Duress Wallet

After a special PIN is entered, a device may open another set of keys while making the usual wallet inaccessible from that mode. Its outputs are real and spending them is a real payment; decoy describes only their intended role. The name Duress Wallet alone does not specify derivation, available menus or side effects. Assessing protection therefore requires distinguishing the device state, the keys accessible in that state and the knowledge of the person demanding access. [COLDCARD — PINs and Trick PINs] [EFF — Your Security Plan]

In BIP39, backup words and a passphrase participate in seed derivation. Every normalized passphrase produces a valid seed; a typo can therefore open another, usually empty wallet instead of producing a wrong-password error. A PIN typically unlocks a device but does not itself define standard BIP39 derivation. Trezor requires the exact original passphrase and correct backup to regain access. The ability to create another wallet neither means that a device offers a Duress PIN nor that an existing wallet's additional passphrase can simply be changed. [BIP 39 — Mnemonic code for generating deterministic keys] [Trezor — What is a passphrase?]

COLDCARD documentation distinguishes Duress Wallet, which does not erase the main seed, from Wipe → Wallet, which erases the seed and then opens the selected wallet. It lists three BIP85 variants and the older Legacy Wallet. For a 24-word seed, the BIP85 variants use indices 1001–1003; for a 12-word seed, 2001–2003. Legacy uses m/2147431408h/0h/0h. These are implementation-specific details, not a universal wallet standard. The same label on another device or older firmware may therefore represent a different path, word count or behavior. [COLDCARD — PINs and Trick PINs]

BIP85 derives application entropy from a BIP32 root key using a fully hardened path and an additional HMAC step. Knowing only the derived child is not intended to reveal its parent root; compromising the root nevertheless permits recreating its derived children. Separate addresses thus do not establish independent backups or separate exposure to compromise. For a particular Duress Wallet, determine whether it can be recovered from the main root, requires a different passphrase or has a genuinely separate seed. A shared backup does not replace knowing the correct mode, path and index. [BIP 85 — Deterministic Entropy From BIP32 Keychains]

BIP39 describes plausible deniability for another wallet because different passphrases are valid. This is a derivation property, not proof that other funds do not exist. Purchase records, known addresses, stored public keys or previous access to an application may change the other party's expectations. In its SSSP documentation, COLDCARD explicitly notes that someone knowing the main PIN can obtain an XPUB and discover the balance; subsequently showing a different wallet may therefore lack credibility. An on-chain connection alone does not automatically prove the owner's identity. [BIP 39 — Mnemonic code for generating deterministic keys] [COLDCARD — Single Signer Spending Policy]

Depending on its configuration, a Trick PIN may merely switch the open wallet, wipe the seed or permanently disable the device. These effects must not be confused. Erasing a local key copy does not remove outputs from the blockchain or other backup copies; complete recovery information can still make the funds spendable elsewhere. Without it, the owner may lose access themselves. A destructive response also provides no predictable control over an attacker's behavior. Describing the feature is therefore not a recommendation to activate it in a dangerous situation. [COLDCARD — PINs and Trick PINs] [EFF — Your Security Plan]

A recovery plan must record the relationship between the main and separate wallets, the required backup, any passphrase and implementation parameters. A device PIN cannot substitute for those details, and an ordinary word backup alone cannot restore a forgotten BIP39 passphrase. Design verification should use separate test data, known receiving addresses and checks of the correct mode before and after restarting; destructive options should not be tried on the only copy of a real wallet. Successfully opening some wallet is weaker evidence than matching the expected addresses. [Trezor — What is a passphrase?] [BIP 85 — Deterministic Entropy From BIP32 Keychains]

Assessment must distinguish theft of a powered-off device, compromise of a backup and direct coercion of a person. The adversary has different capabilities and information in each scenario. Duress Wallet can change the scope of access being disclosed, but guarantees neither concealment of other funds nor personal safety. A security plan should consider dependants, recovery availability and the consequences of mistakes, and be reviewed regularly. A device test establishes its behavior, not a predictable human response under coercion; it cannot establish a universally safe decoy amount. [EFF — Your Security Plan] [COLDCARD — Single Signer Spending Policy]