Privacy and operational security — staying off the target list

There is more depth here if you want it. A couple of optional tools go further still — PayJoin and Silent Payments. Neither is required, and you are not behind if you never touch them, so they wait for you in Running your own node, the last lesson of this level, rather than cluttering the habits that do most of the work.

A note on Lightning. Lightning payments don’t appear on the public ledger individually, so routine spending over it leaves far less of a trail — a real step up. But opening and closing a Lightning connection is on the ledger, and if you fund it with ID-checked coins, that identity follows you in. Use it for small everyday spending; keep the habits above for savings.

You have seen the first half of the pipeline: a leaked ID check puts your name, your home address, and the fact that you hold Bitcoin into one file. That file circulates for years, and you cannot un-leak it.

The second half is the part you still control — the public clues you leave yourself. Posts under your real name, a talk you gave, a balance screenshot, a comment from a friend about “my buddy who’s into Bitcoin.” On their own each is harmless. Combined with a leaked home address, they turn a maybe into a yes, and that is what a target list is made of. Jameson Lopp, who keeps the most detailed public record of real-world physical attacks on Bitcoin holders, puts this above everything else: the most effective thing you can do to lower your risk is to not talk about Bitcoin using your real name or face.

That is not secrecy or shame. It is declining to paint a target on yourself. In practice:

• No balance screenshots. Not ever, not anywhere public. One screenshot travels further than you think.
• No “just bought more” posts under your real name, and no Bitcoin-branded hats, keychains, or laptop stickers in public. Small signals accumulate into a picture.
• Keep amounts vague — see below on why “even with friends” is the hard part.
• Use a separate, non-name email for Bitcoin accounts, and keep your home address off things where you can — some people ship hardware to a P.O. box or a work address.

The hard part is the people you trust. The instinct is that this rule is about strangers on the internet. It isn’t. Almost everyone who gets targeted was known to hold Bitcoin by someone who told someone else. Your brother-in-law is never going to rob you — but he might mention it at work, and the colleague he mentions it to might repeat it at a bar, and by the third telling it has reached somebody you have never met, still attached to your name and the town you live in. You control the first telling and nothing after it.

So keep it tight even at home. No figures, no screenshots, no “it’s done really well this year,” no “I bought in early.” None of that is a lie you need to tell — “I own some Bitcoin” is a perfectly good answer to a friend, and “I’d rather not get into numbers” is a complete sentence. What you cannot do is un-say a figure. Once a number is out, it travels on its own.

None of this means staying silent. Talk about Bitcoin the idea — the technology, the freedom, the economics — as loudly as you like. That’s the whole rule in one line: talk about Bitcoin; never talk about your Bitcoin.

There's a well-known joke in security circles called the "$5 wrench attack." The idea: no one needs to crack your encryption if they can simply confront you and demand you hand over the coins. It sounds scary, so let's take the fear out of it and think clearly.

First, keep the odds in view. This is rare, and it clusters almost entirely around people who were identifiable as holders. Everything in the sections above is your real defense. Prevention through privacy beats any dramatic response.

Second, the best protection is not bravery — it's a setup where cooperating fully still can't hand over everything. If your coins are arranged so that no single place, and no single action of yours, can move all of them, then "I genuinely can't do that right now" is simply true. You're not bluffing. You're not resisting. You're telling the truth, and that is far safer than trying to be a hero.

You may also hear about a duress wallet or decoy wallet — a small, believable stash you can reveal to satisfy someone, while the bulk stays hidden and separate. These can be a useful extra layer, but they're not reliable on their own. Someone may not believe a decoy is everything. So treat a decoy as one thin layer on top of the real defenses: being hard to identify, and being genuinely unable to move it all at once.

Back in the backup lesson you spread your backups across genuinely separate places. That is worth doing whatever your setup, because it defeats destruction and it makes you harder to search. But be clear about what it does not do. If you hold a single set of recovery words, every place you keep a copy is a place that holds everything. Three copies in three cities is three chances for someone to find the lot. Spreading copies around buys durability and obscurity — it cannot, on its own, make any one location "not enough."

What makes that true is how your keys are arranged, which is the whole point of the ladder. Three of its rungs give you a setup where cooperating fully still can't hand over everything:

• A passphrase (rung 2) — your words live in one place and the passphrase in another, and neither alone opens the wallet holding your savings. It is also what makes the decoy above possible: the words on their own open a small, believable stash. Back the passphrase up as carefully as the seed and store it where the seed is not — a passphrase kept only in your head is the single most documented way people lose passphrase-protected Bitcoin.
• Multisig (rung 3) — two of three keys are needed to spend, and they live in genuinely different places. One home, one break-in, one search: never enough.
• Collaborative custody (rung 4) — you hold two keys and a Bitcoin service holds the third. Someone standing in front of you cannot produce the service's cooperation, and you genuinely cannot give it to them.

Shamir backup does something similar for a single key: it splits one backup into shares, so any few rebuild it and one alone reveals nothing.

None of this is a reason to climb for its own sake. The guide's governing rule still holds — choose the simplest setup that covers you — and for most people the physical risk is small, so the honest answer at the first rung is that spreading copies out is for fire and flood, not for a confrontation. But if a physical threat is a risk you can genuinely name, this is one of the few reasons to move up a rung on purpose.

One more everyday habit, whatever rung you are on: don't carry your hardware wallet around unless you actually need it. It stays home, or wherever it lives, most of the time. There's no reason to have it in your bag on a normal day, and every reason not to have it on you if something goes wrong away from home.

It’s easy to read a page like this and feel uneasy. Don’t. For the large majority of people, physical attacks are a small, tail-end risk — the rare worst case, not the everyday one. And the habits that guard against it are the same low-effort ones that make your whole life a little more private: a fresh address every time, no balance screenshots, no logo hats, vague amounts, backups spread out, device left at home.

You don’t need bodyguards or a bunker. You need to be unremarkable. Match your effort to what you actually hold — a modest stack needs modest habits — and then enjoy the quiet confidence that comes with holding your own keys.