VEYRNOX · Duress Wallet

A duress wallet for the moment cryptography can't help you

Every wallet works fine — until someone with a wrench stands over you and tells you to unlock it. Cryptography protects your keys from mathematics, not from people. VEYRNOX Safety Plus adds a Coercion Resistance layer designed for exactly that moment.

The wrench-attack problem

Randall Munroe named it in the $5 wrench attack: no matter how strong your key is, an attacker with physical control of the owner just makes the owner unlock the wallet. Every seed-phrase wallet, every hardware wallet with a single PIN, every custodial account — they all comply when the legitimate owner is forced to comply. As on-chain balances become part of public identity — through NFT collections, ENS names, on-chain donations, or a single loud post about a recent trade — the coercion vector stops being theoretical. Reports of physical attacks on identifiable crypto holders have become a regular part of the news cycle, from home invasions targeting Bitcoiners to organised threats against DeFi personalities. Digital defences do not help here. Cryptography is a tool for the mathematical adversary. For the human adversary standing in your kitchen, you need a different tool.

How Veyrnox Coercion Resistance works

• Two wallets, one app. A real wallet with your actual holdings, and a decoy wallet with plausible balances and transaction history.
• Duress PIN. Under coercion, you enter a different PIN. The app unlocks the decoy — same interface, same look, plausible amount visible.
• Real wallet stays hidden. No indication another wallet exists. The attacker sees something and leaves.
• Believable, not empty. The decoy shows enough to satisfy a rational attacker — an empty wallet raises suspicion.

Combined with tamper detection

Coercion Resistance sits on top of the standard VEYRNOX stack: RASP (rooted / jailbroken / debugger detection), hardware-bound signing via Secure Enclave / StrongBox, biometric gating, and panic wipe. Together they cover both the digital attack path (malware, cloned devices, instrumentation) and the physical one (someone standing next to you).

Availability

Coercion Resistance is a Safety Plus feature — $5.99 / month, cancellable any time. See plans.

How it works

The duress wallet is not a separate app or a hidden partition on the device — it is a second key derivation path unlocked by a second PIN. During Safety Plus onboarding you set two PINs: your real 8-digit PIN, which unlocks your real wallet, and a duress PIN, which unlocks the decoy. Both PINs live behind the Secure Enclave; the app cannot tell one from the other without a successful biometric-plus-PIN unlock. When someone enters the duress PIN under coercion, Veyrnox loads the decoy wallet — same interface, same asset list style, plausible balances, real-looking on-chain transaction history against a decoy address you control. Nothing in the UI hints that a second wallet exists. The attacker sees a working wallet with something to take, and the real wallet remains invisible. Because both wallets sign inside the Secure Enclave and rest on Shamir-sharded backup, the decoy has the same recovery model as the real one — losing your iPhone does not lose the decoy.

Fees

Veyrnox charges $0 for wallet operations on the free plan. Send, receive, portfolio, and WalletConnect dApp sessions on every supported chain cost nothing beyond the underlying network fee, which is set by the chain itself. The duress wallet is not part of the free plan — Coercion Resistance is a Safety Plus feature at $5.99 per month, cancellable any time. That subscription also covers tamper detection, panic wipe, and the other advanced security tooling. There is no separate charge for using the duress wallet under coercion; the monthly Safety Plus subscription is the whole cost. For the full plan comparison see plans.

Ecosystem support — every supported chain, both wallets

The duress wallet is not chain-specific. Whatever assets Veyrnox supports on the real wallet — BTC, ETH, SOL, USDC, USDT, MATIC, ARB, OP, AVAX, BNB — the decoy wallet can hold too, at addresses you fund yourself with plausible amounts. That matters because an attacker who forces you to open your wallet is often looking for a specific asset — a BTC balance they know you posted about, a stablecoin float they overheard about. The decoy can show a plausible amount of exactly that asset, on the same chains they expect to see. WalletConnect v2 dApp connections and the standard signing flow work in the decoy the same way they work in the real wallet, so the decoy behaves like a real wallet under scrutiny, not a demo screen.

Compared to competitors

No consumer hardware wallet — not Trezor, not Ledger — ships coercion resistance natively. A Trezor PIN protects the device against a stranger who picks it up, but under coercion the owner simply enters the real PIN and the attacker gets everything. Passphrase-based hidden wallets on hardware devices offer something in the neighbourhood, but they require the user to remember an additional passphrase under duress, and any attacker familiar with the feature knows to demand the passphrase in addition to the PIN. Software wallets on iPhone — Trust Wallet, MetaMask, Blue Wallet, Muun, Phantom — do not ship a duress mode at all; unlocking the app unlocks the entire balance. Multisig setups can require multiple parties to sign, which mitigates the physical-threat case for very large holdings but is heavy operational overhead for daily use. Veyrnox's Coercion Resistance targets the specific gap: a duress-triggered decoy on the device the owner actually carries, with no additional hardware, no additional signer to coordinate, and no visible tell that a second wallet exists.

Security model

Coercion Resistance sits on top of the standard Veyrnox stack, which is itself hardened for the digital attack surface. Signing happens inside the Secure Enclave, gated by Face ID or Touch ID and an 8-digit PIN. Recovery uses Shamir Secret Sharing — the material needed to reconstruct your keys is split into KEK-encrypted shards across the device and your personal cloud (iCloud, OneDrive, Google Drive, Dropbox, etc.), with reconstitution requiring both. Veyrnox holds no shard. Runtime Application Self-Protection detects rooted or jailbroken devices, active debuggers, and instrumentation frameworks, and blocks signing on compromised phones. Panic wipe clears local material if the app detects tampering. On top of all that, the duress PIN adds the physical-threat layer. Together they cover both the digital attack path (malware, cloned devices, instrumentation) and the physical one (someone standing next to you). For deeper cryptographic detail see Security at Veyrnox, No seed phrase wallet, and Shamir wallet.

Frequently asked questions

Can an attacker tell the decoy from the real wallet?

No — same UI, same asset list style, real-looking transaction history. There is no visual tell.

Can I move the decoy funds to look more real?

The decoy wallet is fully interactive with plausible balances. Its content is under your control.

Does this protect me against on-device malware?

That is what RASP, hardware-bound signing, and biometric gating are for. Coercion Resistance addresses the physical-threat case specifically.

What if the attacker knows Veyrnox has a decoy feature?

They cannot detect from the app whether a decoy is configured or not. The presence of a decoy is itself hidden.

Is Coercion Resistance legal?

Yes — you are choosing which of your wallets to unlock. Consult local law if you have concerns about coercion-response measures in your jurisdiction.

What does the duress wallet feature cost?

Coercion Resistance is a Safety Plus feature at $5.99 per month, cancellable any time. Everyday self-custody stays on the free plan; the duress wallet is the tier upgrade that adds this specific physical-threat protection.

Do I need extra hardware for the duress wallet?

No. The duress wallet is a software feature that runs alongside the standard Veyrnox app on your existing iPhone. It uses the same Secure Enclave signing, Shamir-sharded backup, and biometric gating as the real wallet — no extra device to buy, carry, or lose.

How does the duress wallet compare to a hardware wallet PIN?

A hardware-wallet PIN protects the device against a stranger who picks it up, but an attacker who forces the owner to unlock it still gets access to everything on that device. Coercion Resistance is different — the duress PIN unlocks a plausible decoy wallet instead of the real one, so the attacker leaves believing they got what they came for.

Add AI Security Protection ($19.99/mo, coming soon)

Coercion Resistance sits in the Safety Plus tier and defends the physical-attack surface — the wrench, the airport interrogation, the shoulder-surfed PIN. AI Security Protection — $19.99/mo, coming soon is a separate tier that defends the digital transaction surface. Ten shipped features layer transaction-time threat intelligence on top of Shamir + Secure Enclave signing: Address Threat Screening via the TIP (Threat Intelligence Platform) edge function, Phishing Site Detection (curated blocklist, not an ML classifier), Risk Scoring (nine-signal rule-based composite scorer, deterministic pre-sign), Token Approval Review, Approval Monitor (periodic polling, not push), AI Risk Notes, Personal AI Advisor (chat interface, advisory only), Drainer Detection (local heuristics), Transaction Explanation, and Portfolio Q&A. Digital and physical are separate tiers because they are separate threat models. See Plans & pricing for the full AI Security Protection tier — an AI Security add-on to the Veyrnox stack.

Related

• No seed phrase wallet — why removing seed phrases eliminates phishing
• Shamir wallet — how threshold recovery replaces single-phrase backup
• Security at Veyrnox — full threat model and cryptography overview
• The $5 wrench attack — physical coercion threat model explained