Crypto custodians are reporting increased interest in their services amid the rising frequency of so-called “$5 wrench attacks” on cryptocurrency traders, investors and project leaders.

In the last year, several high-profile wrench attacks — physical attempts to steal someone’s crypto — have targeted prominent investors and business executives in the blockchain industry. 

The crypto mantra of “not your keys, not your coins” has lost its power among some investors who fear for their personal safety. Cold wallets may offer full control over digital assets, but they also present a single point of attack.

As crypto adoption grows, and wrench attacks persist with the proliferation of more high-value crypto investors, custodians are seeing a shift in preference from self-custody to institutional control. 

Crypto wrench attacks drive security demand

Wrench attacks are nothing new. Jameson Lopp, a Bitcoin (BTC) advocate and chief technology officer of Bitcoin wallet Casa, published a GitHub repository logging hundreds of such incidents since 2014 — and those were only the ones reported in the news.

In the last two to three years, as crypto adoption has sped up and become more mainstream than ever, attacks have grown more public and sophisticated. In January 2025, the founder of crypto wallet Ledger and his wife, David and Amandine Balland, were kidnapped, taken to separate locations and held at ransom. 

Related: Violent crypto robberies on the rise: Six attacks that targeted investors

Just months later, the daughter of an exchange founder barely fought off attackers who attempted to kidnap her in a van on the streets of Paris. Concern over the rise in attacks and their similar methods led French Interior Minister Bruno Retailleau to meet with cryptocurrency professionals to discuss the issue. 

As concern over these attacks grows, crypto custodians are noticing an uptick in interest in their services. 

Emma Shi, over-the-counter and institutional sales director of HashKey, which offers custody and exchange services, told Cointelegraph, “We’re absolutely seeing rising retail anxiety translate into meaningful inflows. Wealthier retail investors are increasingly approaching regulated custodians after high-profile cases like the recent Manhattan kidnapping, where physical coercion was used to access private keys.”

Shi said HashKey’s custody business has noted increased interest in storage from “family offices, crypto-native high-net-worth individuals and even those with nest eggs that are large enough to be vulnerable to theft.”

Cold wallets have long been lauded by crypto advocates as a way to give investors full control over their assets and to keep them maximally secure offline. However, this single key also provides a “single point of failure,” per Wade Wang, CEO of multiparty computation (MPC) crypto custody service Safeheron.

Wang said that there is a “flight to security” among crypto investors, where holders “are actively seeking innovative solutions that eliminate that single point of failure to significantly raise the bar for attacking.”

Already in 2023, a report from PricewaterhouseCoopers on the state of digital custody noted the challenge of cold wallets being prone to theft or loss. One solution posited in the report was MPC or multisignature wallet options. 

Can custody services stop wrench attacks?

Crypto self-custody, while boasting a new technology, runs into the same problem as treasure hoarders throughout history — they were vulnerable to physical attacks and theft until they could share that risk with a stronger and securer institution like a bank. Robbing a bank is a lot harder than robbing a person.

In the same fashion, crypto investors are now seeking to “raise the cost” of the $5 wrench attack. Wang said that investors wish to “return to the fundamental principle: making the cost for an attacker rise exponentially. For example, when it costs $3 million to steal $10 million, the incentive for attack is lost.”

Third-party custody can achieve this and mitigate the problem of wrench attacks, adding time-locks and layers of approval and shifting the target from an individual to the custodian’s employees. 

“But it is not an optimal solution,” per Wang. Trust is still put in a single, centralized institution and, as exemplified by the recent breaches at Coinbase and Bybit, even major regulated crypto businesses are vulnerable to employee misconduct and phishing. 

Related: Lessons from Bybit hack: How to stay safe on crypto exchanges

Wang suggested that distributed custody, such as MPC, “is a superior solution because it fundamentally solves the problem. The core principle of MPC is to use technology to decentralize the single point of control and risk […] into a ‘multiparty’ structure.”

In such a system, control doesn’t belong to any one person, and transferring funds requires complex consensus protocols from multiple parties. 

Decentralized solutions may better reflect the ethos of the blockchain industry, but “we cannot neglect the benefits of centralized custodians,” Wang said. “Reliable security measures bring better assurance of keeping clients’ assets safe, a familiar way of doing things for lots of new crypto players.” 

Centralized or decentralized, crypto investors could still be at risk if the public image of crypto investors is that they are all walking around with cold wallets full of Bitcoin.

Shi said, “The perception of risk matters, too. Attackers often assume holders store funds themselves, so public awareness that more crypto is held in custodial solutions may deter opportunistic assaults.” 

Wrench attacks a “temporary problem” solved by adoption

Public perception is indeed changing. Retail investors are increasingly making crypto part of their portfolio, according to a 2024 report from Ernst & Young. New regulations in large financial markets like the EU and the US are creating the frameworks necessary for institutional investors to get involved.

This regulatory shift has been good for the custody industry as well, as it “legitimizes professional custody for everyday investors and is leading to more offerings from not only crypto-native firms but traditional banks as well,” said Shi.

“We’re seeing crypto adoption accelerate in regions with regulatory clarity, which creates entirely new custody considerations for investors who previously relied solely on self-custody solutions.”

Regulations also raise the stakes of wrench attacks, per Wang. Better regulatory frameworks with more jurisdictions “proactively setting robust regulations” will “inevitably lead to more severe law enforcement actions, which will significantly increase the cost of such attacks and fundamentally curb such behaviors.”

“We see the physical attacking as a temporary challenge,” Wang concluded. 

The crypto industry has evolved through many stages, but the rise of wrench attacks on prominent investors and executives shows that it has yet to reach the maturity of traditional financial markets. 

In the meantime, executives are not only moving their assets to centralized and decentralized custodians but also finding muscle of their own. Personal security firms have also seen an uptick in interest from crypto’s elite to protect their homes and persons.

Magazine: Robinhood’s tokenized stocks have stirred up a legal hornet’s nest

]]> https://earlybirdsinvest.com/wrench-attacks-drive-crypto-investors-to-centralized-custodians/feed/ 0 49795 https://earlybirdsinvest.com/the-tornado-cash-trail-begins-with-a-discussion-about-the-limine-and-data-custodians-movements/ https://earlybirdsinvest.com/the-tornado-cash-trail-begins-with-a-discussion-about-the-limine-and-data-custodians-movements/#respond Tue, 15 Jul 2025 01:42:07 +0000 https://earlybirdsinvest.com/the-tornado-cash-trail-begins-with-a-discussion-about-the-limine-and-data-custodians-movements/

The Tornado Cash Trail began today in the Southern Region of New York (SDNY).

Only during the first 90 minutes of the day, Judge Phila, the judge who was on the trial, worked in prosecution and defense before the court. The rest of the day was dedicated to the ju-describer’s selection process.

The judge began the session by discussing the remaining three claims. In Limin Tornado Cash co-founder Alexey Pertsev’s opposition to data extraction from mobile phones, and from other defenses Brady Defence demand.

Limine #1 Movement: Data Extraction from Persev Phone

In both the status meeting on Friday and the letter sent to court over the weekend, the defense questioned the integrity of the data extracted from Alexei Pertef’s phone.

He argued that some of the messages in the data, especially Pertsev’s telegram messages, should be acceptable as they lack context.

The defense specifically referred to one message. This refers to the quote that he misquoted Pertsev.

The message referenced the $600 million cryptographic exploit from online game Axie Infinity. The funds were washed through Tornado Cash. What court records originally did not show was that this message was forwarded from Coindesk The accused reporter, from Rome Storm, Peltsev.

The judge addressed the issue, but said it was not a basis to exclude the remaining data extracted from Pertsev’s phone from the body of evidence in the case.

Limine #2 move: denial of defense Brady request

Judge Phila also denied the recent Brady request for defense. (This type of request is named after Brady vs Maryland A Supreme Court lawsuit in 1963. Brady The rules provide for clear evidence to be provided to the defense, making it available as part of the due process.

“The idea that there is faster information is very unlikely,” Judge Phila said.

The defense did not push back the judge’s decision.

It raises doubts about the legitimacy of data provided by custodians

Some of the data prosecutors plan to use as evidence in their cases was provided by companies including Apple, X, and Dragonfly (a venture capital firm that invested in Tornado Cash).

The defense questioned the legitimacy of the data provided in light of recent discoveries of false induction telegram messages.

Representatives of these companies requested that they testify during trial regarding the legitimacy of the data.

Judge Phila denied the request and said that such testimony was not necessary.

The defense accepted the denial as it was related to Apple and X, but pushed back against requests related to Dragonfly, calling for questions about the relevance of the data provided by Dragonfly and the devices on which the data was retrieved.

Issues with Dragonfly Telegram Messages

The defense argued that telegram messages from Dragonfly employees should not be included in evidence that the company should not be handed over to court (although it also states that it is OK for the company tornado cash transactions to be handed over).

In response, the prosecutors acknowledged that some of these telegram messages contained hearsay, but explained that the message also includes information about tornado cash business transactions and therefore should not be excluded from the body of evidence.

Judge Faira then cited the 2020 Second Circuit case from the US v. Elgamal.

The prosecution also cited us and Figueroa. This is a 2023 lawsuit that found it legal to recognize a business record that is legal in a particular context, claiming that the telegram message obtained by the court is a business record and is related to the case.

In a final statement on the issue, the defense argued that it speculated that the device on which the telegram message was obtained was a company-owned device.

Judge Phila was particularly surprised by the statement, but said the defense had no basis for the claim and there was a recognition that stated that the phone was indeed a company’s device.

Prosecutors added that the records produced by Dragonfly corresponded to the large ju judge’s summons.

Ju-referee’s choice

The ju apprentice selection process began at 11:15am ET and continued for the rest of the day.

Of the 90 potential ju apprentices, approximately 45 people addressed the court and/or spoke with the judge in a sidebar session.

The ju apprentice selection process will resume tomorrow at 9am ET.

If time allows, the prosecutor and defense will issue an opening statement later tomorrow.