persecuted crypto-holders” thing now? In all seriousness I think most people relate to kidnapping and mutilation and not wanting it to happen to them. I mean it’s not like the traditionally rich receive much love.
- topranks 1y agoThose people keep their money in banks. Sure you can pressure people to transfer money from banks to you. But that will be easier to trace and the transactions could just be reversed. If moving all your wealth the bank is likely to ask some questions, maybe want to see you in person. With crypto the philosophy is “be your own bank”. It’s like keeping your money under the mattress. So you are a much more promising target.
- gesman 1y ago[flagged]
- i80and 1y agoGenerating a bad LLM summary of articles is poor form. (Especially since all the markdown is just visual noise)
- _tom_ 1y agoLiterally yesterday: https://www.nytimes.com/2025/05/24/nyregion/crypto-investor-torture-italian-tourist.html https://www.nytimes.com/2025/05/24/nyregion/crypto-investor-...
- dang 1y agoDiscussed here: Crypto investor charged with kidnapping and torturing - https://news.ycombinator.com/item?id=44085188 https://news.ycombinator.com/item?id=44085188 - May 2025 (67 comments)
- Adrig 1y agoTwo instances of crypto kidnapping happened recently in France just a few weeks apart. The first was the father of a crypto milionnaire who was rescued after a few days, missing a finger. The second is the daughter of a crypto CEO who fended off a kidnapping in broad daylight in the center of Paris, while she was with her husband and baby. Insane stuff. This will only go worse and harder to protect from. Most of the instances I heard about were carried by "amateurs", which makes all this quite unpredictable.
- morkalork 1y agoRecently happened in Montréal too and yes, very amateurish operation that went very very wrong: https://globalnews.ca/news/10868204/quebec-crypto-influencer-body-found/ https://globalnews.ca/news/10868204/quebec-crypto-influencer...
- yupyupyups 1y agoThinking of cryptocurrencies, and trade with them, as the wild west, it shows that many people out there will turn into absolute animals and take the rights of others if the law wasn't there holding a gun to their heads to keep them in check.
- mensetmanusman 1y agoThese events will cause crypto to reinvent the entire financial and legal system then :)
- deleted 1y ago[deleted]
- aleph_minus_one 1y ago... but (hopefully) without the insane amount of its historical baggage.
- bugtodiffer 1y agoby removing more of the legal system
- specialist 1y agoMugging, larceny, robbery, assault & battery, a stick-up. Kids these days.... Always inventing new words for old ideas, amirite? More seriously: I'm still a little unclear how stealing crypto is feasible. There's a ledger, right? Tumblers are really that effective at hiding the chain of custody? At some point(s) the cyberspace "durable digital asset" (h/t a15z) has to emerge in meatspace, right? Even if it pops up in Russia, NK, or Golden Triangle, there's always some heads to bash, fingers to break. Right?
- brewdad 1y agoI imagine it works like the stolen art world. You can’t just put that lost Picasso on auction at Sotheby’s, but the right buyer will take that wallet off your hands and wash it.
- beeflet 1y ago>There's a ledger, right? There is tech for private transactions, but the cryptography is more complex. It's used in cryptocurrencies like zcash or monero. You can also trade between different cryptocurrencies without trusting an intermediary, using "atomic swaps". So if you seize cryptocurrency you think will be tainted, you have a small window to swap it for private (and thus fungible) currency. https://cointelegraph.com/news/zachxbt-330m-btc-heist-xmr-surge-chainalysis-privacy-crypto https://cointelegraph.com/news/zachxbt-330m-btc-heist-xmr-su... This business is booming!
- deleted 1y ago[deleted]
- pierander 1y ago[dead]
- pluto_modadic 1y agoAh, and here I was hoping it would have parallels to attacks on yubikeys. not concerned with coins. or, journalists getting detained at the border.
- akrymski 1y agoYou mean there's a point to banks after all?
- afsdef3f3wafew 1y ago[flagged]
- jonfromsf 1y agoThe obvious answer is to invest in ETFs that hold bitcoin, in a traditional brokerage account. Ironic that it comes to that (given that bitcoin was supposed to take down big finance). But it is the most straightforward and safe way for someone to own some amount of bitcoin.
- beeflet 1y agoThe obvious answer is to kidnap lightning channel maintainers instead. They will always have their funds living on a "live" computer, which you can extract secrets from using whatever side-channel you like. This way, you don't even have to torture them. You just have to kidnap them and keep them from transmitting closing transactions. If you open a channel with them beforehand, you don't even need to extract the keys from their hardware. You get to can steal the funds in their channel unless they use another mechanism like a DMS to transmit a revocation transaction.
- anigbrowl 1y agoHow does this need an academic paper?! >Be rich >Don't have good personal security because you're nouveau-riche and socially naive >Boast about the size of your crypto wallet >Targeted by criminals >surprised pikachu.jpg
- refulgentis 1y agoHow does this need a comment?! >Be bored >Don't have a particular stake in anything you're actively(!) doing >Complain that someone else wrote up something and you don't want to read it >all the commentariat are going to be pleased you deigned to comment on this, thank you sir, for spending your time sir >Do it in the middle of a sea of comments remarking on all the novel aspects of this >brain in microwave.gif
- anigbrowl 1y agoI did read it. I was unimpressed. No, I don't think it's novel at all.
- lo0dot0 1y agoIt's pretentious to say something is "novel" when people have raided each other for valuables for centuries.
- ryanjonney 1y ago[dead]