Conference week opsec: a guide

In July 2025, two crypto investors visiting London were ambushed by masked men and held captive for 52 hours. According to court reporting, the attackers obtained roughly $30,000 in cryptocurrency; one victim was released, while the other reported further captivity. The attackers targeted the people who could authorize a transfer, rather than exploiting a vulnerability in their software. It’s a pattern that shows up whenever people hold access to something worth taking. When technical defenses are strong, attackers go after the people.

Conferences make attacks like this easier to pull off. For a few days, people with access to money or systems are away from their usual routine and in unfamiliar cities. This guide explains what changes about your security when you travel to an event, and some concrete steps you can take to protect yourself.

The security routines you rely on at home and at work may not cover conference travel. Badges announce employers, and schedules are public. Strangers become “partners” over a drink. Conferences are well planned, but attendees often lack the same level of planning for their own security, while their adversaries have most of the work done for them.

View yourself the way your attacker would

Threat actors assess each target before taking action. They decide whether the target is valuable, reachable, and susceptible to exploitation. Doing this for yourself before an attacker has the opportunity might prevent you from ever becoming a target.

Know what information you already gave away

When you give an attacker information freely, you make their job easier and put yourself at risk. That risk extends to what you leave behind while you’re away, including your possessions and the people you love.

You should do your best to know what information is publicly available about you and limit it where possible:

• Information on where you live that is exposed on social media or in publicly available documents
• Indicators of where you or your family might be found away from home, like photos at your child's school
• Fitness-app activity and location-tagged posts that map your movement
• Personal phone numbers or email addresses exposed through domain registrations, company filings, or past data breaches

Don’t make yourself a target in the moment

At a conference, it’s easy to stand out in ways you wouldn’t at home. You take part in events that require you to wear badges, move between defined areas, and actively update people along the way. This is all part of the experience, but it also exposes you to planned and opportunistic attacks.

Prevent exposing your movement and making yourself a convenient target:

• Don’t announce where you’re going in advance
• Don’t wear anything that identifies you unless necessary
  • No branded gear or badges outside of venues
• Don’t livestream or post photos that might expose your current location, especially if you plan to stay there
  • Even without clear identifiers like street signs or venue names, the simplest details could expose your location
• Know your routes, don’t repeat them, and plan your own travel

Handle encounters safely

Doing your best to avoid being targeted goes a long way, but if you do come face to face with a threat actor, you should know how to handle the situation. Whether you’re faced with a fraudulent interaction or violence, the primary goal is always to leave safely and with the least impact to yourself as possible. Whenever possible, try to avoid provoking your attacker.

Don’t fall for in-person deception

At a conference, meeting new people and making new connections is the norm, and threat actors know this. You are most susceptible to false interactions while you’re in networking mode, so as you meet new people, always watch for things that aren’t right. Take time to verify what you’re being told and who's saying it, and don’t open yourself up to exploitation on the spot, whether by giving up information or access.

When making contacts at a conference, protect yourself by sticking to planned behavior:

• Vouch through a mutual contact you trust, not references they supply
• Don’t provide information you wouldn’t provide publicly
• Never give access to your work, whether this is trying someone’s codebase on your laptop, or performing your duties alongside them
• Verify new contacts through an independent channel before sharing sensitive information or granting access. For new business relationships, use your organization’s onboarding and due diligence process.

Leave physical altercations safely

Whether you have been targeted specifically, or are a victim of opportunity, your focus should always be to de-escalate and leave safely. Your safety matters more than your money or possessions. Avoid confrontation and focus on getting through the situation safely.

Plan for physical threats so that you have what you need to respond well to the attacker:

• Prioritize your safety over protecting money or possessions
  • Don’t carry, or have access to, more than you are willing to lose
• Agree on check-in times and a distress signal with a trusted contact before you travel. Make sure they know what to do if you miss a check-in or use that signal.
• Save the local emergency number before you travel, and contact emergency services as soon as it is safe to do so.

If you find yourself in a physical altercation, stick to the best practices:

• Leave if you can do so without putting yourself in greater danger
• Provide your attacker with what they ask for, and nothing more
• Do not antagonize your attacker or in any way hold their attention

When to bring in professional support

Everything above is doable on your own, and we wrote it that way on purpose. Physical security and Protective Services are part of our work at AR because we know that the hardest security problems cross code, operations, people, and physical boundaries. The risks an individual faces can be just as consequential as a vulnerability in the code or software. If you don't want to spend conference week thinking about routes and room numbers, or your team is large enough that someone should own this, we can take it on:

• Exposure assessments. We find out what is public about you and your founders, how it ties back to your holdings, and flag what should be taken down.
• Pre-arrival work. Our team scopes out the venue and knows your routes ahead of time. We vet drivers carefully and have an exit plan for each stop before you arrive.
• Travel device setup. We help you with setup and policies to ensure that one person losing their phone or being coerced doesn’t compromise the entire company.
• Trained protective agents for your trip. You get one point of contact who knows the whole itinerary and moves the moment a check-in is missed.

For help planning safer conference travel for you or your team, get in touch through our contact page.