Yo Bitcoin has seen one of its most volatile weeks in history
after we saw a record-breaking $1.4 billion heist that occurred
last week. This massive buy bit hack from
an infamous nation nation state hacker group has forced many
people to reconsider how they hold their Bitcoin.
Today we reached out to a Bitcoin OG with a / a.
What is happening? There we go.
Sorry about that guys. I have I have my Echo in the
background. Today we reached out to a
Bitcoin OG with a decorate decade of experience in
cybersecurity to breakdown everything that happened with
this hack. And also this morning it was
Opti and I had to put a fire out, which was absolutely crazy.
We had some trouble getting the live stream up and going, which
we managed to fix 10 minutes before the show went live.
And of course, what Bitcoin OG am I talking about?
We have the one, the only legendary Jamison Lop in the
house. Thank you so much for joining
us, Lop. I know we've had you on Simply
Bitcoin IRL, but we've never had you on Simply Bitcoin Live, so
welcome to the show. Always glad to talk about
Bitcoin. It's so crazy because every time
we have a big guest coming and joining us, those are the days
that something goes wrong. So we're rolling with the
punches. Anyways, let's jump straight
into today's article. Let me pull it up.
FBI accuses North Korean backed hackers of stealing $1.5 billion
in crypto from Dubai based firm It goes on to say the FBI has
accused North Korean linked hackers of conducting one of the
largest thefts of cryptocurrency publicly known using some $1.5
billion worth of etherium from a Dubai based firm.
The theft earlier this month targeting by bit one of the
world's largest crypto exchanges represents yet another another
involving a team of hackers identified by the US government
by the names of Trader, Trader and the Lazarus group.
The hackers steal cryptocurrency through the disseminate the
dissemination of cryptocurrency trading applications that were
modified to include malware that facilitates theft of
cryptocurrency. It goes on to say in an online
public service announcement late Wednesday, the FBI said it
believed the North Korean backed hackers were, quote, responsible
for the the theft. Quote, trader, trader actors are
proceeding rapidly and have converted some of that stolen
assets, the Bitcoin. I think that's the signal there,
right? They're getting rid, you know,
of, of whatever and they're they're buying Bitcoin.
Other virtual asset dispersed across thousands of addresses on
multiple black block chains. The FBI said in its
announcement, quote, it is expected these assets will be
further laundered and eventually converted to Fiat currency.
It goes on to say North Korean state media has not acknowledged
either the theft or the FBI accusation.
Pyongyang's mission to the United Nations and Geneva did
not respond to a request for comment from The Associated
Press. Now here is a post from I
believe the Buy Bit CEO Ben Zu and he said buy BIC hack
forensic reports. As promised, here are the
preliminary reports of the hack conducted by Singa Labs and Vera
Chains. Screenshot of the conclusion.
Here is the link to the full report.
And Lop, we were talking about it earlier before we went on air
about this report that came out. So Lop, what happened?
How did this happen? How can an exchange of this size
with this many customers, how are exchange, how are exchange
hacks still happening in 2025? You know, after the industry has
been around for, you know, almost 16 years now.
We all remember Mount G Ox, You know, I think bit Fenix got
hacked a couple times, Finance got hacked.
How's this stuff still happening?
Well, these are complex systems and, you know, complexity can be
the enemy of security. I think that's the short version
of how this happened. There's complexity at many
different layers and it really starts at the very lowest layer.
There's a lot of complexity on, you know, these EVM Turing
complete protocols. And that level of complexity
means that you can't have the same trustless verification that
we do on Bitcoin if you're using, you know, one of these
tiny low powered hardware key management devices.
So you know, if you've ever used treasure Ledger, cold car and it
really any of those hardware devices, then you know that when
you're making a Bitcoin transaction, it explicitly tells
you on the screen, hey, you're ascending this many SAT's and
you're sending it to this address and you can confirm it
all on what is essentially a totally self-contained computer.
And that's possible to do because Bitcoin is simple and
the partially or fully signed transaction that you are sending
to that device is usually only a few 100 bytes, maybe a few
kilobytes, and it's capable of parsing it and telling you
exactly what the resulting change to the blockchain is
going to be. But with these more complex EVM
type of protocols, you're not signing a transaction that has
all of that context inside of it.
You may be signing a more complex transaction that's
basically sending a command to the EVM, and the only way to
know what the result of executing that command is, is to
actually execute the command. So you have to have your own
full node basically, where you do a test and you then check the
state's change of what actually happened from executing the
transaction. So the short version is that you
can't sign these complex transactions on secure air gap
hardware because the hardware itself simply does not have all
of the contextual information necessary to know what the final
outcome is of that transaction. And then beyond that, there's
just multiple other layers of of problems that happened in this
one particular case, particularly that they were
using a web app, you know, a JavaScript front end to actually
drive the creation and the coordination of this multi sig
setup. And anyone who is familiar with
JavaScript and web apps know that they are just incredibly
difficult to secure because you can't have integrity checks for
the code itself. You know, if you're running a
mobile app or in many cases a desktop app, those applications
can be cryptographically signed, like the final build of the app
can be cryptographically signed by the developers of that app.
And that provides a strong attestation and integrity check
that the code that you're running is the code that was
actually written by those developers.
But with JavaScript, that's just not a thing.
And So what happened in this case is it appears that Lazarus
Group, which is these, you know, North Korean state backed
actors, somehow compromised the AWS like S3 bucket or Cloudflare
bucket. Like wherever this JavaScript
was actually hosted. They managed to insert a few
lines of malicious code that basically said, hey, if this is
the buy bit wallet that is being used to construct and sign this
transaction, then do this malicious contract call that
completely changes the ownership of the contract.
And they were able to do that because, you know, whatever code
they put up there just immediately gets sucked down
into the browser and run and there's no integrity checks to
make sure that the code was actually written by the NOSA
safe developers. So they basically they were able
to completely bypass any of the security mechanisms that's the
safe team may have had around, you know, code review, peer
review, the build and deploy process.
And it appears that this happened because a developer
developer had some sort of production access API key on
their machine and that machine got compromised.
That we don't know all of the details at this time.
So and, and it's, it's a couple things, so many things to unpack
there, right? So the first, the first question
that I have for you, Lop and you know, of course we recommend,
you know, Bitcoin only hardware wallets, but I'm sure that a lot
of our listeners still use Ledger.
It it was the Ledger device itself.
It it's not compromised, it's the fact that it can't lay out
all the data effectively on on the constraints of the hardware
itself and on the screen size. So you can't really actually
confirm what it is you're signing.
And if you compare and contrast that with Bitcoin, it's pretty
straightforward. It's like, look, here's your
Bitcoin address, here's the change address.
A lot of good hardware wallets actually lay that out for you.
Bitcoin only hardware wallets. So it's not the actual Ledger
device itself that was compromised.
It was something that was compromised on the software
level. How how were they able to do
that? Was is it so essentially did did
a developer download like a, a malicious software?
Is that what happened? Probably it's too early to say
because I think the only forensic report that has been
released was performed by by bit or at by Bit's request.
I don't know that they actually had access to this supposed
developer's machine. Over the long term, you would
expect that if that's what happened, then a full forensic
analysis of any compromised endpoints, you know, employee
laptops and other machines should occur and they should
then be able to figure out what is the actual root cause of how
it got compromised. But generally what happens in
these cases, especially with Lazarus Group, you know, they
are considered very advanced persistent threat actors, and
they will spend weeks, if not months poking and prodding and
trying to social engineer and compromise various employees at
a company in order to eventually get your production
infrastructure access. So that usually does involve
some sort of social engineering to trick an employee into
installing some sort of software that has a malicious payload.
What we've seen pretty often is that they will go after
developers and in some cases they will, it will try to get
the developers to download and run, you know, some sort of code
from GitHub, usually under the auspice of helping them debug
something or helping them do some sort of, you know, academic
project. And that code in that GitHub
project will have a malicious 0 day like exploit that basically
allows them to get, you know, full access to the machine.
Gotcha gotcha you know it's it's it's very interesting by the way
we're about to break 1000 live viewers on the live show.
If you guys are enjoying simply Bitcoin live so far, make sure
to smash that like button help us break 100 likes within the
1st 15 minutes of the show on YouTube.
We're already at 80 likes. If you guys are enjoying the
show smash the like button consider subscribing opti crazy
morning man the day that Jamison lop is joining us on the show.
We had to put out some fires in a very short amount of time, but
I'm happy that we we got the show up and running for you
guys. What are your thoughts on this?
Man? It was a pretty big deal.
It, it tanked the price as well, man.
Like, I think it, it severely affected the price.
We were at like 99.5. I totally bought the top.
I always do no shame, don't care.
But but it, it like it, it, it affected the price, right?
It, it dumped the price. I think a lot of people had a
lot of questions. A lot of people are like wait a
second, hold on, this dude is using a Ledger to sign a
transaction for a $1.4 billion transaction?
Like what is going on here? What were your thoughts, Opti?
Yeah, well, obviously when I saw that video of the Ledger, it was
like, wait, it's almost like the joke you've been saying for a
long time that Bryan Armstrong just has a Ledger in his sock
drawer and that's how he secures the transaction.
It like literally happened with Bibit.
So that that was just hilarious. And then just kind of in
context, you know, this is 1.4. That article said about 1.5.
I think it's like $1.45 billion hack.
Obviously it's an Ethereum, but in context, this is what about
three times the size of the Mt, you know, Mt Gox going down.
So this is a huge, huge hack here.
The Lazarus Group obviously came up huge on this hack, whether it
was social engineering or what have you.
It's a huge hack. And then before I actually have
a question for a lot before, but it's kind of what you pointed
out, Nico. Like it's funny.
And I was joking about this earlier.
Why we're kind of setting up the show.
It's funny that even the real scammers out there don't even
want Ethereum or any shit coin. And they just flip it into
Bitcoin instantly and try to get it into Bitcoin.
You know, a signal for everyone out there that might be Bitcoin
to Jason. It's like even the real scammers
don't want the the the shit coin scams.
They're like, let's put it in the Bitcoin.
But lot for, you know, for the not so advanced people in the
audience with this hack, just to be completely clear, is this an
Ethereum issue or Ledger issue? Can this happen on Bitcoin?
For someone watching the show right now, you know, maybe
they're getting a little a little scared if their Bitcoin
is secured correctly, what would be your advice to them?
I mean, it's a combination of the complexity of some of these
protocols and just the way that these hardware devices operate.
So, you know, I think the take away here is, you know, multi
sig is not panacea. You know, having your keys
offline obviously is a good start, but the real question is,
you know, when you are actually cryptographically signing a
transaction to move funds, how strongly are you verifying
exactly what you're signing? And so the problem here is that
in most cases when people are doing multi sig transactions on
these EVM networks, they're blind signing because as I said,
the the hardware simply doesn't have enough information to know
exactly what the result of the command that you are signing is,
is going to do to, you know that network to that blockchain.
So you have to have more safeguards in place.
You have to have more levels of verification if you are using a
we could call it a non-native multi sig contract.
Like the nice thing about Bitcoin is that multi sig is
baked into the protocol. It is it's very simple.
The the downside to these, you know, more generic smart
contracting networks is they don't have multi sig baked into
the protocol. It ends up being a, you know,
much more complicated, you know, app, if you will, that is
written and deployed onto these networks.
And as a result, those hardware devices simply just don't know
what to do with it. The one thing that we're seeing
your Ledger is talking about, well, no one should be doing
blind signing. They should be doing clear
signing. And what does that actually
mean? Well, it basically means Ledger
wants you to be using their enterprise product where they
have, you know, a very specific set of smart contracts that
their servers are aware of. And then they have additional
sets of interactions between your like Ledger live app
software that you're running. And then the servers on their
back end where it's doing just additional levels of
verification back and forth and sending data to your Ledger
device so that the Ledger can display exactly what it expects
the result to be. So, you know, this is still
additional complexity, but I think it's really it's the best
that we have to offer at this point in time.
And you know, we've done similar things at Casa where it's it's,
you know, a client and server validation basically checking
each other's work. The problem that occurred here
with this NOSA safe front end is that everything was happening in
the browser. Like there was no other machine,
you know, no other node that was running somewhere that was
basically being checked against to see exactly what the result
of the transaction was going to be.
Got it. Interesting.
So essentially and and that's that's actually so multi sig is
built natively into Bitcoin, but with the alternative with the
altcoins, it's not built natively into them.
So they have to do it via smart contract.
And essentially, that's where it, it opens the attack vector,
so to speak, right? And someone in the chat, I think
the complexity and I just want to share this.
I just want to share this screen from, from the by bit fitter by
bit CEO. And it exactly says what, what
Lop was saying. So the benign JavaScript file of
app dot safe dot global appears to have been replaced with
malicious code on February 19, 2025, specifically targeting
Ethereum multi sig cold wallet of BI bit.
The attack was designed to activate during the next BI bit
transaction which occurred on February 21st, 2025.
So this is extremely sophisticated lop like these
guys. This is not child's play.
Like they knew exactly what they were doing.
Well, they did because if they had wanted to, they could have
been sweeping basically everybody's wallets who were
using the NOSA safe web app. But you know, they were smart
and they put in that conditional that basically only listed a
couple of contract addresses because they they didn't want to
tip their hand. Like this is sort of classic
game theory of a zero day exploit.
When you have some sort of massive vulnerability that
you're trying to monetize, do you immediately start, you know,
trying to sweep up money from everybody?
Or do you have a little bit of patience and you basically lie
in wait until the big whale comes along?
And so that's what happened here is like they knew that like that
was the biggest possible wallet that was going to be interacting
with this code. And so they only had to wait a
couple of days to basically get the the fish on the hook, so to
speak. If they had deployed it without
those conditionals, then, you know, you probably would have
had people losing a few E here and there and they would have
raised the alarm because they wouldn't have understood what
happened. And then, you know, that would
have resulted in the Gnosis team looking into it and finding the
problem before they were able to get the 1.4 billion.
Yeah, well, it's so wow, wow, wow.
Very is the the the Lazarus group very sophisticated target,
you know, just lying in wait until they get the big pot.
Now my question to you, Lop, and I think a lot of people are
watching this. How do people protect themselves
from this? Like, I mean, from my vantage
point, it's like, OK, obviously take self custody Bitcoin, you
know, the simpler the better, right?
In my opinion. So what would your professional
advice? You've been around for a very
long time in the space. You're obviously, you know, this
is up your alley, right? You're a security.
I would consider you a security expert.
How could people protect themselves from this type of
attack? Well, yeah, I mean, if you stick
to Bitcoin and you are using these air gapped hardware
devices to verify the transaction details on the
device, then you're gonna be good to go.
It's not until you start dealing with these more complex
protocols where you're basically doing, you know, smart contract
commands where you need to have a more sophisticated setup.
So you know, if you are gonna go down the route where you're
using EVM stuff, you can you can simply avoid using these smart
contracts and you can just use the native, you know, single
signature on chain functionality.
And in those cases, your hardware devices will be able to
display exactly, you know, what the amounts and destination
addresses of your transactions will be.
But you know, if you have millions or 10s of millions or
hundreds of millions of dollars, you basically need to have a
much more sophisticated set up that's managed by a team.
And you know, you really need to be paying a number of different
security professionals to try to break your set up and find the
weaknesses in it. It needs to be a lot more
sophisticated than just using a web app.
Yeah, 100% agree. And I think that's where you
know, it, it it perhaps it gives it gave them a false sense of
security, right. They're like, oh, we're using
multi sig. This is fine, you know, Oh, I,
I'm, I'm looking at I'd like this is something that I've done
over and over and over again. But that's exactly what the
social engineering. It's like this is what they they
rely, they they hope that you kind of fall into this
convenience trap. This oh, I'm safe.
My, my, my setup is safe. And you know, they, they pounce
on the, the opportunity. Not to mention it was a massive
honey pot because, you know, if, if the, if the reward wasn't so
great, you know, I don't think they would have gone through the
amount of effort. Like I'm just reading this
report and in my mind I'm telling, I'm thinking to myself,
I'm like, this must have taken months and months and months of
planning and just checking and seeing until, you know, they
found a vulnerability. This was not something simple.
It wasn't like the the Bit Fenix hack, which was a total social,
social engineering hack attack. This was like a sophisticated
like Black Hat hacker type of, you know, operation.
Though we still really don't know the details of the Bit
Fenix hack. And that's always been
disconcerting. Like, they never really
revealed, you know, how the machines got compromised.
Like how how did Ilya get production infrastructure access
to the Bit Fenix? There's still so many open
questions, and I'm afraid at this point we're never going to
get all of the answers to that. But yeah, so you know, some of
the people that have been concerned about this have
basically been saying, well, you know, if a if a multi billion
dollar exchange can't do self custody correctly, then how do I
know that I can? Well, you know, first of all,
you probably don't have a billion dollars that you're
trying to custody. Like you're not at the same
level of of threats that you have against you.
So you know, North Korea isn't going to be sending their hacker
squad after you for your, you know, few $1000 or, or even
probably for $1,000,000. They are going after those multi
100 million and billion dollar targets.
You know, their time and resources are precious.
So they're going to go after the big boys.
Beyond that, you know, part of part of the just Mile High
aspect of security in this ecosystem is we need to stop
creating such huge targets. And the way that you do that is
you get as many people as possible to take their Bitcoin
into self custody. If the culture is not pushing
people to educate themselves and to learn and take the
responsibility of self custody, then the inevitable outcome is
the vast majority of people have all of their money in just a
handful of trusted third parties.
And those are going to be the targets for these state level
actors who, as you said, are very advanced and persistent.
And they will spend months and huge amounts of resources
because they are backed by a nation state.
And they only have to find, you know, one weakness.
They only have to win and only have to like, succeed one time
in order to have massive catastrophic consequences for
many people. And and as as we've seen, you
know, the consequences here actually affect everyone in a
way, even the self custody folks, because whenever a
attacker manages to get their hands on millions or billions of
dollars worth of crypto assets, what are they going to do?
They're going to try to dump it as quickly as possible.
And, you know, first they're going to try to, you know, move
it around to make it harder for anyone to try to confiscate.
You know, I think one of the reasons that they started
hopping to other chains was because there was a little bit
of rumbling about, well, maybe we could, you know, rollback
Ethereum or, you know, make a state change to Ethereum.
But of course, once they start moving to other chains, that
becomes, you know, practically impossible, infeasible to get
consensus to do. But the ultimate medium term
goal, of course, is for them to get out of the entire crypto
ecosystem and and basically convert it into Fiat so that
they can fund, you know, whatever their nation state
programs are. You know, some some people
speculate that this is going to funding like North Korean
military programs. I don't know how much evidence
we have of exactly where the money is going, but you know,
it's probably nothing good. Yeah, absolutely.
And, and one of the thing I found it interesting that they
converted the ETH to Bitcoin, right?
I found that interesting. And then, you know, it's, it's,
let's see what happens. Cause a lot of, I saw, I saw a
lot of people were talking about it how like they weren't,
because all these addresses were being followed.
They weren't going to be able to do anything with that stuff.
But apparently that's not the case.
It doesn't look like the Lazarus Group or any of these, you know,
any of these hackers have any intention of giving that money
back. So yeah, but that's, that's the
way it is. Anyhow.
Anyways, guys, before we move on to the next segment of the show,
we're going to talk. We're going to be talking about
the rise of $5.00 wrench attacks all over the world and what you
can do to protect yourself. Also, Lop wrote an article that
Jack Dorsey is not Satoshi Nakamoto.
Apparently that has been making the rounds on X, that Jack
Dorsey is Satoshi Nakamoto. I mean, I could have told you
that. I could have said, you know,
like that. You know, I have my suspicions.
I'll never say them publicly, but Jack Dorsey is not wasn't is
not on that list. But yeah.
So we're going to be talking about that, of course.
And then during the culture segment, we're going to be
talking about Casa. Casa makes self custody easy.
It lets you take all the advantages of multi sig, but the
UI makes it incredibly easy for anyone who doesn't have
experience with Bitcoin multi sig.
It allows allows it for anyone to just pick it up and get all
the benefits of security without the complexity of very
sophisticated, you know, apps and UI and all that stuff.
Casa makes it incredibly easy to to do all that.
So we're going to be talking about that during the culture
segment. It's going to be an incredible
show guys, if you guys are enjoying it so far, we already
broke 100 likes on YouTube. Help us break 200 likes.
We're almost on four. We're almost at 400 live viewers
on YouTube alone and 1500 live viewers across all platforms.
And of course, shout out to the Rumble audience, which has by
far the most savage chat everyone, the rebel audience, I
feel like hits us with the metaphoric 2 by 4 every single
day non-stop. So guys, it's going to be a
great show. Before we jump into it, I do
want to give a very special shout out, of course, to simply
Bitcoin's lead sponsor. Simply Bitcoin would not be
possible without our partners. And we're very, very, we're very
picky on who we choose to partner with Bitcoin Well,
enable your independence with the fastest and safest way to
buy Bitcoin on chain or via the Lightning network in Canada and
the USA. To get started, you put in your
e-mail address. It takes 2 to 5 minutes to get
signed up. And what makes Bitcoin Well
different is that it's a completely non custodial
platform. What does that mean?
That means that when you buy Bitcoin on Bitcoin well, as soon
as the funds clear, they go straight to yourself custody
Bitcoin wallet address. They don't even allow you the
ability to leave your Bitcoin on the exchange, which of course
perfectly aligns with the simply Bitcoin ethos of the separation
of money and state because self custody is the revolution.
Also, if you're a higher net worth individual looking to buy
$50,000 worth of Bitcoin or more, check out Bitcoin.
Well, Infinite. It's a white glove experience.
You get a dedicated Rep, which you can call or you can text,
you can do e-mail. And every time you want to buy
or sell Bitcoin, you have a real human being that you can
interact with. So check out Bitcoin Well
infinite today. Go to bitcoinwell.com/OTC to get
started. And now if you're an American,
you can get paid in Bitcoin sent directly to your personal
Bitcoin wallet. Share your Bitcoin Well direct
deposit details with your employer, set your Bitcoin slash
dollar split and receive stats instead of Fiat with every
paycheck. What are you waiting for?
Head over to bitcoinwell.com today.
Scan the QR code, use promo code simply BTC.
Get 3 tosses into the Bitcoin. Wishing well guys, we're going
to hit the numbers. Will be right back.
I want to tell you guys about our sponsor Stamp Seed.
Is your Bitcoin and cold storage really secure?
Are your seed words really secure?
Stamp Seeds Do it Yourself Kit has everything you'll need to
hammer your seed words into commercial grade titanium plates
instead of writing them down on paper.
Don't do that. Paper sucks.
You want to literally stamp your seed into this plate of
titanium. Your words are actually stamped
into the metal plate with this hammer, so once your words are
in, they aren't going anywhere. No risk of the plate breaking
apart and your pieces falling everywhere.
Titanium stamp seeds will survive nearly triple the heat
produced by a house fire. They are also crush proof,
waterproof, non corrosive and most importantly, because this
is generational wealth time proof, all things that paper is
not allowing you to huddle your Bitcoin for the long haul.
I mean, here is the plate that they crushed, they put in water,
they put a blowtorch to it. And as you can see, the words
have survived. Stamp your seed on stamp seed
and you can use promo code simply to get 15% off anything
on their store. Head over to stampse-ed.com
today. All right, everybody, could you
imagine that conversation? Many generations, I mean like 50
years from now and your grandchildren are looking at you
and they're saying, grandpapa, are you going to, are you going
to give me your Bitcoin? And you look at them and their
eyes and you say no because I wrote down my seed phrase on
paper. Don't do that.
Stamp your seed phrase onto titanium.
Go to stampse-ed.com today. Use promo code Simply 15% off.
At the time of recording, the Bitcoin price is 84,750 block
height. That's at a discount, 22%
discount. Specifically block height
885,590 SAT's per dollar, 1180 market cap 1.68 trillion Bitcoin
versus gold market cap 8.3% Percentage issued 94.42% decline
from all time high -22.4% realized monetary inflation
.97%. In the grand scheme of things,
we're just getting started. I love this number.
When me and Opti started covering this, I believe it was
at like the 2% level. It's now below 1%.
Bitcoins realized monetary inflation, continuing to take
Fiat currencies to absolute school.
And if you buy Bitcoin right now, you're getting it at a
22.4% discount. Big of a bit of a dip.
Anyways, I do want to focus on this because I think our friends
over at at Casa do such a great job making multi sig easy,
making your Bitcoin self custody set up extremely secure.
And a lot of people think that, you know, maybe the wrong
episode to say this, but I'm going to say this anyways.
But a lot of people think that the the biggest vulnerability is
their Bitcoin being hacked, right?
And there's a Bitcoin being hacked like that's their biggest
vulnerability. That's what they think.
But in reality, the biggest vulnerabilities to your Bitcoin
are two things. You either losing the ability to
access your Bitcoin because you made your set up way too
sophisticated and you just don't have the technical know how, so
you lose your Bitcoin yourself. And then the other, which is the
more physical type of attack, which is the infamous $5 wrench
attack. And it seems like those types of
attacks have been escalating over time and perfect we have
the the what I consider the master of Bitcoin security on
the show today. Jamison Lop to talk about all of
this. So first, starting off with this
article article, A Chinese man has been, I can't say that on
YouTube, a Chinese man has been taken out on the southern South
Korean island of Jeju and what appears to be a cryptocurrency
robbery. Here's another one.
An in depth news report on one of the attackers evolved in the
Danbury kidnapping attempt last year that was linked to a
several $100 million Bitcoin heist.
Here is the next one. Six men are accused of
kidnapping 3 family members and a nanny from a Chicago townhouse
in October and forcing them to transfer $15 million in
cryptocurrency before releasing them five days later.
And last but not least, a specific type of worker named
Zapry Outlaw is charged with kidnapping a man she met at a
Las Vegas nightclub, taking nearly 300,000 in crypto
currency from him. The victim might have been under
the influence of something. So anyways, lop, this seems to
be happening seems to be escalating.
I think a lot of things there's trade-offs obviously with self
custody. Self custody comes with personal
responsibility comes with responsibility, complete
responsibility. There is no one 800 number to
call if you've lost your keys, right?
And it also, I think, potentially opens you up to a,
you know, the infamous $5 wrench attack, right?
You know, like, everyone's thinking like, oh, it's going to
be the sophisticated Lazarus group.
But in reality, you buy a $5 wrench and you show up at
someone's house and you say, I'm not going to leave until you
give me your Bitcoin. And if not, I'm going to use
this $5 wrench in ways that you don't like, right?
So lot like, obviously, you know, you've been doing a great
job covering all these events that have been happening
worldwide. But first thing that sticks out
to me is one happened in Chicago.
So one happened actually in the United States, which you would
think in the United States that these types of things weren't
happening you that you've been covering this for so long.
Is this surprising at all? I think what we're seeing is
that just because you live in a safe area doesn't mean that
you're safe from being targeted. Like these are highly specific,
highly targeted attacks. Well, some of them are, right.
So I guess we we need to break down the different types of
attacks, right? So first of all, there's the
like the crime of opportunity. And so I think the the one with
the, as you said, specific type of worker, you know, that that
sounded more like a crime of opportunity.
This guy was probably going out, putting himself in a risky
situation. He was probably flaunting as
well through talking about how he was doing a lot of crypto
trading stuff. And so that got him targeted
just in the moment. Now, I think The thing is that
people should be more worried about because they're harder to
protect against are the ones where it's a home invasion type
thing where you're getting targeted ahead of time.
And, you know, these people, these attackers are putting a
lot of effort into, you know, surveilling you and figuring out
what your sort of day-to-day activities are and then
essentially taking you hostage. And maybe they do that at your
house if they feel like your house is not a hard target.
Or in other cases, like last year, we saw Aceo of Wonderfi in
Toronto. They just waited for him to exit
his office at the end of the day, and they threw him into a
van when he came out into the parking garage going home from
work. So they were likely surveilling
him and figured, hey, that's the most vulnerable time for us to
pick him up. So, you know, I would say in
general, these are still rare, like in in the greater context
of how many million people obviously are owners of Bitcoin.
But we also see the trends and the trend is that there seems to
be a rough correlation between the exchange rates, you know,
the general adoption and understanding or awareness of
Bitcoin and the number of criminals who are then trying to
apply their own skill sets in extracting these valuable assets
from targets that are probably not nearly as hard as, you know,
trying to hit like an armored car or a bank or, you know,
traditional high value target. Sorry about that.
And let me ask you something else, Lop, right.
So you broke it down in the specific types of attacks.
There's the opportunistic attack, right, with that
specific type of worker that I said YouTube.
And then there is the there's the planned attack.
It seems like that Chicago attack that that seems like a
pretty big heist 15,000,000. That seems like a planned
attack. That seems like they they
scouted that person out. Now my question to you, Lop.
And you've written amazing articles on this, by the way.
How do you protect yourself against this?
Like, you know, how do you how do you go about your life, you
know, rethinking your your safety and your family safety,
right? Because us bitcoiners, we have
this joke of like, look, I love the Second Amendment and I'm
going to make my house into an effing castle.
So, you know, like what, what would be the, the, the, what
would be the advice to someone that potentially is, you know,
they've been in Bitcoin for a while, they had they take self
custody, but they they haven't really thought about this
potential attack vector. What would your advice be to
them? Yeah, I mean, the first thing is
don't be an idiot. Don't put yourself into risky
situations, you know, don't go conducting high value face to
face trades with large amounts of of cash involved.
Because you know, that's where a lot of these crimes of semi
opportunity happen is people targeting the sort of face to
face OTC traders, getting them to meet up in a sort of secluded
hotel room or something like that.
And then basically taking them hostage, tying them up and only
performing 1/2 of the trade, as it were.
But for the the more like long term targeted stuff with the
home invasions and robberies and whatnot, the the main thing that
you want to focus on is not becoming a target.
And how do you not become a target?
Well, you shut up, you don't go around, you know, flaunting
wealth. You don't broadcast to the
entire Internet that you're doing stuff with these assets.
And preferably if, if it's too late for you, if you've already
basically doxed yourself as being, you know, Bitcoin
evangelist and holder, then you should take precautions so that
it's hard to actually find your address where you sleep at
night. That's what I did a number of
years ago. It's, it's not easy, but it's
feasible, at least in the United States.
It can be more difficult in other countries that don't have,
you know, some of the same legal options for, you know,
protecting your address and your ownership of property and stuff.
But privacy, I would say is the thing that people should be
investing in the most. You think of, you know, any
security system should be this multi layered system.
So you know, you've got your your valuable thing that you're
protecting at the center and then you're sort of rain fencing
it with multiple layers of security.
You never want to only have one layer of security.
You should assume that various security mechanisms are going to
get broken through. But at the outermost layer
beyond the actual security is your privacy.
And that privacy layer is very important because if you have
strong privacy, you're not going to get targeted in the 1st place
and you're not going to have to worry about whether or not your
various layers of security are going to fail.
So, you know, I, I do hear people, of course, basically
saying, oh, I don't have to worry about this because I have
guns and so on and so forth. And look, I'm a big firearm
owner myself. There's plenty of photos and
videos of me with guns on the Internet.
And, you know, if it gets to that point, then you are in
trouble. Like it means that all of your
other privacy and security mechanisms have failed and now
you're in a sort of last ditch effort to really fight for your
life. And of course, there are plenty
of things that can go wrong. Simply having a gun is not a
guarantee that it will be successfully used to defend
yourself. I think across the over 200
different different incidents that I've measured, only only
two of them were successfully defended with the firearm by the
victim. And why?
Why do you think that is? Like, is it just because you're
again, they have a jump on you, you don't have a jump on them?
Yeah, you can't be hyper vigilant all the time.
Like unless you're going to go spend like a quarter, $1,000,000
a year for 24/7, you know, around the clock bodyguard
security, like nobody has eyes in the back of their heads and
everybody has to sleep at some point.
Gotcha, gotcha. Yeah, it's a, it's a, it's a
very interesting, it's very interesting topic.
And you know, it's, it's one of the trade-offs of of self
custody, right? It's 1 something that I think
bitcoiners all have to really put some thought into.
But I agree with, I agree with you lap 100%.
I think privacy is just that's the easiest one, right?
Because if no one knows who you are, there's nowhere to look,
right? And then the also the.
Go on podcast with your real name and face that would be.
A terrible idea. And also Opti did that for a
while. No, I didn't.
You're lying.
You put, you put, you put on a mask for a while.
Oh yeah. Oh yeah, yeah.
I wasn't on forever and then Nico wrote me into not being a
non, so now I'm wrecked. Thank you, Nico.
But but hey, someone has. Someone has to talk about
Bitcoin. Someone, someone, you have to do
it right. But yeah, this is this is a
very, very fascinating topic. Very interesting topic.
Lop, if people want to go down the rabbit hole and read some of
your articles, where could they find them?
Yeah, check out blog.lop.net. I've got a lot of privacy
articles there. And in general, if you want to
go down the privacy rabbit hole, you should spend the like 40 or
50 bucks to buy Extreme Privacy by Michael Bizzell on Amazon.
Awesome, awesome. So you go.
We have it in the ticker down below, blog.lop.net and check
check out some of Lop's articles or some of my favorite.
I've been reading them for years.
There's one there's one with an image of of just like a Moat
around the house, which it was one of my favorite articles.
So yeah, just go check out all this stuff.
This is all stuff, guys, that you have to think about if
you're taking Bitcoin into self custody, especially you've been
in Bitcoin for a while. These are all things that you
have to think about. Think about multi sig, think
about geographically separating your seed phrases, think about
decoy wallets. Those are all things that could
work to your advantages, to your advantage, but you have to you
have to put in the thought, you know, the the Spider Man quote
is ringing my head, right? With great power comes great
responsibility and that's what self custody is all about.
Anyways, guys, we're going to jump into the news segment where
we're going to be talking about whether Jack Dorsey is Satoshi
Nakamoto or not. So we will be right back.
I want to give a shout out to our sponsor Casa.
Bitcoin security matters, but managing private keys can
sometimes be complicated, especially multi sig.
What if you can secure your Bitcoin without worrying about
losing a seed phrase or giving up custody?
With Casa, you can completely control your Bitcoin with multi
key security. So even if one key is lost or
stolen, your funds stay safe. No single point of failure, no
stress. That's what I absolutely love
about these guys. They make taking Bitcoin and
into self custody incredibly easy with their best in industry
user experience through their app.
I've been personally recommending Casa for years now
to my friends and family because they will get all the benefits
of multi key self custody security without the hassle of
having to learn complicated UI. And if you're thinking of one
day passing on your Bitcoin to the next generation, their
inheritance plan has you covered.
Also, if you're a business looking to add Bitcoin to your
treasury, do it the secure way with Casa.
For business to get started, go to Casa dot IO today and get 5%
off Casa Standard or Casa Premium with promo code simply.
I want to give a shout out to our sponsor foundation.
It's self custody done right. They built a premium grade
hardware wallet called Passport right here in the US and it
integrates seamlessly with their free app called Envoy.
Passport is fully open source and verifiable.
It's the most intuitive Bitcoin wallet designed with a UX
reminiscent of a classic feature phone, so you'll know how to
navigate it and use it the moment you pick it up.
It's also air gaps, meaning Bitcoin stays offline, never
touching an Internet connection. It's Bitcoin only open source,
verifiable air gap security model, gorgeous design craft,
premium grade materials. Get your Bitcoin off exchanges
and into your own hands in just a few minutes with Passport at
foundation dot XYZ slash. Simply get Peace of Mind for
your piece of Bitcoin. All right, everybody, this is
Opti and Opti is not holding a Nokia, He's holding a passport
by Foundation Devices. And if you use promo code
simply, you will get a discount not on Opti, but on the Passport
by Foundation device. Remember, guys, not your keys,
not your keys. This device is completely open
source. It's completely air gaps and it
doesn't sacrifice security for convenience.
Get yourself a passport by Foundation Devices today.
Take self custody. Not your keys, not your cheese.
All right, everybody, let us let's talk about this gentleman
right here, Jack Dorsey, which lot believes is Satoshi
Nakamoto. No, just kidding.
That's a joke. Blop.
You dropped this article on your blog, blog.lop.net.
The title of the audio the title, the title of the article
for the audio listeners is Jack Dorsey is not Satoshi Nakamoto.
Compilation of evidence that Jack Dorsey could not be the
creator of Bitcoin. So let's go through some of
that. Lately some folks have been
pushing 1/2 baked narrative that Jack is Satoshi and you can find
the arguments here. First one from Sean Murray Why
Jack Dorsey is Satoshi Nakamoto. Jack Dorsey was one out of the
1300 confirmed cyber puns in 1996 in his UMR e-mail wore an
atom back T-shirt in the UMR yearbook.
UMR students were called minors. Was a computer science and math
major with an interest in crypto.
Continues to go. Anyways, you guys get the point.
Back to Lops blog and here this is Matthew Siegel.
He says in the spirit of Full disclosure in intellectual
honesty, prosperity's judgement and rigorous debate, I would
like to share my strong belief. I have become personally
convinced that Jack Dorsey, CEO of Square and founder of X is
Bitcoin's founder Satoshi Nakamoto.
And he posted this was April, this was February 18th, this was
February 15th. Wow, OK, this is all coming all
all around the same time. But you know and Lop says here
we go again. 2014 we found Satoshi, turns out he was hiding
in plain sight and we listed in the phone book. 2025 we found
Satoshi. Turns out he was hiding in plain
sight and appearing on national television wearing Satoshi
shirt. I have to play the meme.
Here we go anyway. Continues to say it's true that
Jack was a cyberpunk and a programmer, but that's the
strongest evidence available to support the this theory.
Everything else is circumstantial if not outright
mental gymnastics via numerology.
I will once again point out that Satoshi hunting is a Dick move,
and thus I once again find myself interested in
discrediting said Dicks. If you're going to post a
Satoshi claim, you should put as much effort into trying to
disprove improve your own thesis as you do trying to improve it.
Otherwise you risk looking like a fool.
Accusing someone of being Satoshi without providing
bulletproof evidence makes you a massive asshole because you're
painting a target on them. It continues to say.
The funny thing about Jack is that unlike most cyberpunks, he
was an extremely public individual.
Who posted who? Who posted what he was up to on
nearly an hourly basis during 2009 and 2010.
Jack posted over 6200 tweets. This gives us a much larger data
set to work with compared to Satoshi, who created fewer than
1000 time stamps events during the same period.
A little common sense. During that time period of 2009
and 2010, Jack Dorsey was not only chairman of the board of
Twitter, but also the CEO of the fledgling startup Square.
It's quite clear that he was an extremely busy person, not only
oversight, overseeing multiple companies, but traveling around
the world, meeting important people, doing press conferences,
speaking at conferences, and promoting philanthropic causes
and more. His activities do not fit the
profile of someone who had the time and mental bandwidth to
also be. Did we lose Nico?
It seems like it's. OK, OK.
Oh wait, he's back. Oh did did I drop out?
Yeah, for a second. You're back.
What?
What part? What part did I drop out?
Of the persona part. Oh, OK, all right, perfect.
I mean, so everything, the little common sense, all that.
OK, anyways and. So the the my point here about
Windows is that we know Satoshi was building on Windows.
The first version was Windows only, so I shouldn't clarify
that. Yeah, so, Lop, first of all,
excellent article kind of debunking all of this.
What, you know, what motivated you to do this?
I mean, it's kind of a self-explanatory.
You feel like these people are Dicks.
Why are they Dicks for trying to expose Satoshi Nakamoto?
Yeah, I guess I'll leave that to the very end the the conclusion
in which I basically say that, look, Satoshi should be an idea
and a myth. You know, I think we are all
Satoshi. You know, Satoshi left the
project to us. And the problem comes in when
you try to paint Satoshi as a singular figure of a human
being. You know, a human being is
fragile as a single point of failure is going to be human.
They're going to have said or done probably controversial
things that people are going to dig into and try to use to
basically cast aspersions upon the entire Bitcoin project.
So as a result, I think Bitcoin is stronger when there is no,
you know, single human point that people can basically try
to. Denigrate 100%.
And I think that's something that Bitcoiners fundamentally
understand. I think if you've been in
Bitcoin long enough, you understand that it's actually
better that Satoshi's identity is never discovered because it
if it is discovered, it it essentially connects his
identity to a mortal, to a human being.
Human beings have flaws, right? Human beings, you know, they
have to sleep, they have to do other things, right?
They have to eat. But if if he remains this
mythological figure, there's really no flaws there, right?
You only have like, you know, certain interactions that he's
had. I know in the CSW lawsuit, it
was very interesting to, to see some of some extra
communications that Satoshi had that wasn't exposed to the
public, right? So I, I fundamentally agree, I
think the less we know, know about Satoshi, the better.
I think that if you've been in Bitcoin long enough, you've come
to realize that knowing the identity of Satoshi is not
important. It's what Satoshi did is that is
important. And I think it would be actually
a negative to the industry and to the movement because this is
really what Bitcoin is if we discovered his identity.
I don't think that's ever going to happen, by the way.
And I don't think those coins are ever going to move, by the
way. Also, I think that he under, he
fundamentally understood that he created something bigger than
himself and that's why he walked away and left it to its own
devices. And here we are 16 years later
and we're talking about nation state adoption and all that
stuff. So it's been a tremendous
success. So if you're look, if you're
still trying to discover Satoshi's identity, you don't
get Bitcoin. That's my take.
My maybe I'm wrong, but that that's my opinion.
Opti, what's your take on this brother?
Yeah, well, I'm with lap on this one.
I don't think Jack Dorsey is Satoshi and I don't really need
any any evidence for this. It's maybe it's just a vibe
check here. I just I does makes no sense to
me. And I I find it interesting
though part of this idea, like you were saying, Nico, if you
are trying to find out who Satoshi is, you don't understand
Bitcoin. I find it interesting that
usually for a lot of new people in Bitcoin, this is like their
one caveat. This is the one thing that they
always say that, you know, makes them not trust Bitcoin.
And us Bitcoiners are completely opposite.
It's like this is a good thing that we don't know who Satoshi
is, whereas most people come in. It's like, how could you trust
this Internet money thing with an anonymous creator?
Like, don't you want to know who it is?
And I'm like, no, it doesn't matter.
This is the beauty of it. This is this is the whole point
that the creator came anonymous, gave us a gift and disappeared
like Batman. And this, This is why no.
One controls the. Network, but an interesting kind
of take on this is that those bitcoiners on Twitter that are
saying this they're not like newbie bitcoiners.
And so I, I find it kind of interesting that they are
pushing this narrative and I wonder what the incentive is and
you know that's that's kind of my take on this.
It's like it's not like they're new people into the space that
are saying this. They've been around for a couple
of years and now they're pushing this.
So that's what that's like the things that gets me kind of
wondering, like what what is the incentive to push that?
Jack Dorsey is Satoshi. But yeah, like I said, it's it's
usually newer people in the space that come in and they
wonder who Satoshi is. And all of us here that been
around for a while were like, dude, it doesn't matter.
I don't care. I literally don't care.
I don't ever want to know. I hope he never comes out.
But it's funny that when new people come in, they always ask
the same questions. Like, how could you trust this
money? You don't even know who created.
I'm like, this is a good thing. What are you talking about?
Do you even understand what's going on here?
I think that some people just want to have a hero or a leader
figure and that, you know, it would be cool if Satoshi
happened to also be this guy who's a billionaire and one of
the richest people outside of the Bitcoin, the Satoshi mind.
I think that's a similar reason why some people have floated the
Elon Musk theory, which is, you know, similarly ridiculous.
But, you know, people come in and I think they want to know
who Satoshi is because they think that there might be a
backdoor in the code. You know, Satoshi could be the
NSA or the CIA, and it doesn't matter because we know what the
code does. We can look at it.
It's open source. It's been reviewed by countless
individuals who have tried to find weaknesses in it for 15
years now and then I think some other people are slightly
worried about the economics aspect of, you know, one person
controlling such a large portion of the supply.
And I tend to agree with Nico that the coins are never going
to move. I have a blog post a few years
ago entitled Satoshi was Not a Greedy Minor in which I go into
the really deep technical details of Satoshi's mining
operation and I show that they actually mined a lot slower than
they could have. And so my thesis or Satoshi's
mining operation is that it was never meant to accumulate coins.
It was really meant to act as a heartbeat for the network.
And you can actually see that Satoshi would stop mining for 5
minutes after finding a block to basically give the rest of the
world a chance to try to find a block.
And then over the the years, Satoshi actually decreased their
hash rate as the hash rate of the rest of that network
increased. And so that that was because
they no longer needed to be that stabilizing force to ensure that
blocks were still being produced at a consistent rate in those
very early days. 100% no. And he was, and I remember some
of the earlier, earlier communications.
Lop to add to your point, he was like basically saying like guys
like calm, you know, like, let's make sure that this hash is
distributed right? Like let's calm down because in
the beginning it was, it was, it was very delicate.
You could you can even make an argument that it was, it was
centralized. Lop, isn't there a story that
essentially Satoshi ran Bitcoin and stealth in the for like,
kind of like in the very, very early days on purpose?
I'm not sure what you mean by stealth.
I mean, I think he, he. He was running.
He was running the software by himself.
No, like there were other early miners even in the first, you
know, day or so of blocks. If I recall correctly, there was
actually some logic in the Bitcoin client at the time where
it would not start mining blocks until there was at least some
other peer connected to the node.
Interesting. So he so someone else had to is
is that I don't want to ask what that person is, but I mean like,
like some of these people are are public, are they not?
Yes, we do know some of the very early minors and then there are
plenty of those early blocks that as far as we know have not
been attributed to any specific identity.
Yeah, those guys, they're doing it right.
They're doing it right. They're watching all this
content, they're going to the conferences.
They. They're not.
Going to the conferences. No, they might.
You have no idea. You would have no idea, right?
Anyways, alright guys. Hey wait, Nico, before we go on,
since we got Lop here, SpongeBob SquarePants in the chat has a
question here, and I think Lop's perfect, perfect person to add,
why hasn't Satoshi's wallet's been hacked?
Well, the keys might have been destroyed.
I think there's there's plenty of reason to believe why the
keys are no longer laying around.
Like I said, you know, my take away from looking into Satoshi's
mining activities was that it was actually a very specialized
machine with it was running specialized multi threaded
mining software that was not like public open source mining
software was not the software that was built into the Bitcoin
client at the time. And so that's, you know, another
reason why I believe that Satoshi basically just had that
infrastructure running to keep the network going for those
first 18 months to 24 months. And then once the network seemed
like it had bootstrapped itself, they turned it off.
So you know what happened to those keys?
Maybe they destroyed them, maybe they still exist.
But I think it's basically there.
That money is like too hot. Like I don't know how you would
actually spend any of that money without putting yourself at
extreme risk of of being doxed. 100%, I 100% agree with that.
I do, I do. Before we move on to the next
segment, I do want to end or you know, finish off some of the
reasons as to why Jack Dorsey is not Satoshi.
A LOP lined it up there, lined it up here because I'm sure Jack
used Windows at some point in his life, but he has been a die
hard Apple fan ever since the original iPhone came out.
And it says can't use my computer because both my Magic
Track pack and keyboard are out of batteries.
And it says most of the evidence in this report is based upon
timestamps, meet space activities.
Jack was bicoastal in 2009 and 2010, frequently alternating
between San Francisco and New York because those are the
locations of Twitter HQ. And then I think this is the
most interesting one right here. I think out of out of the things
that you've posted LOP. This to me is, I mean, like,
unless Satoshi could be two places at the same time, like I
feel like Jack Dorsey just planning all of this, you know.
But anyways, so Satoshi's public activity hour of the day.
And then here is Jack Dorsey's public Jack Dorsey's tweets hour
of the day. Obviously he needs to be awake
to tweet. I mean, I mean, I don't know
Lop. He could be the sophisticated
shadow coder and be planning his tweets.
Technically, like any activity can be automated, right, But you
know, you you kind of have to go with the Occam's razor on on
yes, like is the more complicated question or answer
to it really the more likely one.
I think that. I have a question for you.
Lop like it. It seems like Satoshi based on
this. What?
Seems like he was on the E in US time zone.
Yeah, it really lines up well with what you would consider to
be a typical waking and sleeping schedule of someone on the
Pacific Time zone. Interesting.
Very, very OK All right everybody, we're going to move
on to the culture segment. We have tons.
We have tons to cover and tons to talk about.
We're going to be talking about Casa.
It makes multi sig easy. It makes self custody easy.
There's an app that I've been recommending to friends and
family because I want them to have all the benefits of taking
self custody, but also but not losing their keys.
I don't know how many times I've found myself in the situation
where either, you know, just family members of mine.
They're like Nico, I lost my seed phrase.
I'm like, don't worry, we can just replace it, right?
So the Casa app enables that makes it easy.
So we're going to talk about all of that.
We're going to hit the culture segment.
We will be right back. I want to give a shout out to
our sponsor Hive Digital Technologies.
As the first ever public miner, Hive's been battle tested
through every possible market and as the first with an AI
strategy, Hive continues to redefine the future of
sustainable energy. Also got to casually drop this
in here. Hive consistently tops the
industry in Bitcoin mine per Exahash.
They're lean and mean, they're green and clean, and they're
changing the the game. Learn more by following them at
Hive Digital Tech or check out their website
hivedigitaltech.com. I want to give a very special
shout out to our sponsor, Compass Mining.
They make Bitcoin mining accessible to everyone, from
beginners to experienced investors.
Their turnkey miners gets you online and hashing within 48
hours, making it easier than ever to start your mining
journey. Plus, with their active
marketplace, you can resell your miner at any time, adding
flexibility and value to your investment.
Visit their website to access a wealth of resources, learning
everything you need to know about Bitcoin mining.
Take your first step into the world of Bitcoin mining with
confidence. Discover more at Compass Mining
dot IO. Again, Compass Mining dot IO and
see how Compass Mining can power your success.
All right, everybody, we are back guys.
So we're going to talk about Casa and of course we have
Jameson Lop here in the house joining us today on Simply
Bitcoin Live. Jameson is the CTO of Casa.
Jameson quick elevator pitch. If you had one minute in an
elevator with someone and they're like Jameson, what is
this Casa thing? How would you describe it?
So basically, we help you be your own bank and we make it
easy to do so because you know, when you are setting up
essentially your own bank security, there's many, many
different decisions to be made, many best practices to be
followed. And if you're not deep in the
weeds of all of that, then it's very helpful to have a software
that basically guides you down following best practices, and to
have actual humans that you can talk to who can help you
understand the trade-offs of the different decisions that need to
be made. Great, and I love I love that
phrase. We help you be your own bank.
That that's a very, very powerful statement.
And and I agree. I think, you know, taking
Bitcoin into self custody, especially with multi sig and
all the capabilities that that gives you, you feel like your
own bank. It's it's it's badass AF.
Do you have any questions before I move on?
Yeah, definitely. So when we were starting the
show, I asked Slob, what's the main message you want to get
across to our audience and Lop said it very simply that we are
fighting an uphill battle of convenience when it comes to
self custody. So can we elaborate on that for
the audience? I know our audience is pretty
much most of them are self custody maximalist, but we still
see some people that are on the fence about taking their Bitcoin
into personal custody. Yeah.
I mean, beyond just, you know, our operations as a company, you
know, this is a systemic issue for the entire ecosystem.
And my sort of black pill view of privacy and security is that,
you know, unfortunately, human nature is to prioritize
convenience at the expense of almost everything else.
And we know that using a trusted third party to hold your money
for you is always going to be the most convenient thing.
Basically pushing off all of the responsibility to someone else
is easy. And we do that in many different
aspects of our lives. So it's basically second nature
to us. So what we're trying to do is
we're trying to make it as easy as possible, reduce as much
friction as possible so that people can be more confident to
take that responsibility. And we want people to be able to
sleep at night with the understanding that, you know,
they can do self custody without screwing it up and without
having to worry that, you know, there's a weakness somewhere or
that, you know, one thing might go wrong and be catastrophic.
So that's everything that we're doing is to put people into an
architecture that eliminates single points of failure because
we understand things go wrong, humans make mistakes, and you
don't want to be in a really brittle set up where one thing
going wrong results in you losing all of your assets.
Totally lot you've been in Bitcoin for a long time, your
cybersecurity expert from your vantage point from where we are
today, do you think self custody or rather the idea of people
self custody, do you think that's going to improve or is
this will this always be a niche idea for the the like average
mainstream layman? I, I suspect that in relative
terms, you know, as we go more mainstream, that the vast
majority of adoption will happen through trusted third parties.
I think that's just the, the reality of the situation, at
least in our lifetimes. The problem here, it really is,
I think cultural and it, and it's also, it's a result of how
human civilization has developed over millennia is that we have
created these economic powerhouses that have been able
to leverage extreme efficiency and performance gains through
specialization of tasks. And, and so we've created these
systems where you're outsourcing the vast majority of the, you
know, important aspects of your lives to 3rd party specialists
because they're going to be better at doing something than
you are if you had to do everything yourself.
Like, This is why it's so much easier and efficient for us to
go to the grocery store than it is to grow our own food and
slaughter our own animals. However, while that's convenient
and it's efficient, it is also fragile.
It's, it's creating all of these potential points of failure such
that, you know, if the supply chains for food and, and
delivery of important, you know, medicines and, and other
physical items broke down, you know, we'd be in pretty dire
straits within a week or two with the way that the modern
society is architected. So that similar thing basically
trickles down to, you know, where we are with self custody.
You know, people who have bank accounts are used to the idea of
having all of their money in a trusted third party who's
managing it for them. And so this is, as a result, is
kind of a cultural issue where I suspect that it could take
generations for us to kind of reverse course on that and
really teach our children and our grandchildren to take
responsibility for some of these extremely important aspects of
their lives. Totally.
Yeah, I, I, I very much agree that it's a culture issue.
Now you did kind of mention about businesses and Bitcoin
treasuries. So as someone that is working on
a Bitcoin treasury product, how big of a product or a problem do
you think that these honeypots are like Coinbase and etcetera
in the in the space right now? We know a lot of the Bitcoin
ETFs are all custody essentially at the same companies.
And obviously it's your kind of life motto here.
Your life purpose is to obviously destroy, distribute
that security away from these honeypots.
So how big of an issue do you think this is?
And is this something that you think, you know, that keeps you
up at night? Do you think we might see
another, I don't know, exchange blow up?
Like what? What's your thoughts on that, on
that perspective? Oh, I mean, look at what
happened last week, right? Like this is it's not stopping.
I mean, we are, we are improving security best practices, but
security is a cat and mouse game.
It's a never ending battle. And so as this ecosystem
continues to grow and the total value of the ecosystem grows,
and then the total value of the single points of failure,
honeypot custodians continues to grow, then that means that the
attackers are incentivized to spend even more resources trying
to find the weaknesses in them because the payoff of of a
successful attack is also growing.
So, you know, I think that in terms of risk, it's just it's
better to distribute risk across millions of different points
such that, you know, if, if the average individual has a, a
failure and, and their self custody gets successfully
attacked, yes, it could be very bad for that individual.
But there's no, you know, ripple effects across the rest of the
ecosystem where, where you, you don't have like one failure
causing hundreds of thousands or millions of people to lose their
money instantaneously. And then you don't have the the
economic pressure, as we talked about earlier of, you know, a
billion dollars worth of liquidity trying to be extracted
from the system as quickly as possible by the attackers.
So LOP, we have a, we have a A. It seems like we have a Casa
user in the chat, so I don't know how to pronounce that.
OP, do you want to give it a go? Psycho Psycho psycho 05 says
Lop. Can we have foundation and cold
cards for signing devices? I haven't used Casa because we
get sent treasors. Yeah, we support both of those
devices and you know, you can either buy them for yourself off
the shelf or it really depends on like which tier you're at.
I think we only really offer the customization of hardware at the
private clients tier if I recall correctly.
But you can you can definitely buy any of our supported devices
and we support the cold card Mark four and the Q both seem to
work pretty well as well as foundation passport.
It just it depends on if you prefer doing the like AQR code
based signing or not. And that can be a bit tricky.
I have you know several articles about multi sig performance
testing of like signing really large data size transactions.
Yeah. And and let me ask you something
else, Lob. So maybe in in the chat, the
supplies right and the reason that I love the cost of product
is again, it makes the whole self custody aspect easy without
sacrificing convenience. And I think you guys have
mastered the UIUI is incredible even has a little haptic tick to
make you feel good when you sign something right.
So and I think that makes it very easy for someone that
perhaps is transitioning from the Fiat standard, the Fiat
matrix to a Bitcoin standard where they're taking self
custody. And it kind of gives them the
same vibe of, oh, this is like a bank, but it's not a bank
because it's self custody. So you guys cover a lot of the
complexities there. What would your pitch be to
Someone Like, You know, like, hey, look, I I already have a
single sig and then I'm using, you know, I'm using a passport,
I'm using a cold card and you know, I'm on I have Sparrow
like, you know, why should I use Casa?
Now look, if you are comfortable with using the totally free
tools that are out there, then go for it.
You know, nothing, nothing that we do can't be replicated by
someone if you put in enough time and effort to do so.
And in fact, like if you want to try to replicate everything that
we've done, I highly recommend that you look up our wealth
security protocol. And that is several dozen pages
explaining all of the threats that we're trying to mitigate
and exactly what steps that and decisions that we made in our
architecture to mitigate those threats.
But really I think a lot of it comes down, as I said earlier,
to convenience, to really providing a very simple user
experience. Like we on purpose, we do not
offer a lot of the more advanced functionality that you can do
with Bitcoin. And that's because we think that
it's actually kind of dangerous, You know, it could be a foot gun
in the hands of an unsophisticated user.
So what we're trying to do is we're trying to build super high
security and cold storage set up that eliminates single points of
failure and is accessible to a non-technical user that you may
not know all of the insurance and outs of the protocol and
security best practices and such.
So what you're really doing is you're saving yourself a lot of
effort of having to learn all of those best practices and put
them into place. But it's certainly possible to
do it yourself. And you know, I think that's one
of the great things about Bitcoin, like you don't need us
to self custody. We're really here to help you
get into the best possible position as quickly and as
easily as possible. A. 100% and but someone who it
learning, learn, I learned self learn multi sigs, specifically
using electron and Sparrow. There's different standards.
People don't realize this, right?
If you don't update your devices, all of a sudden it's
like, wait a second. Oh my God, I can't spend right
there. There's there's a lot.
It's it's a very deep rabbit hole.
Ladies and gentlemen, electron crashes when you like.
There's so many like you know, and that's what I love about
Casa is that you guys make this easy.
You guys make something that is highly complex, easy to use for
the everyday user and of course you guys offer support and all
that stuff. Now my question to you, Lop, is,
so you guys offer a two of three and a three of five.
What happened for anyone doesn't know.
So the two of three you hold, the user holds two of two of the
three keys Casa owns one or not owns, but holds one key.
And then for the three of five, Casa holds one key, the user
holds four. One of the keys is on your
phone, which is backed up to iCloud or the Google equivalent.
And then the the the rest of the three keys the the user, the
user holds. Now, what's really interesting
about the three of five? Is that it actually feels like
you're signing a two of three because the the phone key, it's
like a basically it's like as soon as it's, you know, you, you
put in your phone password with your face or your fingerprint,
it like it signs automatically, right.
So the experience is is very pleasant in in my experience.
And let me let me ask you something lop, So what what
happens if Casa disappears? You know, could, could people
still access their Bitcoin? Like, for whatever reason, the
app is pulled from the from the App Store, You know, something
funky happens, you know, would, could people still sovereign
recover their Bitcoin? Absolutely and because we're not
doing anything proprietary here, we're not doing any sort of like
proprietary multi party computation or should be your
secret sharing or anything like that.
We're doing the you know, native on chain multi sig, which means
that there are many other wallet software out there that supports
the same thing. So, you know, we added wallet
descriptor support last year that makes it really easy to,
you know, export and import the sort of skeleton, you know,
descriptor of your wallet. And you know, you can import
that into like Electron or Sparrow, you know, any, any
other wallet that supports sort of arbitrary complex multi sig
setups. And the first thing that
actually happens when you finish initializing your multi sig
vault with Casa is that we send you instructions for what we
call sovereign recovery. And that's basically, you know,
if Casa ceases to function or exist or, or for whatever is not
working, then you have the your step by step instructions for
how to recreate your wallet and spend your funds without ever
relying upon our software or our infrastructure.
So I say this a lot, but the primary point of Casa is to
eliminate single points of failure, and that includes Casa
itself as an organization. Yeah, and, and you guys do a
very good job at that because I've been in situations where,
and I mentioned this earlier where you know, someone loses
one of their keys on their multi sig setup.
It's incredibly easy to replace you just you you press a button,
a little haptic makes you feel good about losing your key,
sends you an e-mail, you plug in your new device and boom, BOM
Bing. You know, your, your, you know,
your, you know, your wallet is, is good to go without that UI.
You don't know the only way, you know, by trial and error.
And it took me a while and you know, Sparrow wasn't around, but
so I had to learn a lot of this stuff on Electrum and I'm still
an electrum junkie and I love electrum, despite what people
say. OK, it's a great wallet.
But yeah, it it you guys essentially make a very
sophisticated thing incredibly easy to use without sacrificing
security. And it's convenient for people
that want to benefit from multi sig, but again, don't have the
technical capability of technical know how to to to go
down that. Now my question to you LOB as
well is, OK, so let's talk about geographically multi sig,
geographically separated keys, right?
Because I think that is incredibly important, especially
if you're using multi sig. Could you talk a little bit
about that, right, Keeping your keys in different locations and
that obviously helps protect you from, you know, $5 Reg attack,
which we were talking earlier. And there's something that
you've said in the past that really resonated with me and
I've never forgotten it. It will take an attacker just as
much time to spend your Bitcoin than it takes you to spend your
Bitcoin. And that's the way that you
should be looking at it, right? So if it's if it takes you 10
minutes to, you know, sign your big sign a transaction, send
your Bitcoin out of cold storage in your mind, the back of your
mind, you'd be like, it will take an attacker 10 minutes to
send Bitcoin, whatever. But if you know that your multi
sig setup and your keys are geographically separated, so it
takes some couple hours to go, you know, from place A to place
B and etcetera, etcetera, then it becomes a little bit more
complex, right? And then it's not just a, you
know, let me just jump in here and stay a couple hours.
Now it's like, Oh my God, this might take a couple days.
Obviously that raises the risk for the attacker himself.
So it's it's just some some things to talk about.
So can you talk a little bit about that Lop geographically
separated keys for multi sig? Well, yeah, so the name of the
game when it comes to building the best possible multi sig
setup, because multi sig in and of itself is not panacea.
If you keep all your keys at home, then congratulations,
you've introduced a single point of failure to your multi sig
setup. Distributing the keys in as many
different ways as possible is what gives you great strength,
and it actually lets you leverage the benefit of what we
call additive security. It's basically, you know,
strength through diversity. And this is diversity in a
number of different things. You know, you mentioned
geographic diversity, but also you want diversity of like what
devices they're stored on, what are the physical security
protocols around where each device is.
And basically you want all of these things to be different
because when something goes wrong, you want that particular
attack or failure scenario to only affect one of your keys and
not affect all of your keys. And when you're in a more of a,
you know, homogeneous set up, then it's more likely that you
have one weakness that could potentially affect enough of
your keys that either your money gets lost or stolen.
So you're having geographic separation.
Yes. I mean, it's, it's obviously
that's the way to protect against wrench attacks.
But even more commonly, it's just how you protect against
natural disasters and, you know, things going wrong like your
house burning down. We've had clients whose houses
burned down. We've had clients who have been
in flood zones and if, you know, had various types of
catastrophic destruction to their primary residence.
And so having you know, keys in different geographic areas that
are, you know, prone to different types of weather and
natural disaster events gives you some improved, you know,
robustness there. If you want to take it to the
extreme, not just upon like wrench attacks, but upon like
nation states 61O2 seizure style attacks, our most paranoid
clients actually go to the extreme of distributing their
keys in different countries, different jurisdictions that you
do not play nicely with each other.
So that, you know, it's unlikely for A61O2 attack to be able to
reach across borders and be able to, you know, force the turning
over of those keys that are, you know, outside of the reach of
any given justice system. Yeah, love the way guys, this is
all things that you got to think about.
These are all things again, with great power comes great
responsibility. That's what self custody is all
about. Casa makes it incredibly easy.
If you feel intimidated by the the tech stuff, and I'm telling
you, someone who loves computers, the trial and error
that I had to end the mini heart attacks.
No one tells you that, right? The the trial and error of
having to learn this stuff was not a was not a a a walk in the
park. So this is a great way to
especially if if you hold a decent amount of Bitcoin, you
should definitely have it on multi sig like I I can't
recommend that enough. I think a single sig is just
like so it's a terrible idea in so many.
Point of failure right there in the name.
Yeah, exactly. So if you if if you know you've
been a Bitcoin for a while, I highly, highly recommend multi
Sig and Casa makes it incredibly, incredibly easy
without sacrificing security. I want to give a very special
shout out to our guest today, Jamison Lop.
Go check out his blog blog.lop.net.
And of course, go check out Casa.
Go to Casa dot IO slash simply. Of course, today's show was
February 27th, 2025. I'm your host Nico, our guest
today, Lop and of course, my legendary Co host Optimus
Fields. We'll see you guys tomorrow for
a brand new episode of Simply Bitcoin Live.
Today's episode was brought to you by bitcoinwell.com, a
Bitcoin only platform on a mission to enable financial
independence.