Defending Against $5 Wrench Attacks: How Trezor Suite’s PIN and Passphrase Protect Against Physical Coercion

A “$5 wrench attack” is not hypothetical. It describes the scenario where an attacker with physical access to a device, and potentially knowledge of a recovery seed, demands cryptocurrency or uses coercion to extract it. The traditional defense—a secure backup in a vault—becomes worthless if the attacker has already obtained the recovery seed through theft, extortion, or social engineering. The critical question is whether possession of the seed alone is sufficient to move funds, or whether additional secrets create a second line of defense that remains independent of the first compromise.

Trezor’s security model introduces exactly that separation. A recovery seed restores the device’s capability to generate addresses and sign transactions, but it does not automatically grant access to all funds. A passphrase—a user-defined secret distinct from the PIN—creates an alternative derivation path that changes which addresses and private keys are generated from the same seed. Without the passphrase, an attacker holding the device, knowing the PIN, and possessing the recovery seed still cannot reach funds secured under a different passphrase. This architecture transforms a single point of failure into a cascading problem that requires multiple independent secrets to solve.

The physical attack surface and why device capture matters

A hardware wallet’s primary advantage is private key isolation: the keys never leave the device and are never exposed to a computer or network. This is meaningless if the device itself can be stolen or seized. Once an attacker has the hardware wallet in hand, they can begin attempting to access its contents. The first defense is the PIN, which must be entered correctly on the device’s screen to authorize any sensitive operation. The PIN protects against casual theft, where the attacker has the device but not the credentials.

However, a PIN has a known limitation: it can be bypassed or brute-forced under specific conditions. An older Trezor One might be vulnerable to side-channel attacks if an attacker could measure power consumption or timing during PIN entry, though this requires specialized equipment and is impractical for a street-level coercion scenario. More relevant is the reality that a PIN is typically short—often four to eight digits—and designed for usability rather than cryptographic strength. A coerced user can be forced to enter it. A PIN is therefore best understood as a protection against opportunistic theft, not against a capable attacker with the device and time to work.

The recovery seed is the next escalation point. If an attacker obtains both the device and the seed—through theft of a written backup, extortion, or compromise of the initial setup—they can restore all addresses and private keys. This is where the passphrase becomes critical. The passphrase is an additional secret, never stored on the device and never required to be written down. It is derived from BIP-39 standards but functions as an additional encryption input to the key derivation process. A different passphrase generates a completely different set of addresses and keys, all from the same recovery seed.

How the PIN provides the first barrier

The PIN on a Trezor device serves a specific role in the attack chain. When a device is first set up, a PIN is created directly on the hardware. This ensures the PIN itself never travels across a network connection or appears on the computer screen where malware could intercept it. Every subsequent operation that involves signing a transaction or accessing sensitive functions requires PIN verification on the device’s built-in screen. The user enters the PIN using a scrambled layout displayed on the device, not a keyboard, to prevent keystroke logging.

The PIN’s real strength lies in limiting attempts. After a certain number of incorrect entries, the device increases the delay before the next attempt can be made. This exponential backoff makes brute-force attacks time-consuming and impractical in a typical coercion scenario. An attacker with an hour and a device will not successfully guess a four-digit PIN through trial and error. What the PIN does not do is protect against a user who is forced to enter it under threat. In a physical coercion scenario, the attacker simply demands that the user enter the correct PIN, and the barrier collapses.

This is why the PIN should be understood as a control against theft and accidental misuse, not as the complete defense in a kidnapping or extortion scenario. The real protection comes from the layer that remains hidden even if the PIN is compromised: the passphrase. A user under duress can give the attacker the device and, if forced, can reveal the PIN. But if the funds are secured under a passphrase the user has not disclosed, those funds remain inaccessible even if both the device and PIN are compromised.

The passphrase: A secret that changes everything

The passphrase is fundamentally different from the PIN because it is not a fixed credential stored on the device. Instead, it is an arbitrary text string that the user can choose and must enter each time they want to access funds secured under that passphrase. According to BIP-39, the passphrase is combined with the recovery seed during key derivation. A different passphrase produces a completely different hierarchical deterministic wallet, with different addresses and private keys, from the identical seed.

In practical terms, this means a user can create multiple “hidden wallets” from a single recovery seed by using different passphrases. One passphrase might be the primary wallet, containing most holdings. Another might correspond to a much smaller “decoy” wallet with a nominal amount of cryptocurrency—enough to satisfy an attacker without revealing the existence of the larger holdings. The decoy wallet is not truly hidden in a technical sense; it is derived from the same seed and follows the same protocols. But its existence is unknown unless the user discloses the passphrase used to derive it.

An attacker who extracts the recovery seed and knows the PIN has a working device but still cannot access any wallet secured under an undisclosed passphrase. They could enter various guesses at passphrases, but because transaction verification happens on the device itself with no feedback about whether a passphrase attempt was successful, there is no way to confirm whether a guess is correct without seeing the expected addresses and balances. The attacker cannot ask the device “is this the right passphrase?” The device simply derives keys from whatever passphrase is entered and displays the corresponding wallet.

Decoy wallets as a coercion countermeasure

A decoy wallet is a conscious use of the passphrase feature to maintain plausible deniability under coercion. The user creates a second wallet with a different passphrase, funds it with a smaller amount—enough to appear credible but not catastrophic to lose—and memorizes the corresponding passphrase. If physically coerced or threatened with financial loss, the user can provide the decoy passphrase, giving the attacker access to that wallet. The attacker sees legitimate transactions, a realistic transaction history, and a seemingly complete picture of the user’s holdings. The primary wallet, secured under a different passphrase, remains untouched.

This strategy has real limitations that should not be understated. A sophisticated attacker might demand multiple passphrases, use forensic analysis to search for patterns in the user’s behavior, or examine transaction history to determine if the amount seems inconsistent with known income or previous spending. Forensic examination of a device might reveal whether the same seed has been used to create multiple wallets, depending on the device’s logging and the examiner’s technical sophistication. A user’s own behavior—reluctance to disclose additional passphrases, visible distress when a certain amount is mentioned—can signal that more is hidden.

The decoy wallet is therefore most effective in scenarios where the attacker’s goal is to extract “some” cryptocurrency rather than to determine the maximum possible amount. It is a psychological and practical defense, not a technical one that defeats determined forensic analysis. The real value lies in creating asymmetry: an attacker must choose between accepting the visible amount or investing additional time and effort to prove that more exists. In many real-world scenarios, the former choice is made.

Device seizure and the importance of what remains offline

If a device is physically seized, the attacker has the hardware but may not have every piece of information needed to exploit it. The recovery seed, if written down and stored separately, remains secure. The passphrase, if never written down and known only to the user, remains unknown. The PIN can be forced from a user, but a passphrase cannot be extracted from the device because the device does not store it. The attacker must either guess it—a computationally infeasible task with a sufficiently random passphrase—or coerce the user into revealing it.

This architecture is why Trezor Suite and the underlying hardware wallet represent a meaningful security improvement over online wallets or even software wallets running on a general-purpose computer. The private keys are generated and stored exclusively on the hardware device, never exposed to the internet, and never processed by an internet-connected machine during normal operation. An attacker who compromises the computer running Trezor Suite cannot intercept private keys or extract them from the software. The attacker would need to compromise the hardware wallet itself, a much higher bar.

The challenge arises when the attacker has all three: the hardware device, knowledge of the recovery seed, and physical control over the user. In that scenario, the passphrase becomes the only remaining secret. It cannot be extracted from the device or the cloud. It exists only in the user’s memory. This is why passphrase setup and secrecy matter more in high-risk scenarios than in routine cryptocurrency management. A user living in a jurisdiction with political instability, asset seizure laws, or organized crime activity faces a materially different threat model than a user in a low-crime jurisdiction.

Practical setup to defend against coercion threats

For a user concerned about physical coercion, the setup process should be deliberate. First, create the device with a strong PIN—ideally longer than the minimum required—and never write it down. The PIN exists to prevent casual access; a written PIN defeats that purpose. Second, set up the primary wallet under a passphrase that is complex and random, not derived from personal information or dictionary words. The passphrase should be long enough to resist dictionary attacks: at least twelve to sixteen characters including uppercase, lowercase, numbers, and symbols.

Third, if using a decoy wallet strategy, create a secondary wallet under a different passphrase that is easier to remember or less suspicious if revealed. This passphrase should be memorable enough to produce quickly under duress but not so obvious that an attacker can guess it. Words drawn from multiple unrelated categories, combined with numbers, can satisfy both conditions. The decoy wallet should contain an amount that appears credible but not suspiciously small. If a user’s known income suggests they might hold $5,000, a decoy wallet with $500 to $2,000 appears consistent; one with $50 suggests the existence of hidden funds.

Fourth, store the recovery seed in a format that assumes the device may be permanently lost or destroyed. A hardware wallet is a convenience; the seed is the ultimate source of authority. Write the seed in two separate locations, in two different physical formats or locations, such that loss of one location does not result in total loss of the wallet. Do not store the passphrase anywhere written. Train yourself to enter it correctly by using the device regularly, so that under stress, muscle memory can produce it even if conscious recall fails.

Fifth, consider hardware redundancy. A second Trezor device, set up with the same seed, allows recovery without touching the first device if it is seized. Both devices will derive the same addresses and keys from the same seed, and the second device can sign transactions for any wallet. This provides operational continuity if one device is compromised or confiscated. It does not protect against an attacker who wants to coerce the primary device specifically, but it does ensure that cryptocurrency is not lost simply because one piece of hardware changed hands.

What attackers still cannot do without additional secrets

An attacker with a Trezor device and a valid recovery seed can do several things: they can restore all addresses derived from that seed, examine previous transaction history on the blockchain, and create new transactions to move cryptocurrency held under the default derivation path. What they cannot do—without the passphrase—is access any wallet created under a different passphrase. They cannot decrypt the passphrase from the device because it is not stored there. They cannot extract it from the computer running Trezor Suite because the software never stores the full passphrase. They cannot determine from blockchain analysis alone whether additional passphrases exist, because all passphrases are equally valid and produce equally legitimate wallets.

An attacker’s practical options are limited to guessing, brute-forcing, or coercing. Guessing requires knowledge of the user’s patterns; brute-forcing a sufficiently random passphrase is computationally infeasible; coercing requires the attacker to force the user to reveal it. If the user credibly claims not to remember a passphrase—and gives the impression of full cooperation by revealing one decoy passphrase—the attacker faces diminishing returns. Additional threats may produce additional passphrases, but without a way to confirm that a revealed passphrase is the “complete” one, the attacker cannot be certain that more funds are not hidden.

The device itself cannot be forced to disclose how many passphrases exist or which passphrase corresponds to the largest balance. Each passphrase is treated as equally valid. The attacker must choose between accepting what they have extracted or investing further effort to extract more. In a physical coercion scenario, time and attention are constraints. An attacker who has already obtained cryptocurrency through the decoy wallet faces pressure to leave before police arrive, neighbors intervene, or the victim recovers and seeks help. The architecture does not prevent loss entirely, but it creates friction that deters the attack from scaling indefinitely.

Limits of this defense and realistic threat modeling

No security measure is perfect against all attackers with all resources. A state actor with forensic equipment, time, and technical expertise could extract information from the device itself through side-channel analysis, electromagnetic observation, or destructive testing. A attacker with legal authority could subpoena records or demand information under threat of prosecution. A threat that includes harm to family members or other hostages can override rational decision-making. The passphrase and decoy wallet are not defenses against these scenarios; they are defenses against criminals, kidnappers, and coercion attempts that assume the victim will comply if the attacker’s demands seem reasonable.

The setup also assumes that the user’s behavior does not reveal the existence of hidden funds. If the user has a known income, documented expenses, and a visible lifestyle inconsistent with holding multiple hidden wallets, an observer might reasonably infer that additional assets exist. Cryptocurrency history cannot be rewritten; if blockchain analysis shows large inflows to the device or large outflows to known entities, that history is observable regardless of whether the funds are currently accessed through a decoy or primary passphrase.

Additionally, the passphrase strategy depends on the user’s discipline. A passphrase written down, stored in a password manager, or mentioned to someone else ceases to be a secret. A user who forgets the passphrase has permanently lost access to that wallet; there is no recovery mechanism. A user who uses the same passphrase across devices or shares it with a trusted contact has created additional attack surface. The security gain is contingent on behavior that remains consistent under stress and over years of time.

Realistic threat modeling means assessing whether coercion is an actual threat to the user’s circumstances. For most users in stable jurisdictions, the risk is vanishingly small. The effort required to set up and maintain multiple wallets, memorize complex passphrases, and create plausible decoy wallets is substantial. A user concerned primarily about theft or malware would be better served by ensuring the device is protected, the seed is stored securely, and the PIN is strong. The passphrase and decoy wallet become relevant when the threat model includes physical access by an intelligent, determined attacker who wants to extract funds under coercion.