Bitcoin Custody Behavior Under Coercion and Duress

Custody Behavior Under Physical Coercion

This memo is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.

What Coercion Looks Like

Most Bitcoin custody planning assumes voluntary action. Someone dies. Heirs step in. Credentials are located. Funds are transferred according to documented intent. The stress is administrative and emotional, but the process unfolds without opposition.

This memo describes a different situation: custody under coercion. Someone is threatened. Someone is pressured. Someone makes custody decisions not because they choose to, but because they are forced to. The custody system, designed for orderly succession, encounters adversarial conditions it was not built to handle.

---

What Coercion Looks Like

Coercion takes many forms. A home invasion where someone demands access to Bitcoin at gunpoint. A kidnapping where release is conditioned on payment. A divorce where one spouse pressures the other to reveal or transfer assets. A business dispute that escalates into threats. Political or legal pressure that compels disclosure or movement of funds. Situations where someone must act on their custody system not because they want to, but because the alternative is worse.

These scenarios share a common feature: the person controlling Bitcoin is making decisions under threat. Their actions do not reflect their intent. They reflect their circumstances. The custody system responds to whatever inputs it receives, regardless of whether those inputs are voluntary.

An individual may be compelled to act under threat. Transactions executed under coercion are processed identically to voluntary transactions. The network evaluates signatures, not circumstances.

---

The Network Does Not Recognize Duress

Bitcoin transactions are irreversible. Once a transaction is broadcast and confirmed, it cannot be undone. There is no customer service to call. There is no dispute process. There is no authority that can reverse the transfer because it was made under duress.

This is a design property, not a flaw. Bitcoin was built to resist censorship and seizure. No one can freeze your funds or reverse your transactions without your keys. The same property that protects against external interference also means that coerced transactions are final.

Traditional financial systems have mechanisms for duress. A bank can freeze an account. A credit card company can reverse a charge. Courts can order restitution. These mechanisms depend on intermediaries who can intervene after the fact. Bitcoin has no such intermediaries. What is done is done.

A woman under threat transfers Bitcoin to an address provided by her attacker. An hour later, she is safe and calls the police. The police investigate. They may eventually identify the attacker. But the Bitcoin is gone, moved through multiple addresses, possibly converted to other currencies. The legal system may produce justice eventually. It cannot produce reversal.

---

Custody Structures Built for Succession

Most custody planning focuses on what happens after death. The holder designs a system for heirs to access funds when they are gone. Time delays are acceptable because there is no urgency—the holder is dead, the heirs are grieving, a few weeks or months to locate credentials is tolerable.

Coercion operates on a different timeline. The threat is immediate. Compliance is demanded now. Structures designed to slow down access for safety become obstacles that escalate danger. A time-locked vault that protects against impulse theft also prevents compliance when compliance is the only way to end a threat.

A holder set up a multisig arrangement requiring two of three keys to move funds. One key is at home. One is in a bank safe deposit box. One is with a trusted friend in another city. This structure provides protection against a single point of compromise. Under coercion, it also means the holder cannot comply even if they want to. The intruders want Bitcoin now. The holder explains that accessing it requires a trip to the bank and a call to a friend. The situation escalates.

---

When Security Measures Become Liabilities

Features designed to protect Bitcoin can become dangerous under coercion. Each layer of security is also a layer of complexity that must be navigated while under threat.

A hardware wallet with a PIN protects against casual theft. Under coercion, the holder must remember and enter the PIN correctly while terrified. Wrong entries may lock the device. The attacker grows impatient. The situation deteriorates.

A passphrase-protected wallet creates a hidden compartment. The holder can reveal the main wallet while keeping the passphrase wallet secret. But this works only if the attacker does not know about passphrases, does not suspect additional funds exist, and is satisfied with what they see. If the attacker knows more than expected, the deception fails and the consequences may be severe.

Geographic distribution of keys means no single location contains everything needed. Under coercion, this means the holder cannot comply without traveling, contacting others, or waiting for time-locks to expire. Attackers may not permit any of these. The protection becomes a trap.

A man keeps his seed phrase in a safe deposit box, accessible only during bank hours. Intruders arrive at his home at night. He cannot access the seed phrase until morning. The intruders must either wait, leave and return, or escalate. The security measure that protected against home theft created a more dangerous situation when a home invasion actually occurred.

---

Decoy and Misdirection Strategies

Some custody approaches involve decoys—small amounts of Bitcoin kept accessible specifically to satisfy attackers without revealing larger holdings. A wallet with a modest balance that can be surrendered while a larger wallet remains hidden.

Decoys work only under specific conditions. The attacker must be satisfied with what they find. They must not know about or suspect additional funds. They must not torture or threaten further once the decoy is surrendered. They must not have information from other sources about the holder's true holdings.

Some custody arrangements include decoy artifacts intended to satisfy coercive demands. Outcomes depend on attacker knowledge and expectations.

Another holder maintains the same setup. But the intruders did research. They know approximately how much Bitcoin the holder has. The decoy balance is far too small. They do not believe it is everything. They demand more. The holder insists this is all there is. The situation escalates. The decoy strategy, designed to protect, has made things worse.

---

Forced Relocation and Custody Disruption

Coercion does not always involve immediate demands for Bitcoin. It can involve forced relocation—fleeing a country, escaping a dangerous situation, being detained. In these scenarios, the holder is separated from their custody infrastructure without time to prepare.

A person flees their home country on short notice due to political conditions. Their hardware wallet is in a safe they cannot access. Their seed phrase backup is in a safe deposit box at a bank that is now unreachable. Their Bitcoin exists, but their ability to access it does not travel with them. They are safe, but their funds are inaccessible.

Custody systems often assume geographic stability. Devices are stored at home. Backups are stored at nearby locations. Access requires physical presence at familiar places. When the holder is suddenly elsewhere—across a border, in detention, in hiding—these assumptions collapse. The custody system remains intact, but the holder can no longer reach it.

---

Actions Taken Under Duress

Decisions made under coercion may alter the custody situation in ways that persist after the threat ends. A seed phrase revealed cannot be un-revealed. Keys shared cannot be un-shared. Transactions broadcast cannot be reversed.

A holder under threat reveals their seed phrase to an attacker. The attacker leaves. The holder is safe but now has a compromised custody system. The attacker knows the words that control the funds. Until the Bitcoin is moved to a new wallet with a new seed phrase, it remains vulnerable. The holder must act quickly, but they are also recovering from trauma. The window between threat ending and attacker potentially moving funds may be short.

A holder under legal pressure discloses custody information to a party they would not have chosen to inform. The legal matter eventually resolves, but the information is now known. Relationships and circumstances have changed. The custody structure that existed before the coercion no longer provides the same protection after.

---

When Helpers Become Targets

Custody systems that involve trusted third parties create additional exposure under coercion. If an attacker knows that a friend or family member holds a key, that person becomes a target too.

A holder uses a multisig setup with keys distributed among family members. An attacker targets not the holder but the family member perceived as weakest. The holder's mother receives a threatening call. She is told to provide her key or her son will be hurt. She complies. The holder's distributed security has exposed someone he was trying to protect.

Custody arrangements that strengthen security during peaceful times can widen the attack surface during adversarial times. Each person who holds a piece becomes a potential point of pressure. The attacker does not need to coerce the holder directly if they can coerce someone the holder trusts.

---

The Aftermath of Coercion

After a coercion event, the custody situation is changed. If Bitcoin was transferred, it is gone. If credentials were revealed, they are compromised. If the holder survived with funds intact, they face decisions about whether and how to restructure their custody—knowing now that they are a target.

A holder successfully resists a coercion attempt. The attackers did not get the Bitcoin. But they know the holder has it. They know where the holder lives. They may return, better prepared. The holder must now decide: move the Bitcoin to a new wallet in case anything was observed, relocate physically, inform law enforcement, or accept ongoing risk. The custody problem has expanded beyond cryptography into personal security.

Inheritance planning that assumed peaceful succession must be reconsidered after a coercion event. The holder's threat model has changed. What felt like adequate protection now feels insufficient. The assumptions that guided the original custody design no longer hold.

---

Coercion as a Distinct Stress Class

Coercion is different from death, incapacity, or administrative complexity. Those scenarios involve friction and coordination challenges, but they do not involve opposition. Coercion introduces an adversary with goals that directly conflict with the holder's interests.

Custody systems respond differently under these conditions. Protections designed to slow down unauthorized access become obstacles when the holder needs to act quickly under threat. Distributed structures that require coordination become liabilities when coordination takes time the holder does not have. Secrecy that protects against discovery becomes dangerous when attackers know more than expected.

No custody design eliminates coercion risk. Every structure has weaknesses that adversarial pressure can exploit. The question is not whether a system is coercion-proof—none are—but how it behaves when coercion occurs, and what options remain afterward.

---

Outcome

Coercion introduces adversarial pressure that custody systems designed for peaceful succession are not built to handle. The Bitcoin network does not recognize duress—it executes valid signatures regardless of the circumstances that produced them. Transactions made under threat are final.

Security measures that protect against theft can become liabilities under coercion. Time delays, geographic distribution, and multi-party requirements create obstacles when compliance is demanded immediately. Decoys and hidden wallets work only when attackers do not suspect them. Actions taken under duress—revealed credentials, broadcast transactions—persist after the threat ends. Coercion reshapes custody outcomes independent of inheritance intent, creating a stress class that operates by different rules than death or incapacity.

---

System Context

Examining Bitcoin Custody Under Stress

Bitcoin Accident Coma Communication Gaps

Bitcoin Divorce Custody

← Return to CustodyStress