The principal attack vectors against Bitcoin self-custodians, drawn from the LegacyCipher synthesis, Lopp's Physical Bitcoin Attack database, and the practitioner literature, in approximate order of frequency: phishing (the single most common real-world attack — a malicious email, text, or call that tricks the holder into signing a malicious transaction or disclosing recovery information); clipboard malware and address replacement (a compromised computer silently substitutes the attacker's address); supply-chain attacks (a hardware wallet ships with tampered firmware or pre-set keys); leaked cloud backups (a "temporary" photo of the seed synced to iCloud or Google Photos); KYC-data-driven physical attacks (exchange or hardware-wallet customer-data leaks fed into burglary, robbery, and "$5 wrench" targeting — Lopp's database shows a 169% year-over-year jump in 2025); coercion attacks (the holder is forced to cooperate by threat or violence). The defences-by-category section below maps each attack to the configurations and practices that address it. The closing principle: the cryptography is robust; the failure modes are behavioural and procedural.
Why this note matters
Attack-vector cataloguing is the operationalization of Threat modeling for self-custody. Where the threat-modeling note frames adversary categories at the abstract level, this note treats specific attacks: what they look like, how they unfold, what works against them.
The note matters because:
- It surfaces the phishing dominance that every practitioner agrees on. Most newcomers worry about hardware-wallet hacks and cryptographic compromises; most actual losses come from phishing and operational error.
- It catalogues the 2024–2025 physical-attack surge documented in Lopp’s database — a meaningful shift in the threat surface that older guides may not reflect.
- It establishes vector-specific defences that map cleanly onto the configurations and practices the rest of the section recommends.
The defensible position: a holder who can name the specific attacks they are defending against (and the configurations/practices that defend) has a setup that survives. A holder who has only an abstract sense of “security” does not.
The threat landscape (as of 2026-05-14)
Empirical data from Lopp’s Physical Bitcoin Attack database, Chainalysis published estimates, and incident reports across the synthesis sources:
- Phishing dominates incident counts. Estimated >80% of “Bitcoin theft” incidents are some variant of phishing, social engineering, or operational error that traces to a deceptive interaction.
- Hardware-wallet compromise is rare in absolute terms but increasingly newsworthy. The 2020 Ledger customer-data leak and the 2023 Recover controversy have shaped the discussion; specific compromises of correctly-used hardware wallets are unusual.
- Physical attacks have surged. Lopp’s database showed a 169% year-over-year jump in 2025. The pattern: attackers identify holders (via leaked KYC — see KYC leakage for the full treatment of breach mechanisms and the chain-analysis-to-targeting pipeline — public profiles, or socially-close-party disclosure) and target them directly.
- Inheritance failure is the dominant long-horizon failure mode. Not adversarial in the conventional sense; the holder dies or becomes incapacitated and the wallet becomes irrecoverable.
- Self-inflicted operational loss is the dominant short-and-medium-horizon failure mode. Forgotten passphrases, untested backups, novel-scheme failures.
The cryptography is essentially robust. The losses come from behavioural, procedural, and social-engineering failures.
Categorized attack vectors
Remote attackers (digital)
Phishing
What it is: Emails, texts, calls, social-media messages, or website pop-ups that impersonate a trusted entity (exchange, hardware-wallet vendor, wallet software, “customer support”) to deceive the holder into:
- Entering the seed phrase into a malicious website
- Signing a malicious transaction (typically one that sends to the attacker)
- Installing malicious software
- Disclosing other recovery information (passphrase, descriptor, security questions)
How it unfolds:
The attacker has a list of email addresses (often from leaked exchange/wallet databases). They send a convincing message — typically about “security verification,” “address validation,” “urgent action required,” or impersonating a recent legitimate communication.
The message contains a link. The link goes to a spoofed version of the legitimate site. The holder, under time pressure or emotional stress, enters credentials, seed phrase, or signs a transaction.
Why it works: Phishing exploits urgency, fear, and the cognitive cost of verification. Sophisticated phishing operations are nearly indistinguishable from legitimate communications at a casual read.
Defences:
- Never enter the seed phrase into any software interface for any reason. No legitimate flow requires this except hardware-wallet initial setup or restoration.
- Verify URLs by typing them, not by clicking links in emails
- Use a password manager that refuses to autofill on spoofed domains — most managers will not autofill if the domain doesn’t match
- Verify any unusual request through a separate channel — if the exchange “calls you,” hang up and call back via the number on their actual website
- Hardware wallet’s screen verification — for transaction signing, verify the destination address on the hardware wallet’s screen (not just in the wallet software, which could be displaying a different address than what’s actually being signed)
Clipboard malware / address replacement
What it is: Malware on the holder’s computer or phone detects when a Bitcoin address is copied to the clipboard and silently replaces it with the attacker’s address. When the holder pastes into the send-to field, the address looks similar enough that they don’t notice. The transaction goes to the attacker.
How it unfolds:
The malware is installed via a compromised application, a malicious browser extension, or a sophisticated phishing attack. It runs in the background; the holder is unaware. When the holder copies a Bitcoin address (their own, to receive; or a recipient’s, to send), the malware silently replaces the clipboard content with a visually-similar but attacker-controlled address.
Why it works: Bitcoin addresses are long strings; holders often don’t verify character-by-character. The attacker generates addresses with similar prefixes or visual patterns to the legitimate one.
Defences:
- Verify the address on the hardware wallet’s screen before signing — the hardware wallet shows the actual destination address that will be signed, regardless of what was in the clipboard or wallet software
- Verify the address by reading it out loud — character by character — for substantial transactions
- Use QR codes for address transfer when possible (less susceptible to clipboard interception)
- Keep the host computer clean — malware scanning, no untrusted software
Fake wallet apps
What it is: Malicious applications in app stores or distribution channels that impersonate legitimate Bitcoin wallets. The holder downloads and uses the app; the keys are exposed or transactions are misdirected.
How it unfolds:
The attacker publishes a fake “Trezor Suite,” “Sparrow Wallet,” or “Bitcoin Wallet” app. Sometimes the app is a complete fake; sometimes it’s a modified version of the real app with malicious code added. The holder downloads it, enters their seed (for “restoration”), and the seed is exfiltrated.
Why it works: App store discoverability favors familiar names; the holder may not realize they’re downloading a fake.
Defences:
- Download wallets only from the vendor’s official website — verify the URL
- Verify GPG signatures for downloaded software when the vendor publishes them
- Use the hardware-wallet vendor’s official companion app rather than a third-party app
- Cross-check with the broader Bitcoin community — searching for the wallet name plus “scam” or “fake” can surface known bad actors
Compromised firmware / supply-chain attacks
What it is: A hardware wallet ships with tampered firmware or pre-generated keys. The attacker controls or can derive the seed from the start.
How it unfolds:
The attacker intercepts the device during shipping, modifies it, and forwards it to the buyer. Or the attacker compromises the vendor’s supply chain. Or the device is purchased from a reseller (eBay, Amazon) who has tampered with it.
Why it works: Visual inspection of a hardware wallet doesn’t reveal firmware tampering. The operator trusts the device.
Defences:
- Buy directly from the manufacturer or an authorized reseller — never from generic marketplaces
- Verify tamper-evident packaging on arrival
- Initialize the device yourself — generate a new seed; don’t trust pre-installed configurations
- For Tier 3+ holdings, verify firmware signatures or use independently-verified firmware builds
- Diversify vendors in multisig so a single-vendor compromise affects at most one key
Leaked cloud backups
What it is: The holder photographed the seed phrase “temporarily” or stored it digitally. The photo or file syncs to iCloud, Google Photos, Dropbox, or another cloud service. The cloud account is later compromised.
How it unfolds:
The compromise can be:
- A targeted attack on the cloud account (credential stuffing, phishing)
- A breach of the cloud provider
- A family member’s accidental discovery
- The holder forgets the photo exists; years later, a different compromise surfaces it
Why it works: “Just for a minute” is a structural pattern. The holder intends to delete the photo and forgets; the cloud sync happens automatically.
Defences:
- Never photograph the seed, ever, for any reason
- Never store the seed in any digital form, even briefly
- Disable cloud backup of camera roll if cloud sync is a concern
- Audit cloud accounts periodically — what photos and files are stored; are there any sensitive items
Compromised host computer
What it is: The computer running the wallet coordinator software is compromised. Malware can modify transaction destinations, capture screen content, or attempt to manipulate the operator into signing malicious transactions.
How it unfolds:
The host computer is compromised through standard channels — phishing emails, malicious downloads, compromised browser extensions, supply-chain attacks on commonly-used software.
The hardware wallet’s structural protection still holds — the keys never leave the device. But the host computer can:
- Display a different address on screen than what’s actually being signed
- Modify the transaction the operator thinks they’re signing
- Capture the screen during signing (preserving information for later attacks)
Defences:
- Verify destination addresses on the hardware wallet’s screen — this is the load-bearing defence; the hardware wallet displays what’s actually being signed
- Maintain host-computer hygiene — limit installed software, especially extensions; keep OS and software updated
- For substantial transactions, sign from a dedicated computer used only for Bitcoin operations
- Use air-gapped signing workflows where the threat model warrants (Foundation Passport, Coldcard with MicroSD/QR)
Local physical attackers
Burglary of identified targets
What it is: A burglary specifically targeting someone known or believed to hold Bitcoin. The attacker enters the home in the holder’s absence and searches for hardware wallets, seed backups, and other valuables.
How it unfolds:
The attacker has identified the target — through KYC-data leaks, public profile, social-media disclosure, or socially-close-party leak. They time the burglary for the holder’s absence. They search known patterns (home safes, filing cabinets, desk drawers).
Why it works: Many holders store hardware wallets and seed backups in predictable locations. Some backups are unlabeled but identifiable on inspection.
Defences:
- Geographic distribution of multisig keys — no single home should contain enough material to spend the wallet
- Discrete storage — backups not in obvious places; some products are deliberately disguised
- Avoid identification as a Bitcoin holder (Lopp’s “don’t talk about Bitcoin” rule)
- Home security improvements — alarms, safe-cracking-resistant safes, geographic redundancy
The “$5 wrench attack” (coercion)
What it is: The attacker abandons cryptography and threatens or uses violence to compel the holder to cooperate. Named for the XKCD comic — the attacker doesn’t need to break the encryption; they need only a wrench and the willingness to use it.
How it unfolds:
The attacker confronts the holder physically — at home, on the street, during travel. They demand access to the holder’s Bitcoin. The threat is direct: cooperate or experience violence.
This category has surged in 2024-2025 per Lopp’s Physical Bitcoin Attack database. The attacker base has expanded from organized crime to opportunistic individuals; the data feeding the targeting pipeline (KYC leaks, public profiles) has grown.
Why it works: Cryptography doesn’t protect against physical force. A holder under direct threat will typically cooperate.
Defences:
- Don’t be identifiable as a Bitcoin holder — the dominant prevention strategy. Public profile drives targeting; private profile reduces it.
- Genuine inability to move funds unilaterally — multisig with remote-confirmer or time-locked transactions means the holder cannot move funds under coercion regardless of their willingness. “I genuinely cannot do this” is structurally stronger than “I won’t do this.”
- Geographic key distribution — the holder physically cannot access all keys; the attacker must accept that some funds will require additional time and coordination
- Decoy wallets and duress patterns — speculative effectiveness (Lopp documents cases where decoys failed); should be one layer among several, not the primary defence
- Personal-safety practices — don’t travel with hardware wallets unnecessarily; don’t discuss holdings publicly; be aware of your surroundings
Kidnapping and extortion
What it is: An extended form of the wrench attack — the holder is detained, often with family members, until they cooperate or pay ransom.
How it unfolds:
The attacker has resources beyond an opportunistic mugging. They identify a substantial target, plan the operation, and execute it over hours or days. The 2024-2025 surge includes several documented incidents in this category.
Why it works: Sustained pressure compounds. A holder who could resist for an hour will typically cooperate after a longer period; family-member threats are particularly effective.
Defences:
- Avoid identification as a large Bitcoin holder — the most reliable prevention
- Personal security — for known-large holders, professional security consultation
- Genuine inability to move funds quickly — time-locked transactions, multi-day signing requirements
- Plausible-deniability decoys for the smaller amounts the attacker may believe are everything
- Family-member preparation — family members who know nothing cannot reveal anything under pressure; family members in the threat model should have their own protection considerations
Socially close parties
Family member discovery
What it is: A family member finds the seed backup, hardware wallet, or documentation. Sometimes the discovery is innocent (cleaning); sometimes deliberate (curiosity, perceived entitlement, financial pressure).
How it unfolds:
The family member photographs the backup, attempts to use it, or shares the discovery with others. The exposure may be silent (the holder doesn’t know it happened) or eventual (the family member’s later actions reveal it).
Defences:
- Compartmentalize knowledge of holdings from family members where appropriate
- Discrete storage — backups not visible during ordinary household activities
- Inheritance planning that surfaces what is known to whom intentionally
- Trust assessment — which family members can reliably maintain confidentiality
Ex-spouse / divorce dynamics
What it is: A separation reveals knowledge that one party has, often used in financial disputes.
How it unfolds:
During marriage, one or both partners may have access to the Bitcoin setup. During divorce, the access becomes a contested asset; the disclosure may extend to legal proceedings.
Defences:
- Pre-marital planning for jointly-held vs separately-held holdings
- Trust structures that clarify ownership
- Legal documentation appropriate to the jurisdiction
- For substantial holdings, professional legal coordination
Heir making decisions the holder would not have made
What it is: After the holder dies or becomes incapacitated, the heir makes custody decisions (selling, moving, exposing) that the holder would have opposed.
How it unfolds:
The heir lacks technical understanding, follows bad advice, or has different values than the holder. The wallet’s structural protection is preserved but the assets are mishandled.
Defences:
- Inheritance documentation that specifies the holder’s intentions
- Trust structures with trustees who can guide the heirs
- Inheritance rehearsals that prepare the heir for the technical and decision-making aspects
- See Inheritance planning for bitcoin for the full framework
Institutional and legal
Custodian failure or freeze
What it is: A custodial service (exchange, collaborative-custody partner, lending platform) fails, freezes withdrawals, or has its assets seized.
How it unfolds:
The failure may be bankruptcy (Voyager, Celsius, FTX-style events), regulatory action (sanctions, court orders), or operational compromise (a hack). The holder’s funds are inaccessible during the resolution period; sometimes never recovered.
Defences:
- Self-custody for substantial holdings — the structural defence
- Collaborative-custody with sovereign-recovery commitment — partner failure doesn’t prevent the holder from accessing funds
- Counterparty monitoring — track the health of any institutions you rely on
- Diversification across multiple service providers
Regulatory and tax disclosure
What it is: A government authority demands disclosure of holdings or freezes accounts under court order.
How it unfolds:
The disclosure may be routine (tax authority queries during audit), targeted (specific investigation), or broad (jurisdictional capital controls). The court order may freeze a custodian’s holdings or compel cooperation.
Defences:
- Self-custody for sovereignty-sensitive portions of holdings
- Tax compliance — voluntary compliance reduces exposure to enforcement
- Jurisdictional planning — for international holders, trust structures and citizenship considerations
- Legal counsel for substantial holdings; this is outside operational-security scope but interacts with it
Defences by category
| Attack vector | Primary defences | Configuration implications |
|---|---|---|
| Phishing | Never enter seed; verify URLs; password manager; verify on hardware wallet screen | All configurations |
| Clipboard malware | Hardware wallet screen verification; QR for address transfer | All configurations |
| Fake wallet apps | Official vendor downloads only; GPG signature verification | All configurations |
| Supply-chain firmware | Buy direct; verify packaging; initialize fresh; vendor diversity in multisig | Multisig benefits from vendor diversity |
| Leaked cloud backups | Never photograph or digitally store seed | All configurations |
| Compromised host | Hardware-wallet screen verification; dedicated computer; air-gap | Single-sig benefits most |
| Burglary of identified targets | Geographic distribution; discrete storage; avoid identification | Multisig structurally addresses this |
| $5 wrench / coercion | Avoid identification; genuine inability via time-lock or multisig | Multisig with remote confirmer is strongest |
| Kidnapping / extortion | Avoid identification; professional security; time-locked transactions | Tier 3 considerations |
| Family member discovery | Compartmentalize; discrete storage; inheritance planning | All configurations |
| Ex-spouse | Pre-marital planning; legal documentation | All configurations |
| Heir mismanagement | Inheritance documentation; trust structures; rehearsals | All configurations with attention |
| Custodian failure | Self-custody; collaborative with sovereign recovery | Substantial holdings should self-custody |
| Regulatory disclosure | Self-custody; tax compliance; legal counsel | All configurations |
Tiered defensive posture
Tier 0: Phishing-awareness; verified downloads; basic operational hygiene. Wrench-attack defence is minimal at this scale.
Tier 1: All Tier-0 defences plus hardware-wallet discipline (screen verification; tamper-evident packaging; never-digital backups). Begin compartmentalizing knowledge of holdings.
Tier 2: All previous plus geographic distribution; multisig (DIY or collaborative); vendor diversity; explicit inheritance planning. Begin engaging the don’t-talk-about-Bitcoin discipline.
Tier 3: All previous plus professional security consultation; possibly time-locked transactions for additional coercion defence; jurisdictional and trust-vehicle planning; family-member-protection planning.
In all tiers: the cryptography is robust. The defences are behavioural and procedural.
What you cannot defend against
Honest acknowledgment of limits:
- Sustained sophisticated coercion by attackers with resources, time, and willingness to use violence over extended periods — defences reduce probability but cannot eliminate the threat
- Nation-state-level adversaries with intelligence, surveillance, and legal authority — individual self-custody does not defend against this category at scale; mostly outside realistic threat models for individual holders
- Black-swan technical attacks — undisclosed cryptographic vulnerabilities, quantum-computing breaks of ECDSA (still theoretical for the relevant signature scheme but the timeline is uncertain)
- Catastrophic events affecting multiple locations simultaneously (natural disasters, regional war) — geographic distribution helps but cannot eliminate
The defensible position: defend against the realistic threats your specific threat model surfaces. Accept that some long-tail threats are not defendable at the individual scale; let those scale to broader society’s defences.
Common pitfalls
Optimizing against newsworthy threats while ignoring frequent ones. Hardware-wallet hacks are newsworthy and rare; phishing is mundane and common. Optimize for the actual incidence patterns.
Treating cryptography as the primary defence. The cryptography is robust. The defences against actual attacks are behavioural and procedural.
Treating decoy wallets as the primary defence against coercion. Decoys’ effectiveness depends on the attacker’s beliefs, which are unpredictable. They are one layer among several.
Ignoring the don’t-talk-about-Bitcoin rule. Public identification as a Bitcoin holder drives targeting for physical attacks. The 2025 surge in attacks per Lopp’s database tracks closely with public-profile factors.
Skipping verification on the hardware wallet’s screen. The screen is the load-bearing defence against host-computer compromise and clipboard malware. Skipping it for convenience defeats the structural protection.
Trusting “support” representatives who contact you. No legitimate service proactively contacts holders requesting credentials or seed phrases. Inbound “support” interactions are nearly universally phishing.
Inadequate inheritance planning. Self-inflicted loss via inheritance failure is structurally similar to attack loss — the holder’s wealth is lost. The defences are different but the impact is comparable.
Believing “I’d never fall for that.” Phishing is sophisticated; the cognitive cost of verification is real. Procedural defences (password managers that refuse to autofill; hardware-wallet screen verification) are required because human vigilance alone is insufficient.
Tooling and resources
The synthesis document (canonical for the section):
- Bitcoin Self-Custody & Security: A Synthesis of Contemporary Best Practices, LegacyCipher discussion, April 2026 — attack-vector cataloguing.
Primary practitioner sources:
- Lopp — Physical Bitcoin Attack Database (annual updates); 21 tips for securing your bitcoin. See Jameson Lopp.
- Blockchain Commons — Smart Custody Book; 27-adversary framework
- Casa — case studies on specific incidents; the seedless-security model documentation
- Unchained — operational-security guides
- Nunchuk — sovereignty-focused threat-model engagement
Empirical references:
- The Block — 2024-2025 wrench-attack reporting
- TRM Labs, Merkle Science — incident data on physical attacks against crypto holders
- Coinbase, Ledger breach disclosures and post-mortems
Software defences:
- Password managers with phishing resistance (1Password, Bitwarden, KeePassXC)
- Hardware-wallet vendor official downloads and verification
- Coordinator software with explicit anti-phishing features (Sparrow, Specter)
As of 2026-05-14: the attack landscape continues to evolve. The 2024-2025 physical-attack surge is the most notable recent shift. The principal defences remain stable; specific tooling updates periodically.
Open questions for further development
- The 2024-2025 physical-attack surge is documented. Is it a sustained trend or a temporary spike? The 2026 data will be informative.
- Time-locked transactions and remote-confirmer multisig configurations provide structural defences against coercion. How widely are these adopted, and what are the operational costs?
- The “$5 wrench” framing emphasises individual attackers; the empirical picture includes organized operations. Should the framework distinguish these more sharply?
- AI-generated phishing is increasing in sophistication. The “verify by separate channel” defence is still valid but the cognitive cost is rising. What additional procedural defences are emerging?
Related notes
The framing context:
- Loss vs exposure failure modes — attacks are the principal exposure-side events
- Threat modeling for self-custody — the abstract framework this note operationalizes
- Self-custody configuration ladder — defences map onto the rungs
Adjacent operational notes:
- Operational security practices — the behavioural-layer defences
- Common failure modes in self-custody — the loss-side counterpart
Storage and key concepts:
- Seed phrases and BIP-39 — never-digital discipline
- Passphrases and the 25th word
- BIP-85 child seeds
- SLIP-39 and Shamir Secret Sharing
- PSBT and wallet descriptors
Hardware wallets:
- Hardware wallets overview — vendor diversity in multisig
- Ledger considerations and tradeoffs — the 2020 leak’s downstream attack consequences
- Other per-device notes
Custody configurations:
- Multisig setups — defends against single-key compromise
- Collaborative custody services — partner-mediated defences
Backup, recovery, rehearsal:
- Backup strategies for seeds — discrete backup discipline
- Steel seed storage — physical durability
- Recovery rehearsal practice — catches operational errors
Inheritance:
- Inheritance planning for bitcoin — heir-mismanagement defences
The principal practitioner:
- Jameson Lopp — Physical Bitcoin Attack Database; the empirical foundation
The sub-MOC home: