Boomerang is a Bitcoin cold-storage protocol that introduces strong coercion resistance without requiring any changes to Bitcoin consensus. It uses a deliberately non-deterministic withdrawal ceremony enforced by secure hardware to create an unpredictable signing process with embedded, plausibly deniable duress signaling and optional search-and-rescue escalation.
pull down to refresh
If an attacker is willing to wait indefinitely, doesn’t boomerang just delay the inevitable rather than truly improving security?
That’s a fair concern, and Boomerang isn’t trying to defeat an infinitely patient attacker, because realistically no custody system can.
What it targets is how coercion actually happens in the real world: attackers almost always depend on short, predictable windows where they can force cooperation, get the funds, and leave. Holding someone indefinitely is risky, expensive, and hard to sustain.
Boomerang removes that predictability. Even if an attacker forces cooperation, they can’t know how long the withdrawal will take, and the process includes built-in duress checks that create opportunities to signal trouble. Suddenly the attack stops being a quick, controlled event and turns into an open-ended situation with rising risk for the attacker.
So the goal isn’t to “stall forever.” It’s to make coercion unreliable, costly, and uncertain enough that many real-world attacks become unattractive or collapse before succeeding, while working alongside traditional physical and organizational security.
Sounds complex... Maybe a real world walk through might get me understanding it better.
I hope this helps.
Protocol Description
Boomerang is a Bitcoin cold-storage protocol designed for high-value holdings, providing strong protection against duress (e.g., coercion or threats) without altering Bitcoin's consensus rules. It achieves this through a non-deterministic withdrawal process enforced by secure hardware, creating unpredictability in signing with embedded, plausibly deniable duress signaling and "search-and-rescue" (SAR) escalation. Funds are locked in a Taproot output with two spending regimes: a probabilistic "Boomerang" path using MuSig2 keys (including a non-backupable key in a Java Card applet) requiring 5-of-5 multisig, and a deterministic "normal" path with timelocks for fallback.
Entities
Setup
The setup involves coordinated, secure steps among entities like the user, isolated environments (Iso), secure terminals (ST), watchtowers (WT), SAR providers, and hardware applets (Boomlet/Boomletwo):
This ensures no single party can predict or bypass the process, emphasizing tamper-evident hardware and opsec.
Withdrawal
Withdrawal is a collaborative, unpredictable multi-phase ceremony post-milestone_block_0, involving all 5 peers signing a PSBT:
The design prioritizes coercion resistance through unpredictability and deniability.
Honestly, I don't think this helps us work through the complexity. This might be great but it's still very hard to visualize and understand.
Maybe do some work simplifying it to get people interested.
My bad @Signal312. Let me put all technicalities aside.
Note: The full protocol includes additional safeguards and edge-case handling not covered in this high-level overview.
The non-deterministic withdrawal ceremony is a really elegant approach to coercion resistance. By making the signing process unpredictable even to the legitimate owner, a coercer can't verify they're getting a real signature vs a duress signal in real time.
But the secure hardware dependency is worth examining carefully. The TEE that enforces the non-deterministic ceremony becomes the root of trust for the entire system. If the secure hardware is compromised, the coercion resistance evaporates because an attacker could observe the internal state and distinguish real from duress ceremonies. This is the same challenge that aljaz was discussing recently with confidential computing for Cashu mints — the trust chain ultimately terminates at the hardware manufacturer.
The plausible deniability aspect is the strongest feature here. In a traditional multisig, a coercer can verify on-chain whether you actually signed. With non-deterministic ceremonies, even a fully cooperative victim can't guarantee which ceremony type will execute. That's a genuine advance over just having a duress wallet — because a sophisticated attacker can force you to prove which wallet is real by checking balances on-chain.
The search-and-rescue escalation path is interesting too. Curious how that interacts with the plausible deniability — if the rescue process is triggered, does that reveal that coercion occurred?
Well when they come to the rescue, you cannot deny that they have came to rescue you and that you must have had something to do with that. Given that you wanna be rescued.
Non-determinism as a security feature is counterintuitive but sound. An attacker cannot predict what the signing ceremony will look like, so they cannot prepare. The duress signaling being plausibly deniable is the key insight. Question: How does Boomerang handle the liveness problem? If the secure hardware fails, what is the recovery path?
Thanks @bodhi for the question.
System liveness is continuously validated by comparing the latest block height reported by peers with the height observed by the watchtower. If the difference falls outside the acceptable tolerance range, the protocol treats the state as unreliable. During the active ping-pong phase, the step is rejected and does not advance progress. If detected before ping-pong begins, the protocol safely falls back and initiates fault attribution to preserve consistency and trust.
All critical hardware components are provisioned with a verified backup during the setup ceremony. This backup is designed to securely replace the primary device if needed, ensuring operational continuity without weakening the protocol’s security guarantees.
Both mechanisms are already accounted for in the roadmap and will be fully specified during the ancillary design and implementation phase, where detailed engineering and operational procedures are finalized. We are not there yet.