AI Came for Bitcoin First | Jameson Lopp
00:00The malicious threat actors aren't going to just sit on their hands and say, okay, well, that was good.No, they're going to move on to the next industry, to the next set of valuable internet-connected infrastructurethat they can try to siphon as much value out of as possible.So, you know, the rest of the world, of course, should always have been paying attention to Bitcoin,but they should be paying attention to it for a very different set of reasons now,because they're next.If you're not racing along with everyone else,then it's pretty much guaranteed that you're going to get compromised at some point
00:41because there's a lot of other people out therethat are actively using these tools against you.Right. James and Lott, back on the show,and wow, we have a lot to talk about.When I was going through the list of things for this show,is basically a never-ending list.I think probably the best place to start is just to get a kind of 10,000 foot view of the securityapparatus around Bitcoin right now and how you're looking at things.
01:10Because since the coal card hack, we had Rob Hamilton spin up the Red Team as him and Caliand a load of others doing really great work there.Then we had the Liquid Hack more recently.And it just feels like the game of security when it comes to Bitcoin has changed entirely.Or maybe it's the game of security more broadly.What's your overarching view of everything?everything that's happened.Well, the best way I can describe the past month and a half is that my beard used to come down to here.
01:38And now it's right here.And it's because I've literally been pulling so much of my beard out over the past month and a half.So the fundamental nature of security and cybersecurity, whatnot has not changed.It is a never-ending cat and mouse game, attackers versus defenders.What has changed is the velocity, and that's basically the result of the accelerating LLM iterations.Like every few weeks, a new model is coming out that is pushing the frontier forward.And the open-weight models that are orders of magnetic.too cheaper are cashing up.
02:28And so basically the tooling that is available to both attackers and defenders in thisspace is surging forward.And the attackers, as is the case with most advancements, the attackers tend to beearlier adopters.They are more motivated to be early adopters of this tooling because the bounties,the return on investment is so high.And so the problem is that a lot of the defense.have basically gotten caught off guard.
02:58And we've seen an acceleration in vulnerability discovery in the Bitcoin space.And what I've been trying to tell people is that this is the canary in the coal mine.Once all of the easy money has been picked out of the Bitcoin space,the malicious threat actors aren't going to just sit on their hands and say,okay, well, that was good.no, they're going to move on to the next industry, to the next set of a valuable internet-connectedinfrastructure that they can try to siphon as much value out of as possible. So, you know,the rest of the world, of course, should always have been paying attention to Bitcoin,
03:42but they should be paying attention to it for a very different set of reasons now becausethey're next. And the reason it's declaring the coal mine is because if you get someone's Bitcoinkeys, then they're yours. The Bitcoin is yours. It's,There's very little recourse.It's very hard to actually do anything about that.But what would the next industry be, do you think?I know we've seen in the last few days that Revolutus got attacked and a load of KIC information has been stolen from them.But does it remain within financial systems, do you think?
04:11Or do you think that you'll see these go after the grid and power supply and things like that?Yeah, I mean, I think generally financial systems will be next.further down the line, basically any sort of system that contains personal identifiable information,things that can then be used to perform identity theft and more roundabout ways of financial theft.And then, of course, infrastructure attacks.That's going to be more of either a nation-state thing or a voluntary anarchist type of.of I want to screw with other groups type of fun hacking adventure.But yeah, I mean, anything of value.
05:01And of course, over the past few decades,more and more of the global infrastructurehas been connected to the internet.So, you know, if you're connected to the internet,you basically have a door there that billions of peoplecan start knocking on.And now they can really automate that knockingand increase the sophistication.
05:21sophistication of the discovery that they're doing by essentially leveraging these highly compressedknowledge bases into doing a lot of the technical heavy lifting for them.So when it comes to the cold card hack, I've covered that a little bit on the show.I've done at least two or three shows on that.But I've not spoken about the liquid hack more recently at all.Can we get into that?Can you give us some information about what exactly happened?I know these so-called white hack, not really white-hat hackers initially stole 4,000 Bitcoin, I think, and then gave a large portion of that back.
05:57But where are we at right now?Yeah, at the moment, I think they're still holding on to about 600 Bitcoin, about 15% of the take there.And, you know, it's unfortunate from a, call it a white hat or gray hat perspective, because how many tens of millions of dollars is that?that it's an absurd amount to claim that you have a right to simply because you were able to use one of these tools.I seriously doubt that the attacker spent more than a few hours actually finding this vulnerability.So from a amount of effort that they put into it versus the payoff, it's absurd that they think they should get tens of millions of dollars.Meanwhile, we have a Bitcoin Red team that has submitted hundreds and hundreds of vulnerability report.and they're not asking for anything.
06:51They're just doing it because they care about the securityof the overall broad ecosystem.I think that this is another thing that's also going to happen more frequentlybecause now you're going to have less sophisticated people,getting their hands on these tools,and basically getting in over their headsand not being familiar with the proper wayto do responsible disclosure.
07:20And so they're sort of stumbling into massive vulnerabilities and potentially massive jackpot payoffs,and they just don't have the maturity or the understanding of the ecosystem to be able to do this in a way that we would consider responsible.Now, I don't think we've yet gotten a full postmortem of the series of events that led to this, but it does sound like,It was actually a result of a vulnerability report that led to a fix for that vulnerability that actually created a worse vulnerability that then was exploited by this attacker, which is extremely unfortunate.And I think really goes to show that you have to be extremely careful on both sides of the equation here.You know, these are very powerful tools, but they can lead you down past that actually make you worse off if you're not really careful about what you're doing.And so, you know, that's why the stuff that we're doing at CASA, you know, we are using a variety of LLM-assisted methodologies, but we're never just taking any one model for granted.We're always using multiple models to cross-check each other's work,
08:47and we always do have a human in the loop for final code review and sanity checks.But basically, you can't trust any of these things.I think I wrote an article a few months ago that was basically entitled,Don't Trust the Clankers.And it spoke of several security incidents that we actually had internally at CASAwith what I would call overly easy.or too helpful models where an employee would ask a model to help do some task.And the model, you know, not being given really any guardrails or specific restraints
09:30around how it was supposed to accomplish that task would essentially end up hacking theemployee themselves in order to be able to, you know, get authentication or credentials oraccess whatever materials were needed to accomplish the tasks.So, yeah, you have to be really careful.It's like these things aren't necessarily malicious.You know, they're not intelligent per se, but they can do, you might call it malicious compliancein order to achieve the goal that you give to them.Yeah, they'll find the shortcut.
10:06It's interesting, though, because like, obviously before any of this died happening, I thinkit was probably, you know, everyone thought that open source code is the most safe because it hasthe most eyes on it. Like you'd imagine that would be the most vetted, the most tested.Does this kind of call that into question where you may be better relying on closed sourcecode because then at least it's not completely viewable by these AI systems that are tryingto attack whatever the infrastructure is?If you hold Bitcoin long enough, there's going to come a time when you need some dollars.It might be a tax bill, a business expense, life getting in the way, but whatever it is,
10:39it might come at a time when you don't want to sell your Bitcoin.That's where Lennon comes in.Lennon lets you borrow against your Bitcoin instead,with tiered rates that go as lower 9.25%,so you don't have to sell your stack if you don't want to.Leden have operated every market cycle since 2018and have originated over $11 billion in loans.But the important part for me is the way Lairdon handles these loans.
10:59Your collateral is held in custody and never lent out to generate interest.And Lennon's more than just loans.Tether gold is now live alongside your Bitcoin,with instant trading across 10 pairs,and later this year you'll be able to borrow againgold in the same way that you do with Bitcoin.Leden really is an awesome company.I've used them multiple times.
11:17The applications have taken me less than 15 minutesand you have the dollars in your account within hours.If you want to check out Leden, go to L-E-Dn.I-Oand use the code WBD for 0.25% off your first loan.That's leaden.com.And use the code WBD.Every Bitcoin eventually has to answer one question.If something happened to me, would my family know what to do?
11:37Could my wife or parents recover my Bitcoin?and would my children inherit the Bitcoin that I spent years stacking.That's where Anchor Watch builds Bitcoin custody models to protect you and your family againstreal life, accidents, errors, kidnappings and even your own death.Every Anchor Watch custody solution includes their inheritance protocol.Designed so when the unthinkable happens, your Bitcoin reaches the people you intended it for.Whether you're a self-custody expert or what multi-institutional support, your Bitcoin estate planshouldn't be an afterthought. Bitcoin is only generational wealth if it can actually be passed down
12:09through the generations. So make sure they can access in the future what you've built today.Anchorwatch is your custody your way. Visit anchorwatch.com to get started. That's anchorwatch.com.If you own a Bitcoin ETF, especially if it's GBTC, you need to listen up.Spot Bitcoin ETFs provide price exposure to Bitcoin, not direct ownership. You can't withdraw it,you can't self-custody it, and they charge you a management fee every year to hold it.Well, Swan recently announced Swan Real Bitcoin Exchange, and it's ready to use right now.RBX is a structured in-kind exchange that converts your spot Bitcoin ETF shares into real on-chain Bitcoin.It does that without selling on the open market and it's designed to support a tax-efficient outcome.
12:50So, for example, if you hold GBTC, you're paying 1.5% a year in management fees for Bitcoin price exposure.But by swapping GBTC for real Bitcoin with RBX, you can drop that figure as low as 0% by just holding it in self-custody.This is designed in a way that maintains your cost basis and in a manner that supports the deferral of capital gains tax.So if you own a Bitcoin ETF, especially if it's GVTC, you need to talk to Swan Private about RBX today.Head over to swan.com forward slash WBD and booking a call with one of their team.That's SWAN.com forward slash WBD.I think the problem right now is that we're in this volatile phase where the AI, they're just so much more powerful and methodical.and they don't need to eat or sleep,
13:40and you can basically have them churning away 24-7-365.I've also made some references to basically,this new technology has made becoming a slave driver moral and cool againbecause you're basically orchestrating massive swarms.Once you get to the high level of using these tools,you're orchestrating massive swarms of different modelsto coordinate with each other.So I think that at the moment,
14:11closed source may be a bit safer,but that's only really true if you're talking about a code basethat hasn't been put through the rigorous level of LLM review.But one way that I've been looking at itfrom Kasa's own code base,where we thankfully had already beenwriting these pen test harnesses to basically,you know, red team our own code.
14:44And we've really accelerated that over the past few months.And it's actually become a sort of recursive loop thing.We're using the AI to make the AI pin test harness even betterand faster and more efficient and even starting to closethe loops of vulnerability discovery to,vulnerability resolution and patching and stuff.But one of the ways that I've been looking at it is that, you,CASA has been around for nearly nine years,
15:18and we've had really good security practices,but they're not perfect.And so over nine years,there's this idea of technical debt in software engineeringwhere you're constructing these,really large complex systems.And oftentimes you have deadlines.And so you might take a few shortcuts and not do the best
15:43practices for one thing.And you'll say, oh, we'll get back to it later.And then after doing that for many, many years,you just have massive amounts of crufts and lack of best practices.Along that similar vein, I've been starting to think of thisas actually security debt, where after nine years of buildingsoftware, even though we did a really good job following a lot of the best practices.And even, you know, we do what is the industry standard for software engineering,
16:19at least for like SOC2 compliance stuff, is you get at least one annual external security audit.You go find a security auditing firm.You give them all of your code.You give them credentials to your production or your state.aging systems and you say, you know, go for it. Like you, um, basically red team our stuff and,and come back to us. Um, and, you know, that usually costs us anywhere from 50 to $100,000per engagement. Uh, usually they'll, they'll bring on like half a dozen, uh, securityresearchers and spend a month, uh, just poking around and then they'll deliver a report to
17:05us. And that report will usually have anywhere from 10 to 20 findings, different levels of severity,and then we go fix them, and then we come back and say, please retest them. And they'll say,okay, it looks like you fixed everything. But like I said, these LLMs are just relentless.And so, you know, annually we would get, you know, 10 to 20 of those security disclosures in the report.and now just the sheer volume of what I'm dealing with.I was just crunching some numbers a few hours ago.Our Pintest harness last month,we filed about 120 issues.
17:51Most of these are like low, medium severity.I don't think there's really any critical issues.Like, you know, Casa already has a really solid foundationalinfrastructure just from the fact that we don't keep any keys online.And for our customers, we never have a threshold of keys that could actually be used tosteal money.But nonetheless, it is a fairly complex software as a service infrastructure.So you've got like all of your standard internet-facing best practices and software
18:27engineering, like, O-WR.related things that you need to follow.And so, yeah, last month, we had about 120 findings.And then, like I said, I was using the AI to continue improving, improving,and then we did another run that was using the newer models,and that has resulted in several hundred more findings.And so we're just playing the catch-up game now.And the reason why at the moment, I'm not seeing the end in sight.
19:07I mean, I'm sure it'll happen eventually and hopefully it'll happen by the end of the year.But it's because everything keeps improving.The models keep improving.Our own internal harness keeps improving.We keep finding other things.Now, thankfully, these are becoming like, you know, less and less lower severity findings.But still, each of these things then has to go through our entire software development life cycle.And that becomes the primary bottleneck.
19:34So I think I had also done some other stats where I had said,basically before August, I had only contributed like 300 lines of code to our CASA code bases this year.I have not been primarily a software engineer in probably four or five years.That has changed.And in August, I contributed about 50,000 lines of code to our code base.And this is pretty much almost entirely, you know, test code, additional verification and integrity checks.It's all like security-related stuff.This is not me writing new features.
20:22We've got a whole other team of people that are doing that.And now, you know, my job is basically to get.us to the point where, like I said, we historically had one annual security audit of our entirecodebase. My goal, hopefully by the end of the year, is to get us to us doing a full codebaseaudit every single day. And that becomes part of the software development life cycle.And basically means that there's no longer a gap where we're writing a lot ofof code and then somebody else is coming along and looking at it.I mean, we do already have peer reviews.
21:06You can't get code into our production environment or into our mobile apps or whateverwithout having another human review it.But, you know, humans make mistakes.They can miss things.And having, you know, another human review your code is good.Having 10 other, you know, large language model agents review your code is even better.because they're far more likely to find other things.And so, yeah, it's just, like I said,
21:36it's a race, making everything faster.And, you know, if you're not racing along with everyone else,then it's pretty much guaranteed that you're going to get compromised at some pointbecause there's a lot of other people out there that are actively using these toolsagainst you.So, yeah, we just continue to harden everything.You know, I'm not losing sleep at night level of concern,because I feel like we are probably in the top 1%,
22:10if not top 0.1%, mainly because we already had the head startwhere we had started developing our Pintest harness back in like February or March.And then, you know, as these new models came out,we just continued clanking harder and harder.And if anything, you know, you probably saw just a few days ago a bunch of these companiescoming out and saying, we need to slow down, right?We need to pace.Yep.
22:39And I don't know what really happened behind the scenes there.I don't know if there was an incident that they're not disclosing.Or if they're just worried that they see the writing on the wall that they're not, they'regoing to hit a wall and slow down.And they want to have an explanation.for it. I actually hope it's that. They can see that they're already getting to likemarginal returns on investment for training and that the rest of these like free open weightmodels are catching up and they're going to have problems with their IPOs and stuff.
23:14That's what I'm hoping for because I'm hoping that means we'll eventually get to a plateauwhere I don't have to be writing several dozen pull requests for code hard.every day around the clock.I mean, I'm sure it's going to slow down at some point,but right now we're just in the thick of it.I mean, if you're trying to weigh up the probabilitiesof why they want to slow down the frontier development,I think that would probably be the most likely,
23:46is that they see that the marginal returns are,they're getting smaller,and they know they're going to IPO and they need an explanation.But if it is something else, it is quite scary.Like, I still don't think slowing downand giving control over to, I saw the Anthropic CEO saying he would give over control tomultiple government agencies.Like that seems like a terrible outcome to me.
24:06That's just giving power to more power to government.But, I mean, it is still kind of scary.It's like it's the Wild West.And the thing that I don't know, like obviously very specifically to sort of Bitcoin softwareand security is like when is code just secure?And so even like a two times gain in the abilities of AI still doesn't.break anything because it's just secure code. Or does that not exist?No, that's not really a thing.
24:34And it's because there's always more to it than just the code, right?So these software systems that we are building now are so incredibly complicated thatit's not just the code that you have written.the best way that I like to describe it is,you know, we all stand upon the shoulders of giantsin many different ways.Humanity in general, civilization has gotten to where we areby standing upon the shoulders of those that came before us.
25:09Now, within the context of software,that means, you know, in the very early days,like 70-something years ago,software engineers were writing in assembly,language, which is only one step abstracted away from the pure machine, binary, zeros, and one'slanguage.And then, you know, over the decades, we started building more complex abstract languageson top of that, like C and C++.
25:44And then we started having web languages, your JavaScript.And now we've got other projects.like rust and stuff out there.So these languages are all building on top of each other,but they're becoming more complex.And also, along with that, is that for a long time now,for a couple of decades, especially once we got into the weband JavaScript and Node.js, is that these massive libraries
26:20for every language started to be,put together and published.And so now it's not just about the code that you've written,but also all the dependencies.And so that's how you get around writing a lot of codeis you reuse other people's code that they have published.And so, you know, I'm busy with many different aspects of securitythat have all been accelerated by AI lately.
26:50And another one of them is dependency.management. And so if you've been paying attention, you know, a number of the really bad compromisesthat have happened over the past few years were actually malicious actors that managed to gaincontrol of highly popular tiny little code snippet libraries that were used in thousands, if nothundreds of thousands of other software projects. And then, you know, you justinject some malicious code into there that like installs a root kit on somebody's machine andlooks for you know any bitcoin seed phrases or whatever um and and so point that i'm getting at isyou know all of those um those libraries are also being subjected to the same level of scrutiny
27:43for vulnerabilities and so i'm also getting just through the roof uh increased level of um alertsfrom our various dependency management softwarethat's basically saying,hey, you need to update this dependencybecause these vulnerabilities were found in it.And sometimes that can become a nightmare in and of itselfbecause you can get into these weird dependency conflictsthat turned into like spaghetti-related dependency,
28:17using other dependency, using other dependencyand sometimes like circular referencesthat are really hard to untangle.And so, yeah, so it's software all the way down, and none of this stuff is ever static.You're never going to, like, ossify any given software project unless it is, like, completely self-contained and has no external dependencies, which, interestingly enough is kind of one of Bitcoin Corps' long-term goals.And that's one of the things they've been doing over the years is getting rid of many.external dependencies and including stuff like OpenSSSL a number of years ago, which turned out to be a really good idea because OpenSSL had a number of critical vulnerabilities in it.But it's really hard to do because you end up having to rewrite a lot of that code yourself and then do all of your own security testing and quality assurance.
29:14Just quickly, on the languages, like all the different development languages, I've never written a line of code in my life before AI.But now with voice to text, I've got it to write some code.It's like built my website, all that kind of thing.But I have no idea in terms of like, if it gives me the output,I have no idea if it's good code, if it's bad code, whatever.Does it need to use the languages that we have built?Or are they still the most efficient ways that it can build software?Or because now like it's English language in code out.
29:44Like can it just have its own new code that's much more efficient?Yeah.I actually, I think that there.has been at least one project.I remember reading a little news blurb about it,that someone had basically tasked AI to write its own languagejust for itself that doesn't need to be human legible.And if you think about it, like I said,
30:13all of these languages that we've been building,they're just abstraction layers awayfrom what ultimately gets compiled down into machine code.Now, the main reason why you would not want to do that at least right now is, as I said before, don't trust the clinkers.At least if you're doing serious software engineering, there needs to be a human in the loop at some point that is reviewing the code that is being written and is making sure that it's not at least obviously overtly malicious.that can be a problem in and of itself because it is there is a whole field of study and in fact there are there are like prize-based projects around writing what is called underhanded malicious code where you can look directly at it and you can be a computer science background and and potentially not see that a given snippet of code is actually doing something.highly malicious. And that actually kind of brings us around to like the cold card issue itself,which is that, you know, it was, it was such a like complex and nuanced piece of code that was
31:39malfunctioning that a number of human security researchers had directly looked at that code over theyears. And some of them even felt like there might be an issue there, but none of them,them could actually see that the true random number generator library was getting swapped outwith a pseudo-random number generator library.And code is difficult.And like I said, if anything now having these agents be able to look at it and basically be muchmore methodical than a human would be, it cuts both ways.both for attack and defense.
32:23You wouldn't reuse a Bitcoin address,so why does your phone broadcast the same identifier for life?Every SIM has a static ID,and carriers, ad networks, and bad actorsall use it to track you.The big carriers have been caught selling that dataover and over again.Cape is America's Privacy First mobile carrier.
32:40Their identifier rotation featurechanges your ID every 24 hours,so you look like a different subscriber every single day.And SIM swaps are off the table.Your number can't move without a 24.forward phrase that only you hold. There's also no name at sign up, no social security number,and there's no profile to build on you. If you're a Bitcoin or in America, I honestly don't know whyyou'd use any other network. You can head over to cape.co, forward slash WBD, and use the code WBD for
33:0633% off your first six months. That's CAPE.com. Forward slash WBD. If you're already self-custodyBitcoin, you know the deal with hardware wallets, complex setups, clumsy interfaces, and a seed phrase thatcan be lost, stolen or forgotten. BitKee fixes that. BitKee's self-custody built for real life.It gives you an intuitive, easy-to-use wallet with no seed phrase to sweat over, and it has astrong recovery system and built-in inheritance for long-term peace of mind. And BitKee's just had amassive upgrade. The new device now has a screen, so before you approve something, you cancheck it on the BitKee itself. The transaction, the address, or any account changes. It's a bigdifference. You're not just trusting what's on your phone, you're seeing it for yourself on the device.
33:47It's simple, secure self-custody without the stress.Go to Bitkey.combe, today and use the code WBD to get 10% off the new Bitkey.That's Bitkey.combe, and use the code WBD.When it comes to, like, obviously, Bitcoin has always said don't trust verify.And with the cold card vulnerability, I can't verify.I mean, I could send an AI agent to go and look at it and tell me what it saw,but I can't read that code myself.And so the trust for me wasn't even necessarily just in coffee.
34:17It was in, I guess, every open source developer that's looking at an auditing code across the Bitcoin ecosystem.But do you think someone outside of just the actual cold card team, I guess what I'm trying to say is, was the, like, did we let people down?Should someone have seen that earlier?Yeah.I mean, I think there's plenty of blame to go around.obviously from like the original cold card developers that wrote the code and then whoever reviewed it originally.You know, I think, you know, large part of the blame goes there.For sure.
34:58Other questions, though.Nine percent of the blame goes there.Yeah, like, I mean, I have plenty of other questions that I don't know the answers to.Like, I don't know if Cold Card hired external security reviews.viewers to look at that code.You know, like doing the annual audits that we do at CASA.I don't know if Cold Card was doing that.In general, though, part of the problem, it does come down to, you know, how many eyes are on it.
35:30And I think that part of the discrepancy and part of the reason why so many people were shockedwhen this happened is that I felt like there was a big discrepancy between.cold cards posture within the industry versus their actual size and resources in reality.You know, if you talk to Bitcoiners, and this is going to be massive generalization,but, you know, if you talk to like hardcore Bitcoiners, you know, a lot of them will poo-pooon Ledger because they support a lot of non-Bitcoin things and they've had, you know,personal information leaks and stuff over the years.And they would say, you know, Cold Card is the best because it's like the hardcore cyphurpunk ethos
36:20project.And that is all true.But if you look at, if you compare the companies, and I don't know the numbers off the top ofmy head, but, you know, let's say rough order of magnitude, Cold Card as a company was probablymaking millions of dollars a year in revenue. And Ledger, I think, is making hundreds of millions ofdollars a year in revenue. And Cold Card had maybe two or three engineers, and I think Ledger has likea hundred engineers. And so, you know, just size and scope of amount of resources that are put into,you know, looking at the code and ensuring it, it's when you look at it that way, it's a lot less
37:06surprising that something like this could fly under the radar.Yeah, and even to add to that,Ledger have their dedicated team in a dungeon that are constantly trying to breakBitcoin hardware wallets.And I feel like everyone just drank the MVK Kool-Aid a little bit.And he was quite arrogant, and he would, you know,we did a show a few years ago after one of the,after Ledger added the feature that allowed you to basically do a Shamir secret of your Bitcoin
37:33keys.and MVP just lambasted the ledger CEO Pascal for an hour and a half, pure arrogance, and then the whole time, I think even when we recorded that show, that bug was still in the cold card at that point.Like, it was, I do think everyone just fell for his stick and it worked for a while.And it's quite embarrassing as Bitcoin is, I think.Yeah, though also, I know that Ledger Donjon looked at Cold Card several times over the years.And I suspect they also looked at it at some point in that four or five year period where that vulnerability was there and they didn't see that vulnerability either.So, like, if anything, that's also another bit of credit towards how obscure and nuanced of a vulnerability it was.So, like, after this was discovered, obviously terrible for anyone that lost money.
38:30I think everyone has at least rethought the way they do this, Bitcoin's security set up.Maybe people have had to look at it and decided that what they do is absolutely fine.I'm sure there's a lot of people in the boat of Bitcoin self-custody is too scary.I'd rather hold it on an exchange or with an ETF.I think it would be a good exercise to go through and talk about what you think the bestpractice is for people's self-custody, maybe on a few different scales.Like maybe we start with the person that has somewhere between $1,000 and $10,000 in Bitcoin.Like what do you think their Bitcoin security setup should look like?
39:03Yeah, I mean, I think of you have.have at least a few thousand dollars worth of Bitcoin, then the very least that you can do is takeyour keys off the internet. You know, invest $100 or $200 into one of these air gaps devicesthat protects you from hackers and protects you from like 99% of the threat vectors in thespace. Now, that means, yes, you are going to end up trusting that that company,whether it's treasurer ledger bitbox cold card and by the way i'm not going to tell people not to usecold card because somewhat ironically now cold card is like the most secure that it has ever beenuh because it has received so much attention like i still have and use cold cards uh many
39:57uh casa clients have and use cold cards and and we had no loss of fundsAs a result of the incident, as far as I'm aware, there was no evidence that any multi-sig user of cold cards lost funds during this incident, even if you had a signing threshold of cold cards.And I think that was simply because the amount of permutations that the attackers would have to try just exponentially blew up and gave people enough time that they were able to move their funds before.the attacker started grinding through all the multi-sig permutations.But, yeah, I mean, at least get yourself on a dedicated hardware devicebecause that protects you from any number of things of like malicious software.Like, it's almost impossible to fully lock down like a laptop or a desktop.These like full-fledged operating systems and especially browsers these days,
41:02just have massive attack surface.And so by taking your keys and putting them on a dedicated hardware device that's extremely simple, that means, you know, the code that that's running on and even the hardware that it's running are simple enough that it's actually possible for security teams to audit them and have a better level of assurance that it's acting as intended.Though, as we saw, none of this is a guarantee.It is still a single point of failure.And so if you're getting above that level of value,if you're getting into life-changing sums of money,that's when you have to start thinking even more paranoidof what is every possible thing that could go wrong.
41:57And how do I ensure that if and when something goes wrong,it does not result in catastrophic loss of funds.And that's basically what we've been doing for nine years at CASA is,I guess another way of thinking of it is, like you said,don't trust, verify.It's a great mantra, but very few people have the resources to verify.So at CASA, you could say, we just go by don't trust.We don't assume that anyone can verify anything,
42:30but rather we say, you know, don't trust any given hardware device,don't trust any given piece of software, don't even trust CASA.Like, you should assume that CASA could blow up or could become malicious.You know, you should think about what would happen in a situation like that.And, you know, how does my security model protect me in that situation?I'm kind of surprised that you said you still use COD card.When you, like, if someone was setting up a cold card today,Do you think you can trust the random number generator now,
43:03or do you think everyone needs to be creating their own entropy when using a coal card?The reason I ask is when you were saying before about the liquid hack,you were like, this was a disclosure, then they rushed in a fix,and that fix ended up being worse than the original issue.And you could probably, I have no idea,but you could maybe make the same argument about a cold cardin terms of being like a rushed update after the fact.Yeah, I mean, they've made several updates.
43:29Now, I haven't set up a fresh cold card on the latest firmware yet, but from what I've heard, or at least from like reading the release notes and stuff, is that they have actually changed it.So you have to add your own entropy now during the cold card setup.I haven't like looked at the code myself to see like what the verification checks are on the entropy that is input to make sure.someone doesn't just like hit one a million times.But yeah, I mean, like I said, I think that they have received more scrutiny against theircode base over the past couple months than they probably have over their entire lifetimeof their company.So it's about as trustworthy as you could get, I think, at this point.
44:22But still, there are no guarantees.There is no insurance.If something goes wrong, then it could be catastrophic.So that's why, rather, if you're putting life-changing sums of money into Bitcoin, I thinkinstead of trusting anyone company, any one project, any one piece of hardware or software,you're way better off distributing your trust across many different ones and having an architecturesure that assumes that any given one of them will have vulnerabilities and can fail,and that if that happens, you're okay. You're robust enough that that's not a problem.
45:07And that's really where CASA's security model is shining this past month, because like I said,we had plenty of clients that were using cold cards. And rather than this resulting in acatastrophic loss of their funds, they just had a minor annoyance where they needed to either,you know, update their firmware and regenerate the key or, you know, go by a differenthardware device and plug it in and set it up and then use our key rotation functionality withinthe app to basically heal their slightly partially compromised setup.I'm interested to know what you think about the idea of creating your own entropy, becauseobviously for people like you who have been in Bitcoin security for, I don't know, a decade more,
45:55however long, forever. It makes sense. And like, you know how to do it. You know the tradeoffs.You know what you're doing. But for people who are new to Bitcoin, do you still see it as likea footgun where they can potentially end up giving themselves way worse entropy than trustinga random number generator? Because from the people I've spoke to, random number generatorsshould be really good. It's just in cold card, it just wasn't being used. And I know there'slike I've got the bull Bitcoin entropy cards and there's like these things from the seed signerguys that make it easy.Yeah, those are great.
46:26Yeah.But like, do you think we should be like that doesn't scale to millions and millions and millions ofpeople?Like, do you think we should be leaning further into this?Or do you think we need to kind of put the trust back in certain signing devices that they canactually produce you good at entropy?Entropy is such a tough thing.the so the funny thing about entropy is that it ultimately comes down to physicality and that when you're when you're trying to generate entropy on a digital device, you're actually still sourcing that entropy from the physical real world.
47:05And, and, you know, different pieces of hardware do it in different ways, but, you know, they could, for example, you know, sample, you know, sample.current timestamp. They could be sampling things like ambient temperature or like temperaturethat the chip is running at. Some of them use the camera. Yeah, yeah. And so that's why it's hard,it's hard for me to ever say that, you know, you should just prefer device entropy because ultimatelyany device entropy is using physical real world entropy. It's just that when you are rolling dice or you're,you're pulling playing cards or you're pulling those seed word sticks,you are verifying the physical entropy with your own eyes while you're doing that.When you're trusting a digital device to be doing that in the background,
48:00it's completely opaque to you.So I think from the verification aspect,it's far better to do it yourself.And I don't think it's that difficult to get your hands on either some playing cards or some dice.it really is just more of a question of,can someone be bothered to do itbecause it takes 10 or 20 minutes to set it up?But I think that is the question,
48:24because if we're looking at devicesthat are going to scale to everyone,most people aren't going to be,won't understand the importance of itand therefore won't spend the time on it.And we'll end up,like I've got friends who did the dice rolls,quote unquote, on the cold card,
48:38but really we're just hitting random numbers.And like that's going to be,Like, I don't know.I assume that's far worse than you just trusting the random number a generator on a device.Well, the human brain is very, very bad at entropy.So, yeah, if you're doing something where you're just mashing buttons and whatever, then yes, that is arguably worse.And this is the problem is that it's more convenient.And so I think that's a good rule of thumb in general is that whenever you're doing something,
49:13in this space that is the more convenient option,it's almost guaranteed to be the less secure option.So you should be aware that you're literally sacrificing timefor security.Convenience and security tend to be in opposing force.Yeah, and don't get me wrong.It's not like I think these options should ever be taken away.Like I think they should always be there.
49:38I just struggle to see how they scale to sort of mass market.Okay, so if that's when, let's say when you get into life-changing money and you want to store your Bitcoin,obviously at Cassidy, your two main products are sort of the two or three multi-sig and the three-of-fivemulti-sig. What is the, like, what's the threshold when you need to move from a two-of-three to a three-of-five?Well, I mean, this is also tough to have a real rule of thumb around because, you know,you would say, well, it's when you have a lot of money, but a lot of money is.is very different to different people.Another way of looking at it is, like, within our system,
50:20the three of five level is accompanied by higher level support tier,where, like, you actually have, you know,a personal relationship with your client advisor,and, you know, you get on video and phone calls with themand talk through any and everything that is on your mind.And so that's also an order of magnitude increase in cost,where our two of three tier is really designed to be more self-service.It's the Netflix subscription of self-custody,
50:55$20 a month type of tier, whereas going up to our premiumand private client levels,that's getting into thousands of dollars a year.So I think very few people are going to want to spendmore than a fraction of a percent of their holdings per year on, you know,whatever their security architecture is.So you can kind of do the math from that.Like if you're at a premium tier and you're paying $2,000 a year,
51:27you probably want to have at least a few Bitcoin that you're holding onto there so that itsort starts to make financial sense.If you're viewing this as kind of an insurance product, like security.and insurance, they're kind of two sides of the same coin. You know, security is like up front insurance.And traditional insurance is like after the fact something went wrong. Your security failed.How do I try to recover from that? But, you know, in Bitcoin, because this is a highly liquidbearer asset, compared to a lot of other things in life, you want to have the super high levelof security up front so that you don't have to deal with a loss in the first place. Whereas,
52:12you know, if you had that type of model for, like, for your car, then you would only want to bedriving a tank around. But that doesn't really make a whole lot of sense, you know, for manyother reasons as well. But you definitely want a Bitcoin tank. As someone who is, like, has somepublic profile in Bitcoin, how worried should I be in terms of avoiding wrench attacks?Yeah, I mean, I think that anyone who is publicly known to be a bitcoiner, especially if you've been in it for more than a few years, you should care a lot about privacy.Like even if you have the ultimate distributed self-custody setup where you're basically wrench attack proof, you don't want to find out the hard way what would happen if you are in a duress situation.because, for example, even if you have what I would call a wrench attack proof setup whereyou don't have direct access to your funds at your home, like that's the biggest problem
53:22for pretty much everybody.If you have the ability to access your funds without leaving your house, you are vulnerableto being put under duress and made to move them.But even if that's not the case, and this is something that really no security architecture can do anything about, you're still vulnerable to like your friends, your family, your loved ones being taken hostage and you are still under duress, but you are free to move and authenticate and go around and get to all of your keys.So, you know, I don't think that anyone should really be advertising or leaking information about, you know, where you are, where you live to make it easier for someone to try to put you under duress in anyway.But the problem, especially with the way you live, is we've seen a ton of leaks from hardware wallet companies where full addresses, full names have been leaked.And that is out of the bag for a lot of people.Like I was in the original ledger leak in, I think it was 2018 or whatever.
54:30I mean, I've moved house.All my information has changed in sense, so I don't mind saying it.But like I was in that leak.And I've heard, I mean, the number of phone calls I got was insane.Luckily, I've moved house, I think, before the leak even happened.So I never had anything physically happen.But like that isn't just the reality that people live with now is that people might know their address.They might know their phone number, their email, like everything.
54:53How are you meant to deal with that?Well, I can certainly opine upon it.You know, I'm in a rare situation because I was physically attacked before really any of those leaks happened.You know, I was swatted in 2017, and that's what really made me wake up to the severity of this problem of having your home address available to malicious people.So, you know, the short version is that I never put my real home address and my real name together in any database and any service.You know, I have mailboxes and even decoy, like, condos that I use for different purposes, where, depending upon the nature of what merchant,or service or government agency or whatever that I'm interacting with and what their requirements are,then I give different levels of false information, really.
56:06That's like one of the hardest things for the first few years that I was doing thiswas basically becoming comfortable with lying and understanding that it's not immoral to lie to people.if you're not trying to, like, deceive or defraud them,I am lying to people on a daily basis to protect myself.And it's not just paranoia.Like, I've actually been attacked before,and I am not going to allow myself to be attacked again.But unfortunately, it requires a massive, massive change in lifestyle.
56:44And I think that's beyond what most people are going to be willing to do.I mean, for sure, even though, like, I,I don't think there's anything wrong with lying in that case.I'll put a link in the show notes for anyone who wants to listen to the show we did a few years agowhere you told the whole story about getting swatted.But essentially the SWAT team turned up, guns drawn at your house while you were just,were you cleaning guns at the time as well, which made it even more sketchy.Insane story.
57:11But it's, it just, it feels like this is only going to get harder in terms of everything.to do with Bitcoin security over the next few years?Yeah.And, you know, with regard to like some of the personal identifiable information leaks and stuff,some people are like, well, this is why you should never order a hardware wallet.Or other people, like the seed signer proponents will be like, this is why you should buildyour own hardware device with off-the-shelf parts, because nobody's going to be like tryingto get leaks of like raspberry pies or whatever.
57:54But it's a nearly intractable problem because almost every merchant that you deal with asks for your personally identifiable information.And almost every exchange out there where people are acquiring their Bitcoin asks for egregious amounts of personally identifiable information.And this is a really fun one for me to deal with.like I said, because I try to use, you know, obscuring address information wherever possible,but the KYC stuff is very difficult.And the only way that I'm really able to get around that in some cases is to actually have a driver's license that is connected to a decoy residence where, like, it's a real place.I just don't actually hang out there.And but I mean, there's a lot of other tricks too of like when whenever a service tries to KY see me,
58:59I always try to use my passport first because there's no address information on there.Usually that works.Sometimes it doesn't.It's like when it comes down to places that will only accept a driver's license that has an address on it,it becomes really problematic.That's interesting.I always think of the passport as the more precious of the identifier.So I would always, but that makes total sense.
59:21Do you think that with like these rise of AI enabled attacks that KYC is going to come under a lot of scrutinyand we might actually get a chance of pushing back against it?Because I'm not sure the data is clear that it actually protects anyone, but it is creatingthese huge honey pots.And we've just seen that Revolut's been got, which is a massive, massive fintech, like tons and tons of information.And these are just honest people who are trying to use a service who now have their informationall over the internet.I don't know.
59:50I mean, I don't think anything is going to change unless someone in power gets hurt.That's the short version.Like, until there's, like, a politician or a really rich and powerful person who gets burnedreally badly from this, that they're willing to then go spend a lot of resources to tryto get, you know, political change or regulatory change.No, like, the amount of leaks has been increasing at an insane pace, and it just seems to be business as usual.It's like, oh, there was another massive leak this week.We'll give everybody, you know, free credit reporting and identity theft protection for a few years and then move on.
01:00:39And, you know, it's very profitable.like the companies that are collecting this informationtend to be highly profitable.I think, you know, the regulators don't want to give upany of their power and any of the sort of surveillance apparatus,even though there's many different levels of independent reportsthat show that, you know, the money laundering has,the people that do money laundering professionally laugh
01:01:10at all of these KYC,safeguards because they just go out and buy real identities on the dark net for pennies on the dollarand just burn through stolen identities that can get through all of these regulatory compliant systems.And if they do get caught, then they just throw it away and pick up another one.So, yeah, I mean, the whole thing is just a clown show, but it seems that the peoplewho were behind it are just so entrenched,the incentives aren't there to fix it.Well, one day they'll all get hacked to
01:01:51and we might get a change.All right, last thing I want to talk to you aboutbecause obviously we, Trez's had a ton of emailscams go out recently.One of their service providers was hacked, I believe.There'll be a load of people getting a ton of phone callsnow with people trying to convince themto give them their seed words or go to dodge your website.
01:02:10I saw on your Twitter that you had one of these phonecalls recently with a scammer. Tell everyone what happened there, because I listened to the sort of three-minuteclip, whatever you put on Twitter, but it sounds very interesting. Yeah, we'll have several lengthy clipscoming out soon, I think, close to like 45 minutes worth of conversation. So basically, you know,like you and like pretty much everyone else in this space, who has been the subject ofdata leaks, I get these calls. And it's never been a problem for me because I just, I never answerthe phone if it's a phone number that's not someone I know personally and talk to regularly.But, you know, we started seeing more of our clients getting these calls. And it just started becoming
01:03:04more of a security concern for us because we started having some clients that, you know, their,their Google accounts were getting compromised.And that was becoming really problematic for us because then, like, sometimes we'd be tryingto actually converse with the client and the bad guy would be inside their email and justlike deleting the emails from us and then sometimes responding to us as if it was the clientand saying, oh, you know, everything's fine, so on and so forth.So the short version is just don't answer the phone from any number that you don't know,but also just never trust any incoming message, whether that's email, phone, direct message on any platform.
01:03:56Unless it's a strongly authenticated, like end-to-end encrypted system like Signal or WhatsApp,where it'll actually tell you, you know, if your cryptographic exchange has changed,you cannot rely upon the person that the message is from actually being that person.Like all of these things can be spoofed, emails can be spoofed, phone numbers can be spoofed.And what I actually ended up doing was I actually took Coinbase and Google's like official business numbersand added them as contacts in my phone so that I knew that whenever I got a call from them,that it was one of these social engineers.And I started picking up the phone.
01:04:43And they have a very sophisticated system where they won't have humans call you.They actually have an auto dialer, and it'll call you, and it'll say, hey, you know,something happened.Like someone logged in here.If it wasn't you, you know, press one.and we'll get a human on the phone with you.And so I started pressing one,and eventually the humans actually started calling me.
01:05:11And I would play around with them for like, you know,20 minutes or so to get a better understanding of their scriptand really like what they were trying to do,how they're trying to get access.And then eventually I'd be like, hey, like,you know I'm a cybersecurity expert, right?It's like, you're not going to trick me.And in that case, they'd either hang up immediately or they'd be like, oh, shucks.
01:05:37I was really hoping to get you this time.And it's interesting because, like, they knew that I am the chief security officer of a security company.And they'd still try to pull one over on me because you never know.Like, even the smartest, like most intelligent people might have a bad day.They might be preoccupied with thinking about other things.And really what they're trying to do is social engineers are hacking your brain.And they're doing this via psychological methods.They're using fear, uncertainty, doubt.
01:06:18They're using a sense of urgency to be like, there's a security issue and you need to fix it right now.And I'm a trustworthy employee of this billion-dollar company.company and I will tell you how to fix your security issue. But meanwhile, what they're actually doingis they're tricking you into compromising your security so that they can get into your email.And from there, you know, most people have like one or two email addresses. And that's like theprimary nexus of all of your other accounts. And once they get into that, they can start gettinginto all of your other financial accounts. And they'll be looking for what exchanges you're using.They'll be looking for seed phrase backups and photos of like your seed phrase.
01:07:03They're highly sophisticated organizations now where they have different people that specializein doing different things.And so I was talking to the guy who specializes in tricking people into getting into theiremail accounts.And he gets paid for every email account he gets into, regardless of whether or not there'sanything valuable in there.And then he'll also get a cut of what.whatever the take is if something else is found.
01:07:28But then they have other people that specialize and then doing, you know, the crypto-relatedstuff. And then they also have other people that specialize in doing the wrench attacks.And those people, then, you know, coordinate other people on the ground, you know,sort of the henchmen, the two-bit thugs to actually go and do the attacks.And, you know, these, like I said, they're complicated and sophisticated international crimerings at this point. And they, they do this all day long. And they, the thing about security and about allthis stuff is that, um, if you're the defender, you have to be successful 100% of the time. But ifyou're the attacker, you only have to succeed one time. And that's just another one of the,
01:08:12asymmetries in the space. It was great. Like, listening to it, the thing that shocked me is howmuch money they're making as well. I, I can't remember, was it, did he say he's making about $800 per email hegets into. You were saying you can make up to about five grand a day or something. Like, it's realgood money. How did you actually get him talking? Well, you know, we just eased into it of me playingdumb for a while. And then, you know, the trick is to not be an asshole, which is really hardbecause these guys, you know, they're doing terrible stuff. But once you get them talking, like,they're just normal human beings like everyone else.They tend to be young guys, you know,
01:08:55um, generally in their like 20s.And, um, and, and the reason that they're doing this is because it's just insanely profitable.And they tend to have a mercenary mindset of, um, you know, I am almost like a Robinhood mindset of like,I'm going after guys who are so rich that it's not going to be the end of their life.if I take millions of dollars from them because they're so well off.And that's like, he literally said something kind of like that to me of like,you've been in Bitcoin so long, you know, you would be fine.And it's like, oh, I guess we can just completely gloss over the fact that, you know,
01:09:36you're stealing from people who have, you know, spent a lot of time and effort building uptheir wealth and you're just going to take it from them in a matter of an hour or so.and not have any sort of regrets about that.But that's how it goes when you get into the criminal worldis that people will justify that whatever they're doing isn't so bad.And I don't know if you can talk about this,but before we started recording,you said there might be something coming from someone from North Korea.
01:10:08Yeah.Well, you know, we've already said a few times,uh,security in the space,It's coming from a million different directions.And we've only talked about a few of the different things that I'm dealing with.But another is that especially if you are running a company in this industry,there are nation-state-backed threat actors that want to get inside of your infrastructure.
01:10:42And they're going to do that in any number of ways.I think a lot of the people out there will be familiar,Lazarus Group, which is the Democratic People's Republic of Korea.They do a lot of defy hacking.They love hacking smart contracts and other types of projects,and I think they've taken billions and billions of dollars through that.But what they also love to do is to pose as technical securityand software engineer to get jobs at companies.
01:11:21Because if you can get employed by one of the companies in this industry,you're going to start to get access to privileged systems.Maybe not production systems, but at least development environments.We posted a job posting for security engineer position,which of course is a highly privileged positionthat would eventually get production level access,you know, if you build up the level of reputation and trust with us.And we just got an insane number of North Korean actors
01:12:00that were applying for this position.And a lot of them, it's very easy to weed outjust from like looking at the resume, LinkedIn profile,so on and so forth.But, you know, some of them get a little further along in the funnel.And what was particularly surprising this time around, I've never had them get to me before.And I'm usually the second or third person after, you know, initial call screening.And what we realized was happening is that they were using an actual American for the first initial video.
01:12:41video interview, and then they would swap out with the North Korean on the second interview.And they're good at answering the technical questions related to the job description,the job that they're trying to actually interview for.And they probably even have some of the skills where they would be able to do that job.But as it is with everything in this space,If you know the right techniques, if you know how to catch them off guard,if you know how to ask them the questions that they're not prepared for,that a real American would be able to answer,
01:13:23then it's actually pretty easy to trip them up.And the difference between those guys and the social engineering guysis that you can't really get them to open up about what they're doing,probably because they're being monitored by their military or whatever state organization is actually sponsoring them.So they tend to hang up pretty quickly after you ask them a few questions that they're not prepared to respond to.What kind of is that, what do you think of your supreme leader?Like, what question are you asking?Yeah, that's an easy one, is to try to get them to, you know,
01:14:06fame King John Un, but other less obvious ones tend to be cultural-related questions.Like I said, they build up a persona profile of who they're supposed to be.They're trying to impersonate.And so, you know, they'll know some of the background of the resume that they've given to you.But a few things that I've done is dig into like more personal questions based upon theresume that would normally not be asked in an interview, but which any like normal person would beable to answer, you know, things about their their college life, you know, experience and stuff likethat. There's also any number of other American cultural questions that you can ask that they're
01:14:59just not prepared for. They just don't really know anything about American culture.Super interesting. You've got to be careful that. There's North Korean Sleeper.sales. Damn, there's so much to be conscious of right now. But James, and this has been awesome.I think there's hopefully been some good actionable advice for people who are rethinking a securitysetup. Tell everyone when they go to follow you and find out more about CASA.Well, you can find me on X. My handle is just L-O-P-P. Check out CASA to c-A-S-A-O.Perfect. Appreciate the time, man. Thank you for this.you bet
There aren't comments yet for this episode. Click any sentence in the transcript to leave one.