Personal and physical security for founders, operators, and investors

Imagine your family being abducted from home, or being forced into a car at gunpoint, or having your finger amputated while your captors demand a ransom payment. These examples are distressing — gruesome, in some cases — but they’re not hypothetical. They’ve actually happened — and are happening — to people in crypto.

I want to share practical lessons that can help keep you — crypto founders, operators, and investors — safe in an increasingly dangerous world. I’m going to go through two areas that are central to your safety. First, daily habits. And second, crypto industry-specific violent crime. But I’ll start with some general principles and a couple of illustrative stories.

Why take the time to talk about this? Founders, operators, and engineers are focused on building their companies. Investors are busy managing their portfolios. But if you’re not thinking about security — personal, physical security — none of that matters. And it’s not just about your safety. It’s about your teams. Your families. Your work. Security has to be part of your operating system. 

I’ve spent the last 35 years in the world of security. Twenty-five of those were in the U.S. Secret Service, where I served in many roles, including protecting every living U.S. president during that time. I’ve protected foreign heads of state (even the ones I disagreed with). The rule was simple: No one dies on U.S. soil.

But the Secret Service isn’t just about protection. It’s the only agency in the U.S. government with a dual mission: protection and investigations. Some of the best cyber investigators in the world start there. I worked global, transnational investigations, surveilled people, and was surveilled myself. You learn a lot of tradecraft doing that. You also become a student of people. You learn how to read them, spot tells, and identify threats before they happen.

Foundational principles for personal security

Let’s start with a few guiding ideas:

• Avoid conflict whenever possible. If someone’s acting strangely, move away. Switch train cars. Cross the street. Don’t be prideful. Your ego won’t save you.
• Trust your instincts. That uncomfortable feeling you get? It’s not random. It’s your autonomic nervous system warning you — rising heart rate, shallow breathing, perspiration. That’s your body trying to keep you alive. Listen to it.
• Expect the unexpected. We call them Murphy moments. When things go bad, they usually go bad fast. You can’t predict every scenario, but you can rehearse mentally. “What if?” is your best defense.
• Invest in your safety. We’ll spend two hours reading Amazon reviews before buying a water bottle. Spend five minutes learning how to secure your home when you’re away.

Situational awareness: Living in the ‘yellow’

In the Secret Service, we used a color-coded system to describe how attentive people, aka targets (that’s you), are when they’re in public:

• White: Unaware, distracted — like walking with earbuds in. Vulnerable.
• Yellow: Relaxed awareness. Alert but not paranoid. This is where you should live.
• Orange: Heightened alertness — used in active threat situations.
• Black: Panic, paralysis. You don’t want to be here.

In the Secret Service, we talked a lot about something called “leaning into the yellow.” It means maintaining a relaxed state of awareness. Train yourself to stay in the yellow. You’re not paranoid, you’re just paying attention.

Maybe you notice someone talking to themselves on a train. Or someone in a heavy coat on a 90-degree day. You don’t panic, but you do move. You don’t want to be in the white — tuned out with both earbuds in, buried in your phone. And you definitely don’t want to be in the black — frozen in panic.

Stay in the yellow.

Learning the hard way: Two personal security stories 

Loose lips in public

Last year, I was in Miami for Formula One. After the event, I went to a bar, not to party, just to grab a burger and a Diet Coke. I was sitting at a table, minding my own business, when I noticed a guy a few feet away. He was with three women, clearly enjoying himself, and clearly a little drunk.

He was loud. Charming, maybe, in a collegiate sort of way. But more importantly, he was talking. A lot. Within the first minute of listening — not intentionally, just by sitting nearby — I learned his first name. A minute after that, I got his last name. The women were talking about ancestry. He mentioned his Irish roots, someone joked about spelling, and he corrected them. Full name. Easy.

He was wearing a polo with his company logo embroidered on it. A racing team. He also mentioned his job out loud: what he did, who he worked for. Now I had his employer and his title.

Then came the birthday. One of the women was celebrating hers, and he chimed in that his had just passed. She asked, “What day?” He told her. “You don’t look 50,” one of them said, teasing him. “Come on, I look great for 50,” he replied. That’s how I got his full date of birth: month, day, and year. I hadn’t even been served my burger yet.

The talk turned to where they were staying. The guy casually dropped that they were all in the same hotel. Then they started talking about the view from their rooms. One woman could see the pool, another could see the street. This guy then added, “We’re all on the 18th floor, right?” They laughed about being neighbors. Someone asked what room he was in. He said it, just like that.

At this point, I had a dossier on this person without ever speaking to him:

• Full name  
• Employer and job function  
• Date of birth  
• Hotel  
• Floor  
• Room number

All it would have taken was a confident walk to the front desk and a little social engineering: “Hey, I locked myself out of Room XXX, I left my ID upstairs, you can call my cell if you need to verify, etc.” If I were someone with bad intentions, I could have easily gotten a key. Best- case scenario, I clean out his room. Worst case, he comes back while I’m inside.

Now, multiply that by a hundred. What if I were targeting someone? What if I had followed him from a public speaking event, or an industry conference, or simply searched for him online because he’s known in the crypto space? All that info he gave away for free — that’s exactly how people get compromised.

He was just trying to impress some people at a bar. But he gave up every security answer most companies would ever ask for. Date of birth, name, place of employment, room number. The kind of stuff that makes you incredibly vulnerable.

The moral of the story? Assume someone like me is always listening. Only I’m not the one you need to worry about — because unlike me the people who are listening could be out to get you. They’re listening, and they’re looking for their next easy mark. Don’t let it be you.

Carl goes to a hockey game

I don’t want to pick just on this random, drunk stranger in Miami. Let me tell you a story about when I ignored everything I knew about personal security.

I went with friends to a Bruins playoff game in New Jersey. I was wearing a brand-new Bruins jersey over my work clothes — permitted gun holstered underneath. We were loud, having fun, probably saying a few things we shouldn’t have. The Bruins won. After the game, I was walking through the parking lot doing the Conor McGregor strut before that was even a thing.

I looked around and realized: My friends were gone. I was in a sea of Devils fans, all in red. They were staring me down. I should go back to the arena, I thought. 

I didn’t. I kept walking.

One guy — taking off his red jersey, angry — starts coming toward me. He’s looking around, scanning, just like we used to do in the Secret Service before taking action. He’s checking for cops and exits. I knew the signs. I saw every one of them. And yet I ignored them.

This person walked right up to me and punched me in the face. I hit the ground. He broke my nose. I was rolling around with him, worried he’d get my gun, worried his friends would stomp me. I remember thinking: “This is how it ends? In a parking lot in East Rutherford, New Jersey?”

Then, out of nowhere, my buddies showed up. Bodies flew. They pulled me out. I was bleeding. My nose was a mess. And they asked, “How the hell did this happen to you, of all people?”

Simple. I put myself in a bad situation and ignored every single sign. The lesson is that it can happen to anyone — even someone who should know better.

Everyday habits to stay safe

A lot of the habits that keep you safe aren’t glamorous. It’s not tactical gear or Secret Service motorcades. It’s basic, boring habits. If you get them right, you will keep way safer than most people.

Here’s what I mean.

Don’t walk alone after drinking. If you do, tell someone your plan. This one’s so simple, but people mess it up constantly. You go out. You have a couple drinks. When it’s time to leave, you ghost your group and walk home. Happens all the time. If you’re going to drink, fine — but make sure someone knows where you’re going, how you’re getting there, and when to expect you. Text a friend. Share your location. Use your phone’s location-sharing features or a special app that helps track and share these details. Do whatever it takes.

Carry non-lethal deterrents — but they only work if they’re in your hand. For example, get yourself a flashlight with a strobe function. That’s a real deterrent — but only if you’re holding it when you need it. The same goes for pepper spray. If it’s buried in your bag, it’s no good. You need to have it out and ready, and you need to know how to use it. Walking alone at night? Carry that deterrent in your hand.

Minimize distractions. If I had bad intentions, I could rob half the people I ride the train with in New York. Earbuds in, screen-gazing, bags wide open. Completely zoned out. That’s the white zone — total lack of awareness. You need to “stay in the yellow.” One earbud out. Head up. Pay attention. Just  looking like someone who’s paying attention will already make you harder to target than most people out there.

Try the Bond app for non-emergencies. There’s a big gap on the spectrum between “just feeling scared” and calling 911. That’s where Bond comes in. You’re in a ride-share and the driver or shared passenger feels off? You’re walking home and something doesn’t feel right? Open the app, and within seconds you’re on the phone with a real person trained in conflict de-escalation. You can have them accompany you en route silently. They’ll stay on the line with you. They can track your route. They can even call emergency services if needed. It’s a game-changer, and I push it to everyone we work with. There may be other services like this, but this is the one I use. 

Practice stairwell drills — know your exits. When I check into a hotel, I don’t just throw my bag down and relax. I find the emergency stairwell, and I walk it. Why? Because in a fire, or a real emergency, elevators are out, and panic sets in. You don’t want to discover that the stairwell exits somewhere you didn’t expect — or worse, that the door doesn’t open. We do it on planes all the time — hear where exits are, see the markers — why don’t we do this in other spaces where we’re spending even more time? I’ve been caught in those situations before. Don’t assume. Know your exits.

Establish fallback plans — where to meet if separated. Here’s one that saved me once. I was at a crowded Orioles game with my daughter. She was younger then, and she wanted ice cream. We walked to get it, and I turned around — and she was gone. Forty thousand people in the stadium. Panic sets in fast. But before we’d gone out, I had told her, “If we ever get separated, meet me at the statue.” Sure enough, that’s where she was — sitting with her little stuffed bear. You should have the same kind of plan anytime, anywhere you’re out with friends or family. “If something goes sideways, meet here.” It’s that simple.

Check mirrors in hotel rooms. This one’s a little more niche, but it’s a real concern. I always check mirrors when I travel — especially abroad. You take a pen or something sharp, press it to the glass. If there’s a gap between the tip and the reflection, you’re good. If there’s no gap? You might be looking at a two-way mirror. I’ve had this happen. Twice. Both in high-risk countries. If that mirror’s sketchy, ask for a new room.

Leave something you’ll need in the hotel safe. Have you ever left a passport or a wallet in a hotel safe when you’re checking out? People do this all the time. You check out in a rush and forget it. So here’s my trick to help prevent that: I put something in the safe that I know I’ll absolutely need to leave — like one of my shoes. Next morning, I’m getting dressed, I’ve only got one shoe, and boom — I remember the safe. 

These aren’t complex tactics. They’re just smart habits. And if you do them consistently, you’re going to be ten steps ahead of most people.

Crypto-specific threats

Those everyday habits are practices everyone should follow. But let’s not sugarcoat it: If you’re in crypto, you’re a target. Founders. Engineers. Early employees. If someone thinks you might have access to digital assets — or even just influence over a protocol — they may come for you. And these aren’t petty criminals. The people doing this are often organized and sophisticated. In many cases, they’re violent.

This isn’t theoretical. It’s an ever–present threat that you need to be aware of.

These aren’t random muggings — they’re calculated, brutal operations

Not long ago, a crypto founder was robbed at gunpoint in the UK (where gun crime is rare). The attackers didn’t stumble on him. They knew what they were doing. They tracked him, studied him, and then they struck.

Another case was a cofounder at a crypto wallet company. He and his wife were surveilled. The attackers followed them, waited for the right moment, then kidnapped them. They took the founder to a separate location, cut off one of his fingers, and sent a video of the mutilation back to his cofounder as proof that they were serious. That’s beyond robbery — it’s terror.

There was another case in Toronto, involving the CEO of an international crypto asset platform company. The night after the U.S. election — when Bitcoin prices jumped — he was grabbed off the street. The attackers had watched his daily movements and planned it out. In the end, he gave them a million dollars in crypto.

And these are just some of the examples on record. There are many more you’ll never hear about. 

It doesn’t just happen to famous people

It’s not always CEOs or protocol founders who get targeted. Sometimes, attackers come for someone who just ran their mouth online.

There was a kid in Portland — young, not famous, not well-protected. But he liked to brag on Twitter. Talked about how much crypto he had, what he was buying, where he was going. A crew in Florida saw the posts, flew across the country, kidnapped him, took everything, tied him to a fence post, and left.

He wasn’t even on anyone’s radar until then. He made himself a target just by being loud.

Why crypto is uniquely vulnerable

So why is this happening?

First, perception. Everyone thinks if you work in crypto, you’re rich. Whether it’s true doesn’t matter — criminals believe it. That’s enough.

Second, when you’re part of an early stage startup, you may be lacking infrastructure. Most early startups don’t yet have security teams, so you’re probably walking around without protection. You may be moving millions of dollars and building protocols, but still living like you’re in college. That’s a problem.

Third, the criminals don’t really understand crypto. They don’t know that wallets can be traced, or that funds might be frozen. They just think that if they get your keys, they win.

And fourth — this is the big one — there’s no “undo” button. If the criminals get your seed phrase, a quorum of keys to your multisig, or passwords and access to your hardware wallet? That’s it. Game over. There’s no one to call. No hotline. No fraud department.

These attacks don’t happen overnight. There’s a process behind how these criminals operate:

1. They identify a target. Usually from public channels — podcasts, social media, conferences, even party guest lists.
2. They build a profile. They start scraping everything: your name, your habits, your digital footprint. Who you live with. Who you work with.
3. They use people around you. Housekeepers. Contractors. Rideshare drivers. Anyone who can get close.
4. They study your routine. This is called “pattern of life” surveillance. The time you leave the house. Which route you walk. Where you eat. When you’re alone.
5. They pick a place. Usually your home, because they know the layout. They can control the environment. And it buys them time.

This kind of operation takes effort. But that’s exactly why it’s detectable — if you’re paying attention.

What you can do

Set up a secondary wallet: Some of you probably know this dramatic irony: You spend years building bulletproof encryption, and some guy hits you with a $5 wrench and demands your seed phrase.

Here’s the hard truth: If someone grabs you, encryption won’t save you. Your air-gapped laptop won’t save you. The multisig you set up? That’s great until someone clobbers you.

That’s why I tell every founder I work with: Set up a secondary wallet. Make it real. Put funds in it. Give it a transaction history. Make it look like it’s the one. If something goes bad, that’s what you hand over. Not the real vault. Just enough to be convincing.

How much should be in it? That’s up to you. Ten percent? Five percent? Whatever feels painful enough to be believable — but not catastrophic.

Because if someone’s spent weeks planning your abduction, they’re not leaving empty-handed. But if they get something, they’re more likely to walk. They want to get out as badly as you do. You don’t want to be in a standoff. You want to give them what they came for and quickly end it.

And if they know — or even suspect — you’ve got more? That’s when it gets worse.

Delete your online presence: You don’t need to be paranoid — but you do need to be private. We recommend using a service like DeleteMe to reduce your digital footprint. When buying property, use a trust. Don’t give attackers a map.

Install home security cameras and motion lights. You don’t need to spend tens of thousands of dollars. A basic setup — motion light and a Ring camera on the front and back doors — will do wonders. No one should be able to walk up to your house without tripping something. A motion light buys you time. A camera gives you awareness. If someone is casing your place and sees that setup, there’s a good chance they move on to someone else. Most people will pick between easy and hard targets. This is basic hygiene. If you’re in crypto, you should have this already.

Separate your funds. Use different platforms. Don’t link everything. Too many people keep all their holdings in one place. Worse, they use the same email, the same device, or the same recovery protocol across multiple accounts. That’s a recipe for disaster. If someone gets access to one, and they can draw a straight line to the rest, you’re done. Break up the connections. Use different services. Vary the wallets, platforms, devices — everything. The harder it is to draw a map connecting the routes, the safer you are.

Practice the “what if” game. This one’s hugely beneficial. I do it constantly. I’ll walk into a restaurant and think, “What if someone walked in with a gun right now? Where do I go? What can I use?” If I’m on a plane, I play out, “What if something breaks bad?” In the Secret Service, we trained this way all the time. Visualization is the drill. Ask yourself: “What if someone came through that door right now? What’s my first move? Where’s cover? Where’s concealment? Can I get out?” You never want to be thinking through this stuff for the first time when it’s actually happening.

Know your exits. Walk the stairwells. Pack a “go chair.” Hotels are chaotic during emergencies. Fire alarms go off, and people are out there in bathrobes, barefoot, holding laptops, panicking. Don’t be that person. In every hotel I stay at, I find the emergency stairwell right after check-in and I walk it. I do this not just to see where it is, but to see where it actually goes. Does it open on your floor? Does it go out to the street? You’d be surprised how many don’t. I also pack a “go chair.” I set out sweats and sneakers — easy to throw on fast. If the alarm goes off in the middle of the night, I’m out the door in 30 seconds, fully dressed, not fumbling around like I’ve never done this before.

Don’t rely on your phone to reconnect. Have a separation plan. Phones die. Batteries don’t charge. Coverage drops. Connectivity comes and goes, especially in disasters. You can’t rely on your phone as your only lifeline. If you’re out with someone — partner, team, friends — you need a separation plan. Say it out loud before you go out: “If things get weird, if we lose each other, meet me here.” Doesn’t have to be complicated. As I mentioned, I did it with my daughter when she was three years old at a baseball stadium, and it reunited us. If a three-year-old can do it, you can too. Make a plan, every time.

*** 

If you’re ever grabbed, it’s too late to wish you’d thought about this stuff. That’s why situational awareness matters. Your best defense is prevention. Stay in the yellow. Adopt good habits. Prepare. 

***

Carl Agnelli is head of security for a16z crypto, where he oversees physical security and safety operations for a16z crypto employees, facilities, and events globally. Prior to joining a16z, Carl served as the Director of Security at Citigroup. Before that, he spent 25 years as a special agent in the United States Secret Service. Most notably, as a special agent in Washington, DC, he conducted security operations around the world while also serving on the personal protective details of Presidents Bill Clinton and George W. Bush. Carl also served as the Special Agent in Charge of a northeast Field Division, where he oversaw security measures at large scale events for the President of the United States and visiting Foreign Heads of State.

***

The views expressed here are those of the individual AH Capital Management, L.L.C. (“a16z”) personnel quoted and are not the views of a16z or its affiliates. Certain information contained in here has been obtained from third-party sources, including from portfolio companies of funds managed by a16z. While taken from sources believed to be reliable, a16z has not independently verified such information and makes no representations about the current or enduring accuracy of the information or its appropriateness for a given situation. In addition, this content may include third-party advertisements; a16z has not reviewed such advertisements and does not endorse any advertising content contained therein.

This content is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. You should consult your own advisers as to those matters. References to any securities or digital assets are for illustrative purposes only, and do not constitute an investment recommendation or offer to provide investment advisory services. Furthermore, this content is not directed at nor intended for use by any investors or prospective investors, and may not under any circumstances be relied upon when making a decision to invest in any fund managed by a16z. (An offering to invest in an a16z fund will be made only by the private placement memorandum, subscription agreement, and other relevant documentation of any such fund and should be read in their entirety.) Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z, and there can be no assurance that the investments will be profitable or that other investments made in the future will have similar characteristics or results. A list of investments made by funds managed by Andreessen Horowitz (excluding investments for which the issuer has not provided permission for a16z to disclose publicly as well as unannounced investments in publicly traded digital assets) is available at https://a16z.com/investments/.

The content speaks only as of the date indicated. Any projections, estimates, forecasts, targets, prospects, and/or opinions expressed in these materials are subject to change without notice and may differ or be contrary to opinions expressed by others. Please see https://a16z.com/disclosures for additional important information.