Wrench Attacks Are Climbing: Onramp Just Built the Bitcoin Vault Businesses Actually Need
Physical Bitcoin theft, where criminals bypass every cryptographic protection by simply threatening the keyholder in person, is rising fast enough that an Austin-based custody firm just rebuilt its entire business product around stopping it.
Onramp has launched a new suite of business Bitcoin accounts that require a second person to approve any withdrawal. No single employee, no matter how senior, can move company funds alone. That one structural change eliminates the most common internal and external attack vector businesses face when holding Bitcoin on their balance sheet.
What Onramp Actually Built
The free-tier company account lets businesses register named users and enforce two-person withdrawal approvals at the protocol level, not just as a policy on a spreadsheet nobody reads. This is not a software toggle. A second authorized person must actively confirm before a single satoshi moves.
For companies with serious treasury exposure, the higher-tier option goes further. Keys are split across three separate institutions, meaning no single custodian, no single jurisdiction, and no single point of physical or legal pressure can unlock the funds. A hostile actor, a rogue employee, or even a compromised institution cannot act unilaterally.
Why This Matters Right Now
Wrench attacks, the blunt-force physical coercion of Bitcoin holders, have shifted from a fringe threat to a documented pattern. High-profile incidents in Europe and North America have targeted not just wealthy individuals but business owners and executives whose company holdings became public knowledge on-chain or through filings.
Most businesses holding Bitcoin today rely on single-signer setups, internal policies, or basic exchange accounts that offer zero structural resistance to coercion. If one person holds the keys or the credentials, one person under pressure can drain everything.
The two-person rule is not new in traditional finance. Banks, law firms, and fund administrators have used dual-control requirements for decades. Bitcoin custody is only now catching up, and the timing is not accidental.
What Crypto Holders Should Watch
This is a signal, not just a product launch. If custody providers are building coercion-resistant features into standard business accounts, the threat model for corporate Bitcoin treasuries has materially changed.
Businesses currently holding Bitcoin through single-signer wallets or basic exchange accounts should treat this as a direct warning. The question is no longer whether your cryptography is strong enough. The question is whether your operational structure survives a bad actor who simply walks through the front door.
Watch for competitors to follow Onramp's lead quickly. Multi-institution key splits and mandatory co-signing are about to become the baseline expectation for any serious business custody product, not a premium feature.