Coercion resistance: what it is and why your wallet needs it
TL;DR. Coercion resistance is the property of a self-custody wallet that lets its owner survive physical coercion — a wrench attack, kidnapping, or forced surrender under duress — without losing the actual funds. Three primitives make it work: duress PIN (a second PIN that opens a decoy wallet), decoy wallet (a plausible-looking wallet the attacker sees instead of the real one), and panic wipe (a gesture that destroys device-side key material immediately). VEYRNOX Safety Plus ships all three.
The threat model most wallets ignore
Every mainstream wallet — MetaMask, Trust, Ledger Live, Phantom, Coinbase Wallet — is designed for one attacker: a remote adversary who wants your seed phrase. None of them is designed for the attacker who is next to you with a weapon. That attacker does not need to guess the seed phrase; they need you to open the wallet.
Chainalysis and TRM Labs both track wrench attacks — physical coercion attacks against crypto holders — as a growing crime category. Public cases: the Toronto crypto exec kidnapping (2024, $1M ransom paid); the Manhattan crypto torture case (2025); the string of French kidnappings that pushed Ledger to ship Recover as an escape valve. In every case, cryptography was not the failure mode. Presence was.
A wallet with real coercion resistance answers the question: what happens when the attacker is in the room and you have to unlock something?
The three primitives
1. Duress PIN + decoy wallet
The wallet has two PINs. The primary PIN opens the real wallet with real funds. The duress PIN opens a decoy wallet — a fully-functional secondary wallet with its own address, its own transaction history, and a small live balance the owner tops up occasionally. Both PINs are valid. The wallet does not signal to the user or the attacker which one was entered. Enter the duress PIN under coercion and the attacker sees a plausible wallet, watches funds move, and never learns the real one exists.
Critical design detail: the decoy must be indistinguishable from a real wallet under scrutiny. That means live balance, chain-verifiable transaction history, real receive addresses, and enough activity to look like a wallet a person actually uses. A decoy with $12 and no history reads as fake; a decoy with $400 and monthly outgoing transactions reads as a real wallet a small holder would defend. Rehearsal matters — the owner should have topped up and used the decoy in the weeks before any attack, so the on-chain footprint is authentic.
2. Panic wipe
A physical gesture — typically holding the device's volume-down button, or entering a specific PIN sequence — that immediately destroys the device-side key share. In VEYRNOX's Shamir 2-of-3 setup, the device shard is one of three. Wiping it forces recovery from the two off-device shards (cloud + optional paper), which the attacker does not have and cannot compel.
Panic wipe is the "no wallet at all" answer. The attacker sees a device that will not open, a wallet that reports no funds, and no path forward. The owner recovers later, elsewhere, from their off-device shards. The device is disposable; the wallet is not.
3. Hidden Safety Plus mode
The whole Safety Plus feature set — duress PIN, decoy, panic wipe — is opt-in and unadvertised in the UI when disabled. A wallet that shows a big "Safety Plus" toggle to every attacker who opens Settings has already leaked that the primitives exist. VEYRNOX Safety Plus, once configured, hides its own configuration surface: a Settings inspection by the attacker reveals no evidence a duress PIN is set up.
Coercion resistance vs custody
A custodial wallet (Coinbase, Binance, Kraken) is coercion-resistant in a specific narrow way: the exchange, not you, holds the keys, so an attacker with a wrench cannot force you to sign because you cannot sign either. That "resistance" costs custody — the exchange can freeze, seize, or refuse to release funds for any reason. It is not the same trade as a self-custody wallet with duress features.
A self-custody wallet without coercion resistance (MetaMask, Trust, Ledger Live without a hidden passphrase) is the worst of both: you hold the keys and you can be compelled to use them. The wrench works.
A self-custody wallet with coercion resistance (VEYRNOX Safety Plus, Trezor with hidden wallet passphrase, Ledger with passphrase) keeps custody and defeats compulsion. That is the trade coercion resistance buys.
What coercion resistance is not
- Not phishing resistance. Phishing attacks the wallet's remote perimeter — coercion resistance answers a physical-attacker threat model, not a network one. RASP, transaction simulation, and address-poisoning defenses cover the phishing side.
- Not multi-factor auth. 2FA slows an attacker who does not have your device. It does not help when the attacker has your device and is compelling you to unlock it.
- Not a hidden passphrase alone. A hidden BIP-39 passphrase (Trezor's "hidden wallet" feature) helps if the attacker only knows the seed. It does not help if the attacker is watching you unlock the wallet, because you have to enter the passphrase in front of them. Duress PIN + decoy is the physical-presence answer that passphrase alone is not.
- Not a panic button that pings a friend. A silent-alarm feature is an incident-response tool, not a coercion primitive. It does not stop the attacker from taking funds while it is being pinged.
How VEYRNOX Safety Plus implements it
VEYRNOX Safety Plus ($5.99/mo, opt-in) ships the full stack:
- Duress PIN. A second 8-digit PIN set during Safety Plus onboarding. Opens the decoy wallet. The wallet does not warn the user when the duress PIN was just entered; it opens the decoy silently.
- Decoy wallet. Derived from a separate branch of the master seed. Owner-controlled, real chain-verifiable state. The user is prompted during setup to top it up with a plausible amount and rehearse an outgoing transaction so the on-chain history looks lived-in.
- Panic wipe. Volume-down long-press from any wallet screen destroys the device-side Shamir share. Recovery from cloud + paper shards is unchanged. No confirmation dialog — the gesture is the confirmation.
- Hidden mode. Once Safety Plus is configured, the Safety Plus settings surface itself is hidden from the primary wallet's Settings tree until the user re-enters the primary PIN plus a specific unlock gesture. An attacker inspecting Settings sees no duress feature.
These features are only on the paid Safety Plus tier because they require the user to actually rehearse the duress path (memorize a second PIN, top up the decoy, practice panic wipe). Free-tier users who never rehearse get a false sense of security; forcing an opt-in and a monthly rebill keeps only actively-engaged users on the feature.
Why not every wallet ships this
- UX friction. Two PINs, decoy top-up, wipe rehearsal — most users will not do the work. Wallets optimized for retail growth choose seamless onboarding over drill discipline.
- Regulator ambiguity. A duress PIN is a feature that lets the user mislead a party who is watching them enter a PIN. Under some jurisdictions' compelled-decryption laws, that may implicate the wallet vendor in obstruction. VEYRNOX ships from the UK where RIPA Section 49 compels disclosure of a decryption key — duress PIN is legal (there is no obligation to disclose a specific PIN when multiple valid ones exist), but the legal boundary is jurisdiction-specific and vendors avoid the analysis.
- Vendor architecture forbids it. A 2-of-2 MPC wallet (Zengo, most retail MPC) cannot ship a duress PIN because the vendor is a required counterparty at signing — a duress signal would have to route through the vendor server, and the vendor cannot lie to itself about which wallet the user unlocked. Only wallets where the signing device has full local authority (Shamir + hardware-bound key material) can implement duress fully.
Coercion resistance in the wallet-comparison matrix
| Wallet | Duress PIN | Decoy wallet | Panic wipe |
|---|---|---|---|
| VEYRNOX Safety Plus | Yes | Yes | Yes |
| Trezor (Safe 3/5) with hidden wallet | Partial (passphrase, not PIN) | Yes (passphrase-derived) | No |
| Ledger with passphrase | Partial | Yes (passphrase-derived) | No |
| MetaMask, Trust, Phantom, Rainbow | No | No | No |
| Zengo, Web3Auth (retail MPC) | No | No | No |
| Coinbase Wallet, Rainbow, Uniswap Wallet | No | No | No |
Setup discipline (what actually matters)
- Pick a duress PIN you would not accidentally enter. If your primary PIN is 481293 and your duress PIN is 481294, you will fat-finger it into the decoy someday. Make them structurally different.
- Top up the decoy with a plausible amount. $200-$800 in a mix of native token + stablecoins reads as a small-holder wallet. $12 in ETH reads as an empty testnet wallet.
- Send from the decoy occasionally. On-chain history is verifiable. An attacker who checks the address on Etherscan and sees zero outgoing transactions in 18 months knows it is a decoy.
- Practice panic wipe on a non-primary device. Wipe recovery from cloud + paper shards is the fallback path, and if you have never rehearsed it, the first time you do it will be under stress.
- Never store the decoy PIN with the primary PIN. If both are in the same password manager, both leak together.