News for hackers. Stuff that matters.

gesman

TLDR:

The paper *"Investigating Wrench Attacks: Physical Attacks Targeting Cryptocurrency Users"* presents the first comprehensive study on wrench attacks—real-world physical attacks used to coerce cryptocurrency users into handing over their digital assets.

### Summary of the Paper:

#### *Definition & Origin*

* The term "\$5 wrench attack” originates from a webcomic and refers to using physical coercion (like a wrench) instead of complex hacking to obtain information such as crypto keys. * The paper defines wrench attacks as *intentional physical attacks to unlawfully obtain cryptocurrencies* via coercion or violence, combining crimes against both persons and property.

#### *Methodology*

* *Data triangulation* from:

  * 10 **interviews** with victims and experts
  * 146 **news articles**
  * 37 **online forums** (672 posts analyzed)
* *Crime script analysis* was used to map how such attacks are prepared, executed, and concluded.

#### *Key Findings*

* Attackers range from *organized crime groups* to *friends, family*, and *even corrupt law enforcement*. * Victims are often *public figures, early adopters*, or participants in *peer-to-peer (P2P) crypto transactions*. * Attacks include *robbery, kidnapping, murder, blackmail*, and a new category: *cryptocurrency-facilitated domestic economic abuse*. * *No user is immune*, including security-savvy individuals. * Attacks have *increased over time*, especially during market booms (e.g., 2017, 2021). * Victims often *do not report attacks*, fearing revictimization or police inaction.

#### *Security Insights*

* Most victims had *used centralized exchanges* and undergone *KYC* processes, potentially exposing their identity and holdings. * Wrench attacks *bypass digital security*—no software or hardware defense can prevent coercion under threat. * Victim behaviors (e.g., displaying crypto apps in public, sharing wealth) can unintentionally increase risk.

#### *Recommendations*

* *For Users:*

  * Keep a **low profile** about crypto holdings.
  * Use **multi-signature wallets**, **distributed fund storage**, and **plausible deniability mechanisms**.
  * Exercise caution during **P2P transactions** and avoid carrying large amounts of crypto assets.
* *For Industry & Regulators:*

  * **Reevaluate KYC policies**—data leaks can serve as “shopping lists” for attackers.
  * Implement **transaction delays** or **alerts** for large withdrawals to thwart coercion.
  * Improve **wallet UI/UX** to prevent exposing sensitive information (e.g., display balance).
#### *Contributions*

* Introduces the first *formal legal definition* of wrench attacks. * Identifies *seven forms* of wrench attacks. * Provides *actionable policy and design recommendations* for reducing risk.

---

This research highlights the *growing intersection of physical crime and digital assets*, calling for urgent changes in user behavior, system design, and policy to mitigate this underreported but increasingly relevant threat.

Re:Void: Open-source Cursor alternative on Friday May 09, 2025 @02:10AM (#43934226)
Context7 is missing lots of info pieces from the repos it indexing and getting overbloated with similar sounding repos, which is becoming confusing for LLM's.
Re:The Llama 4 herd on Sunday April 06, 2025 @11:21AM (#43602082)
RAG gets bigger as everyone else gets bigger. Flooding prompts with garbage is not a sound strategy...
Re:The Mullvad Browser on Monday April 03, 2023 @12:59PM (#35427328)
>> I use it for torrenting so my ISP can't snoop on me

Would installing WireGuard server on a router directly solve this (like Gl-Inet travel routers)?

Yes, google: "gl inet travel routers". Supports everything.

And this: https://www.gl-inet.com/products/compare/

I have about 5 of these at home, each configured at different subnet and VPN for different country. One i always take with me while traveling to securely connect via shady hotel Wi-Fi's.

You can even go crazy with it - install ZeroTier directly in the router by typing few commands and access low-level config of the router from anywhere.

Have a separate small travel router with embedded VPN support to connect printer to Wi-fi hotspot with whatever region it wants to see.

It's not HP's or any other vendor's business to know where you are. This is an easy solution to this.

I have a few routers at home with a separate Wifi hotspot each configured for separate country to avoid exactly this nonsense for different services.

Advantage of this approach is you can travel with a small travel router all over the world while feeding each of the service with a consistent country location.

Added privacy is a benefit.

Re:Dpreview.com is coming to an end on Tuesday March 21, 2023 @02:06PM (#35250039)
I'm sure there would be a line-up of good-willing buyer(s) for DPREVIEW.

This is an exceptional portal with second-to-none depth of photo technology coverage.

It feels like something is missing in "we're closing" message. Cost is not the problem these days.

Pending lawsuits?

Blackmail from deep pocket disgruntled vendor?

Re:Brave – copy clean link feature on Thursday March 09, 2023 @02:44PM (#35085658)
Does it follow redirects and removes affiliate links?
Re:Show HN: Usage 2.0 – Cut AWS Spend by 57% in 5 Minutes on Wednesday March 01, 2023 @06:28PM (#34989853)
Yes it should be and will be in a due time.

AMZN carefully watches the marketplace for "wonders" who are monetizing inefficiencies and if these inefficiencies worth big enough profit, AMZN will fill the gap themselves.

Platform is never your friend or "partner" even if they say so.

Re:Big Data Is Dead on Tuesday February 07, 2023 @04:26PM (#34699932)
Customer pays data analytics vendor to tackle bunch of their [low quality, big size] data.

If you have no tangible capabilities to do above, asking customer "ARE YOU IN THE BIG DATA ONE PERCENT?" will be the quickest way out of the door.

Re:A startup is deploying armed bodyguards to NYC on Monday February 06, 2023 @10:03AM (#34678286)
Or allow concealed carry and stand their ground for responsible citizens to protect their lives.

Problem solved.

Re:Watermark Remover (AI Powered) on Monday February 06, 2023 @09:55AM (#34678139)
Next: FindWatermarkRemovedAndSue.AI
Re:Ask HN: Are you tired of reading ChatGPT headlines? on Saturday February 04, 2023 @05:11PM (#34658941)
I signed up for GPT, asked two questions and this was the end of it.

The answers were "...it is not scientifically proven" BS.

Something I already proved with my own life, GPT is not willing to answer and risk its good, politically correct name for.

Google is here for stay until people are ready to give up spoon fed BS

Just spent 400 CHF at Galaxus, same day no charge delivery. Ho hassles.
Re:How to Create Luck on Wednesday January 18, 2023 @11:03AM (#34428411)
Or both win :)

Welcome to the world of parallel realities which is beyond the scope of this thread.

Re:How to Create Luck on Wednesday January 18, 2023 @07:24AM (#34425880)
This touches on the whole universe of knowledge of how to manifest desires.

Luck is a final jump into desired physical manifestation of desire.

What author is touching upon heavily - is physical part - doing (something).

Another integral part of manifesting is removing conscious and subconscious blocks (beliefs) and practices of being in the state of already manifested desire.

Manipulating the price is not the same as controlling the project direction.
Already successful business will strengthen their presence with app but not through app.

App-based business models are recipe for disasters. Many horror stories of app banned because scammy competitor complained. Apple or Google won't care.

High app rating for new app is a sure sign of cloned app or scam.

I won't download 95% of apps if i see "includes in-app purchases". Special purpose apps like "All Trails" or specialized aggregators/organizers that require lots of work to deliver - typically justify the cost.

Cute calculators that require recurring payments to disable annoying ads is complete nonsense

Re:We are removing the option to create new subscriptions on Tuesday June 21, 2022 @10:14PM (#31831336)
Or spend less than $80 on GL.iNet GL-MT1300 travel router

or $90 on GL.iNet GL-AX1800 Wifi-6 router with MullVad support preconfigured.

Nothing to install, tweak or have hassles with.

Re:We are removing the option to create new subscriptions on Tuesday June 21, 2022 @02:05PM (#31827112)
It sits between your router and your endpoints (computers, laptops).

It can connect directly via ethernet cable or broadcast it's own WiFi SSID's to which you can connect.

You configure it to always connect to VPN of your choice using OpenVPN or WireGuard protocols.

Then you may connect to this device SSID and your traffic always be routed via VPN connection. This is way better, secure and more reliable than "VPN software" or "VPN apps" solutions.

Not sure if i answered your question?

Re:ZeroTier Business SSO on Monday June 20, 2022 @11:42PM (#31819589)
Yes. Didn't help.

However suddenly one laptop was able to connect to 2 other windows boxes (even though other Windows machines cant).

This tells me it's not ZT fault, but rather everlasting update and restriction nonsense from windows is a culprit

Tip:

This portable secure travel router supports MullVad (and Azire-VPN) out of the box:

https://www.amazon.com/GL-iNet-GL-MT1300-Wireless-Pocket-Siz...

Just input your Mullvad account number and it will upload all WireGuard configurations for all MullVad servers worldwide automatically.

Perfect to use to connect to any unsecure Wi-Fi and drive all traffic via VPN in hotels, airports, coffee shops, etc...

What if my electric wall outlet fails?

Am I going to miss the earth destroyed event? This is unacceptable and worrisome!

Re:ZeroTier Business SSO on Thursday June 09, 2022 @04:37PM (#31686527)
I absolutely loved ZeroTier for last 4 yrs.

Until 2 weeks ago when my Windows machines absolutely stopped seeing each other and communicating with each other.

I made a post on ZeroTier discussion group 2 weeks ago with zero replies so far: https://discuss.zerotier.com/t/windows-machines-lost-access-...

If i can get some help - would be amazing.

Big kudos to you for supporting mother-in-law!

Amazon appends reference code to every search: nb_sb_noss_2

Every time I do any search on Amazon - the resulted URL appends "nb_sb_noss_2" ref code:https://www.amazon.com/s?k=stainless+steel+bar&ref=nb_sb_noss_2It seems impossible to get rid of this behavior no matter if i clear cookies or use privacy window. I also found lots of amazon product links on internet includes same ref. code as well.Whom it belongs to?Who is monetizing my (our) purchases?

( Read More... | 1 comment | 3 points | on HN )
Re:Is that ship still stuck? on Friday March 26, 2021 @03:08AM (#26589520)
How about hard fixing heavy duty winches on the ship itself, attach the other end of cables to the shore and make the ship to pull itself in unstuck direction gradually?
Re:Ask HN: How can I escape my third-world country? on Friday October 02, 2020 @11:39PM (#24669317)
$2k/mo in a passive income + $50,000 savings would qualify you for a decent quality wife :)

What prevents you from moving to "safe, clean country with a non-toxic culture (and preferably a cool climate)"?

Ok, we can cross out Monaco, but there are still lots of options on a table?

When you do stupid things that can physically kill people - then NO.

When you do things that violated someone's arbitrary TOS - this should be NON EVENT.

Older »