Latest / What Bitcoin Did / The Coldcard Disaster: Everything You Need to Know | Lloyd Fournier & Nick Farrow

Transcript

The Coldcard Disaster: Everything You Need to Know | Lloyd Fournier & Nick Farrow · What Bitcoin Did

• 0:00
  The Bitcoiners, these are people all in on Bitcoin.
• 0:05
  You know, they're people with families.
• 0:07
  Like, they're saving all their money in Bitcoin
• 0:09
  and they're doing all the right things.
• 0:11
  They're self-custodieding it.
• 0:12
  And then overnight, it's just gone.
• 0:14
  Like, it is really sad because I look at the chart.
• 0:16
  I can see when, like, when people are buying Mark 3s
• 0:19
  with this corrupted firmware,
• 0:20
  you can see the money starting to go into the insecure wallets.
• 0:23
  The money keeps going up in the Mark 3s
• 0:25
  because people are still stacking.
• 0:26
  They're doing what they've been told, right, to stack sats.
• 0:28
  and they more than doubled the amount of Bitcoin
• 0:31
  in their compromised Mark 3s.
• 0:34
  So it's, yeah, that bit is very sad.
• 0:36
  Years spent stacking on things and it's gone.
• 0:40
  Like, this has hit a lot of people.
• 0:42
  Do we know how much Bitcoin is as of right now?
• 0:44
  1,200-ish people and almost 2,000 Bitcoin.
• 0:48
  Criminals who are focused just on this,
• 0:50
  their skills are there.
• 0:51
  They know what they're doing now
• 0:52
  and they know how to target and they get information
• 0:54
  and they know how to do it.
• 0:55
  Brossnap team, let's go.
• 0:59
  Yeah.
• 1:00
  How are you doing, guys?
• 1:00
  Very good, Danny.
• 1:01
  Thanks for having us.
• 1:02
  Here in Sydney.
• 1:04
  I don't know where...
• 1:04
  In fact, the first place to start, I think,
• 1:06
  is if anyone out there has not heard about this cold card vulnerability somehow,
• 1:12
  probably time to turn off the show,
• 1:13
  move your Bitcoin off a cold card.
• 1:16
  I did a video with Rob Hamilton as soon as this dropped.
• 1:18
  I'll put a link in the description.
• 1:20
  Go watch that and do something about it immediately
• 1:23
  because we're going to get into the details here.
• 1:24
  But let's start with like, when did you first hear about this?
• 1:28
  Lloyd, let's start with you.
• 1:30
  It was in the morning.
• 1:31
  It was just before a meeting or whatever.
• 1:33
  And it was good because I was about to make a point about our feature,
• 1:36
  you know, feature of Frostnap,
• 1:38
  which means we don't have to rely on the device entropy.
• 1:40
  It gets linked in the group chat.
• 1:42
  And I said, yeah, there's something wrong with the cold card.
• 1:43
  I thought it was someone that made some fake cold cards or something
• 1:46
  and gave them out and really know what it was.
• 1:47
  And then after the meeting, it was in full swing.
• 1:50
  It was a complete nightmare.
• 1:52
  And I was transfixed by it.
• 1:53
  Yeah, luckily I am almost always on Bitcoin Twitter,
• 1:57
  so I think I saw it quite early.
• 1:58
  And the first thing I thought was like, this is probably FUD.
• 2:01
  Like I imagined that it was being, you know, over exaggerated.
• 2:04
  Text Rob Hamilton right away being like, is this real?
• 2:07
  And he was like, because I had some funds on a Mark IV luckily,
• 2:10
  but I'd like generate the keys on the device.
• 2:12
  So still vulnerable to a degree.
• 2:14
  And he was like, move them immediately.
• 2:17
  Don't mess around, this is not a drill.
• 2:18
  And I was not with the wallet, so I had to do a phone call,
• 2:22
  managed to get the Bitcoin moved, but like scary times.
• 2:27
  And I don't think we've still digested everything that's happened
• 2:31
  as like a Bitcoin industry yet.
• 2:33
  I don't think so at all.
• 2:34
  I think people are sort of grieving in a bunch of different ways
• 2:37
  without actually sort of having to have time to soak it all in.
• 2:40
  But one thing I was surprised at was how quick the response was actually
• 2:45
  from, you know, some of the big names like Kevin from Liana
• 2:48
  and I think it was Instagibs from, I think he's a Bitcoin core developer.
• 2:52
  I think it could be wrong there.
• 2:54
  You know, they wanted this right away
• 2:56
  and sort of raising the alarm,
• 2:58
  which is quite a risky thing to do as well,
• 3:00
  is you don't want to be the person who raised the alarm
• 3:02
  and then be wrong and then sort of, you know.
• 3:04
  But I think Instagivit's found some proof
• 3:06
  that, you know, once he'd seen what he'd seen,
• 3:08
  he was like ready to pull the trigger
• 3:10
  and say that something's really messed up here.
• 3:13
  Yeah, the thing that sort of surprised me with it is
• 3:15
  it looks like this was found by an AI model.
• 3:19
  But this is viewable code.
• 3:21
  I know it's not fully open source code, but it's viewable code.
• 3:23
  And I know people like you actually look through this code.
• 3:26
  I wasn't. Nick was the one looking through it.
• 3:28
  Oh, really?
• 3:29
  Yeah.
• 3:29
  But like, why was this overlooked?
• 3:32
  Or not found earlier?
• 3:34
  I have my theory about it.
• 3:36
  And I have to put my own hat on, because I didn't look at the code.
• 3:39
  I needed Nick, to be fair.
• 3:40
  Like, this part of the code, Nick didn't look at me.
• 3:42
  He did point AIs at it.
• 3:43
  And why didn't the AIs and the humans?
• 3:45
  Everyone failed.
• 3:46
  And not only that, but like, all the different things failed, you know?
• 3:50
  like all the safeguards for this kind of thing wouldn't happen.
• 3:53
  They had several checks in there to make sure this kind of thing wouldn't happen.
• 3:57
  Tests of the RNG, all the kind of things, those all failed.
• 4:00
  And then all the extra randomnesses also failed, basically.
• 4:04
  And so like, there's just failure after failure after failure.
• 4:07
  So it feels like you're on a different timeline, like it's cursed, basically.
• 4:10
  This kind of outcome.
• 4:14
  But in reality, like it wasn't just bad luck,
• 4:17
  there was some contributing factors.
• 4:18
  So what I think is that the code was actually quite bad.
• 4:23
  So not just this problem, but the code around it was actually very bad.
• 4:28
  And I was surprised because I thought, cold card,
• 4:31
  if you're looking at how this generates randomness,
• 4:32
  the code will just be pristine.
• 4:34
  You know what I mean?
• 4:35
  It's like, I'm going to spend 10 hours doing this.
• 4:39
  Every line of code will be perfect
• 4:41
  and just make total sense to everyone who's reading it.
• 4:44
  And then I started looking at it and it's like red flags everywhere,
• 4:47
  You know, smoke and fire everywhere.
• 4:49
  And like, no wonder people have been emailing them about it,
• 4:55
  doing security disclosures without ever getting actually
• 4:58
  at the thing that caused the problem.
• 4:59
  But just pointing out like, man, what are you doing
• 5:02
  with this randomness?
• 5:03
  Okay, you get randomness from here,
• 5:04
  but then you put this Yasmerang RNG thing,
• 5:06
  which is now like a famous meme RNG because it not a cryptographic RNG It is just a toy RNG basically And it being used in weird ways
• 5:19
  Was this the one that the CTO,
• 5:21
  Peter, it's Peter, right?
• 5:23
  Yeah.
• 5:23
  Is this the one that his other alt pseudonym came up with?
• 5:27
  It didn't come up with it.
• 5:28
  It's been around for a while.
• 5:30
  But it's just some random dude on the internet
• 5:32
  came up with it, right?
• 5:33
  And it's just a toy RNG.
• 5:35
  and it was in MicroPython.
• 5:39
  And so I think, like, Peter Doc Hex was probably working
• 5:43
  with MicroPython and he wanted an RNG over here.
• 5:47
  And so he just sort of copy pasted what's over there.
• 5:49
  Now, MicroPython is not meant for secure applications.
• 5:52
  It's not something, it's like for toys, basically.
• 5:54
  It's literally what it's for.
• 5:56
  And so...
• 5:57
  As someone who knows nothing about, like, actually coding,
• 5:59
  why is MicroPython not the right thing to use?
• 6:01
  Well, you can, you can use it.
• 6:03
  You just have to be extremely careful.
• 6:05
  Like the things that micro...
• 6:06
  I mean, micro-fine-fines,
• 6:07
  it's like make your own IoT device kind of thing,
• 6:09
  I would guess, right?
• 6:10
  It's like for embedded devices.
• 6:11
  It's not for secure embedded devices.
• 6:14
  People would usually write in C or a type-safe language, right?
• 6:17
  So Python is a hobby.
• 6:18
  Like it has a reputation as a hobbyist language, right?
• 6:21
  And MicroPython sort of fits in that vein of being a kind of hobbyist toolkit.
• 6:26
  So you can whip up cool applications really quickly, right?
• 6:29
  So you'd like the beer dispenser at like a Bitcoin conference
• 6:34
  is probably could be built with MicroPython
• 6:36
  with communicating with a lightning wallet or something.
• 6:39
  You could also do a hardware wallet with it.
• 6:41
  Technically, nothing necessarily goes wrong with it,
• 6:45
  but you have to be super careful
• 6:47
  because it creates these layers.
• 6:49
  It's very easy to make mistakes.
• 6:50
  Like it's very easy to forget.
• 6:53
  Actually, there's still like these things called linters,
• 6:55
  which like check that you used variables and stuff
• 6:57
  that you didn't forget anything,
• 6:59
  but it's still very easy in Python to introduce logic bugs.
• 7:05
  I think what we saw in cold card was this layer of...
• 7:10
  You weren't able to trace the program quite seamlessly through the calling.
• 7:16
  And one of the reasons was that it wasn't just Python.
• 7:18
  It was Python stacked on top of C, is my understanding.
• 7:22
  And so most of the bug exists in the C code.
• 7:26
  Okay.
• 7:26
  Okay, but it's not helping that you're trying to finagle it through different layers, right?
• 7:31
  So the C code just does things that no cryptographer would do. Like I said,
• 7:36
  it would be pristine. It would be the most cleanest thing in your code base is how these seeds go from
• 7:45
  right from the hardware to the seed words. And instead, it's like these weird loops where you're
• 7:50
  you're pulling words out and putting into it,
• 7:53
  like pulling words out of a chip.
• 7:56
  It seems like it's using the chip.
• 7:57
  So that's what everyone looks like.
• 7:58
  It all looks like it's using the chip,
• 7:59
  but then it's like randomly mixing with Yassmerang RNG,
• 8:03
  which why would you do that?
• 8:05
  Like there's a very simple in cryptography.
• 8:06
  What you're gonna do is you're gonna take a cryptographically
• 8:09
  secure pseudorandom number generator.
• 8:11
  You're gonna pull randomness out of that true random number
• 8:14
  generator out of the hardware, a lot of it,
• 8:17
  compress it down to a seed for that pseudorandom number
• 8:19
  and just pull out anytime you need randomness,
• 8:21
  just pull out of that pseudo random number generator.
• 8:23
  Okay, that's what you would do as a cryptographer.
• 8:25
  And what was Coldcard actually doing?
• 8:27
  They were going to the chip,
• 8:30
  they were seeding it at the start,
• 8:33
  but then they were putting in Yassmerang RNG,
• 8:36
  and that is not even an RNG.
• 8:37
  That RNG pulls out a single word,
• 8:40
  so it's like 32 bits, integers,
• 8:42
  and its state is very small.
• 8:45
  That's the big problem.
• 8:46
  So the amount of data you can put into that,
• 8:48
  like your secret key, right?
• 8:50
  Because a pseudonym RNG,
• 8:51
  when it's a cryptographically secure one,
• 8:53
  it has a secret key.
• 8:55
  And basically it's like some 32 bytes
• 8:57
  or something of secret data.
• 8:58
  And you pull out as many secret values
• 9:01
  as you want from that thing.
• 9:02
  And the security definition is that no one can distinguish,
• 9:07
  without knowing the seed, the bytes,
• 9:09
  the bits that come out of that
• 9:10
  from a truly random string of bits.
• 9:12
  That's the actual security theoretical definition of it,
• 9:16
  right?
• 9:16
  So this thing doesn't even have a space,
• 9:18
  like the state of it doesn't even have enough input to be secure.
• 9:21
  It's like a few bits, I think it's one word or like...
• 9:24
  32 bits.
• 9:26
  I think it might be 32 bits.
• 9:27
  I think it was 40 bits was the entropy
• 9:29
  that you were getting on a Mark III, I think.
• 9:32
  And from the like analogy for anyone listening that I heard was,
• 9:35
  it's like, that's like a needle in a very, very, very large haystack.
• 9:39
  But like, if it's the proper 256 bits,
• 9:41
  it's like a needle in a million galaxies or something like that.
• 9:45
  Yeah, it doesn't.
• 9:46
  and it double every bit doubles it right so you keep doubling but actually it wasn't it was much
• 9:50
  easier than that it wasn't even uh two to the 40 it was just like two to the 20 something really in
• 9:55
  the 20s of bits uh that's because i i thought also i initially posted out i just got grok or
• 10:02
  whatever just told it like you know like let's start posting about whatever the hell is going on
• 10:06
  here and like get the actual bits of security i thought it's like two to the 40-ish i think blocked
• 10:10
  said something similar around this exact same time and then we found out later now kevin and the
• 10:15
  or the team at Wizards Cydine has actually gone through it
• 10:19
  and figured out what the actual numbers are in this incredible article which sort of restores your faith in Bitcoin a bit because it so people really care about Bitcoin it shows you right And have laid out the thing
• 10:31
  and it's actually only, there's only millions of possibilities, or tens, hundreds of millions of
• 10:36
  possibilities of seed words for all these cold cards. And actually, when you do the maths,
• 10:42
  what they've done is it showed that, and it seems to be empirically verified, and we've seen,
• 10:47
  found people with it is that some cold card users
• 10:49
  got the same seed words.
• 10:50
  So I saw that on Twitter.
• 10:52
  And I don't, like, from what I saw, at least,
• 10:54
  you may have seen something else.
• 10:55
  I don't know if that was true.
• 10:57
  D. Hoddle, who, to be fair,
• 10:59
  has done a really good job at sticking around
• 11:01
  and trying to help people.
• 11:03
  He replied to a tweet that said, like,
• 11:05
  it was a tweet from years and years ago saying,
• 11:07
  like, I got a cold card, generated a seed,
• 11:10
  and it looked like a collision.
• 11:13
  But it turned out the guy had just pressed six
• 11:15
  on his dice rolls a hundred times
• 11:17
  or however many times.
• 11:18
  I've seen a few false flags as well.
• 11:19
  But then I did see one.
• 11:21
  It seemed more legit,
• 11:22
  which was actually a guy.
• 11:23
  He got a cold card
• 11:24
  and it already had some money on it.
• 11:27
  And then he already put money on it.
• 11:29
  He's like, all right,
• 11:29
  I'll just put my money on that.
• 11:30
  And then someone took it.
• 11:33
  It's so unimaginable, right?
• 11:35
  It's like, you know,
• 11:37
  in both directions,
• 11:39
  like if you're the person
• 11:40
  who buys a cold card
• 11:41
  and puts money on it
• 11:42
  and it disappears
• 11:42
  and if you do all the right things,
• 11:44
  like no one is going to believe you,
• 11:45
  even if you're like
• 11:46
  and then
• 11:47
  people even believe you less
• 11:49
  like if you just
• 11:50
  if you say I bought a cold card
• 11:51
  and like it already had money in it
• 11:52
  that's like
• 11:53
  even more unbelievable
• 11:54
  but that's the thing that sucks the most
• 11:56
  is like the people that have lost money here
• 11:57
  are like
• 11:59
  good Bitcoiners
• 12:00
  who have done everything right
• 12:01
  like they've been completely rugged
• 12:02
  by CoinKite in this
• 12:04
  and I think that's why it's hit
• 12:06
  everyone so hard
• 12:07
  and I think that's also why
• 12:08
  we've seen people band together
• 12:09
  in the way that they have
• 12:10
  and try and help people out
• 12:11
  like
• 12:11
  I've had
• 12:12
  a lot of DMs about people
• 12:14
  who've been caught up in this
• 12:14
  The only person I know personally, and I'll only say this because he put out publicly that lost money was Madex.
• 12:20
  But like, this has hit a lot of people.
• 12:22
  Do we know how much Bitcoin is as of right now?
• 12:25
  I know how many people it is.
• 12:27
  So I even know how many.
• 12:28
  It's around 1,200-ish people.
• 12:31
  How do you know that?
• 12:32
  Because I ran the attack just last night.
• 12:35
  So I finally got my clankers to finally just like, you know, run it all.
• 12:39
  Like, put it all together.
• 12:41
  Check, go through, find all the possible seed phrases.
• 12:44
  go and check if the first address or whatever has ever been used.
• 12:48
  Output the public keys from that so I can find them all.
• 12:52
  And so, yeah, it's about 1,200-ish people.
• 12:56
  And almost 2,000 Bitcoin.
• 12:59
  Damn.
• 13:00
  Is that 1,000 people, 1,200 people that have actually had fun sweat
• 13:04
  or that could have fun sweat?
• 13:05
  That's wallets.
• 13:06
  No, that's wallets that got hosed, yeah.
• 13:08
  I mean, some of them got it away.
• 13:09
  This is like the total affected Mark III.
• 13:13
  That ever had a balance.
• 13:14
  that had a balance at that moment.
• 13:17
  It's more people, if you go back to the peak,
• 13:23
  and it's like 2,400 Bitcoin was stored on these devices insecurely.
• 13:29
  So it went down to like 1,900 by the time of the attack
• 13:31
  because people are moving on to newer devices, generating new seeds.
• 13:36
  So that's roughly the numbers we're talking about here.
• 13:39
  It's like 1,000-ish people.
• 13:41
  How many people actually got robbed?
• 13:43
  I'm in the middle of figuring that out.
• 13:46
  I think I have a good heuristic on it.
• 13:48
  Do you know roughly,
• 13:49
  like can you say roughly what you think it is?
• 13:50
  I told my clan to start figuring out that number
• 13:53
  just before this.
• 13:55
  It's probably working.
• 13:56
  Let's see if it's done its job.
• 13:57
  I'll have a look.
• 13:58
  I'll have a look.
• 13:59
  So you actually ran the exact attack
• 14:01
  that the attacker will have done?
• 14:03
  Yeah, I can, I mean,
• 14:04
  the initial attacker was,
• 14:06
  they all did different.
• 14:07
  There's a few,
• 14:07
  I think there's four attackers.
• 14:09
  That's what I think.
• 14:11
  It looks,
• 14:11
  They leave quite like obvious fingerprints on chain, like in the behavior of, you know, do they all sweep all these wallets at once?
• 14:19
  Do they use, you know, a fixed 30 sat per byte fee rate?
• 14:23
  And so you can kind of distinguish, oh, that's like not the same person as, you know, that other attack that we saw.
• 14:30
  If you hold Bitcoin long enough, there's going to come a time when you need some dollars.
• 14:33
  It might be a tax bill, a business expense, life getting in the way.
• 14:36
  But whatever it is, it might come at a time when you don't want to sell your Bitcoin.
• 14:40
  That's where Ledin comes in.
• 14:41
  Ledin lets you borrow against your Bitcoin instead with tiered rates that go as low as 9.25%.
• 14:46
  So you don't have to sell your stack if you don't want to.
• 14:49
  Ledin have operated through every market cycle since 2018 and have originated over $11 billion in loans.
• 14:55
  But the important part for me is the way Ledin handles these loans.
• 14:58
  Your collateral is held in custody and never lent out to generate interest.
• 15:02
  And Ledin's more than just loans.
• 15:03
  Tether Gold is now live alongside your Bitcoin with instant trading across 10 pairs.
• 15:08
  and later this year you'll be able to borrow against gold in the same way that you do with
• 15:11
  Bitcoin. Ledin really is an awesome company. I've used them multiple times. The applications have
• 15:16
  taken me less than 15 minutes and you have the dollars in your account within hours.
• 15:20
  If you want to check out Ledin, go to ledn.io and use the code WBD for 0.25% off your first loan.
• 15:27
  That ledn and use the code WBD If you own a Bitcoin ETF especially if it GBTC you need to listen up Spot Bitcoin ETFs provide price exposure to Bitcoin not direct ownership You can withdraw it you can self it and they charge you a management fee every year to hold it
• 15:44
  Well, Swan recently announced Swan Real Bitcoin Exchange
• 15:47
  and it's ready to use right now.
• 15:50
  RBX is a structured in-kind exchange
• 15:52
  that converts your Spot Bitcoin ETF shares
• 15:54
  into real on-chain Bitcoin.
• 15:56
  It does that without selling on the open market
• 15:58
  and is designed to support a tax-efficient outcome.
• 16:00
  so for example if you hold GBTC you're paying one and a half percent a year in management fees
• 16:05
  for bitcoin price exposure but by swapping GBTC for real bitcoin with RBX you can drop that figure
• 16:10
  as low as zero percent by just holding it in self-custody this is designed in a way that
• 16:15
  maintains your cost basis and in a manner that supports the deferral of capital gains tax
• 16:19
  so if you own a bitcoin ETF especially if it's GBTC you need to talk to swan private about RBX
• 16:26
  today. Head over to swan.com forward slash wbd and book in a call with one of their team.
• 16:31
  That's swan.com forward slash wbd. You wouldn't reuse a bitcoin address so why does your phone
• 16:37
  broadcast the same identifier for life? Every sim has a static id and carriers, ad networks and bad
• 16:43
  actors all use it to track you. The big carriers have been caught selling that data over and over
• 16:48
  again. Cape is America's privacy first mobile carrier. Their identifier rotation feature changes
• 16:54
  your ID every 24 hours so you look like a different subscriber every single day.
• 16:58
  And sim swaps are off the table.
• 17:00
  Your number can't move without a 24-word phrase that only you hold.
• 17:04
  There's also no name at sign up, no social security number, and there's no profile to
• 17:08
  build on you.
• 17:09
  If you're a Bitcoiner in America, I honestly don't know why you'd use any other network.
• 17:13
  You can head over to cape.co forward slash WBD and use the code WBD for 33% off your first
• 17:19
  six months.
• 17:19
  that's c-a-p-e dot co
• 17:22
  forward slash w-b-d
• 17:24
  so i know the first attacker
• 17:26
  was basically moving everything
• 17:27
  into one like pooled wallet
• 17:29
  yeah
• 17:29
  and none of those bitcoin moved
• 17:31
  so he was
• 17:32
  he got the vast majority right
• 17:34
  i think he was over a thousand bitcoin
• 17:35
  i believe so yeah
• 17:36
  is the rumor that they
• 17:38
  think he used some sort of like
• 17:40
  paid on-chain heuristic website
• 17:42
  that was kyc
• 17:44
  is that true do you know
• 17:45
  oh i've not heard that rumor
• 17:46
  i've heard the rumor
• 17:47
  maybe
• 17:48
  could be
• 17:48
  It'd be good to figure that out.
• 17:50
  I guess it doesn't necessarily mean it's the correct KYC information.
• 17:52
  Like a blockchain, like, you know, data provider.
• 17:56
  Yeah, exactly. Yeah. But I mean, he could also just...
• 17:59
  You really didn't need to. That's what I can tell you.
• 18:00
  You don't need to do any of that stuff.
• 18:02
  Especially if it's Bitcoin, you can run your own node.
• 18:04
  The guy probably wasn't a big investor to run his own node.
• 18:08
  You know what I mean? Why would he invest that?
• 18:10
  Also, you're in the time limits. Like, I've made it.
• 18:14
  You know, I can buy a small island now or whatever.
• 18:16
  so let me just take what I've got.
• 18:19
  Yeah, he took about half of it.
• 18:20
  That's what I see.
• 18:21
  So he's like, there's around 2,000 there,
• 18:23
  and he took about 1,000 on the first,
• 18:26
  and just in like a few blocks, and it's gone.
• 18:29
  And then actually nothing happened for like,
• 18:33
  you know, 16 hours or something.
• 18:36
  And then Kevin posted, and then nothing happened.
• 18:41
  Actually, people didn't start moving their funds right away.
• 18:43
  It was only when CoinKite, actually,
• 18:45
  as soon as CoinKite put out their advisory thing,
• 18:49
  it all just started happening.
• 18:51
  Yeah, that's what the chart shows.
• 18:53
  I don't know if the timing is coincidental or whatever,
• 18:55
  but people are getting…
• 18:57
  They admitted it at 6.50 New York time.
• 19:03
  People are getting home from work or whatever.
• 19:05
  It's all happening at that moment.
• 19:06
  And then really things start moving.
• 19:08
  And then another attacker hits them.
• 19:11
  And then 12 hours later, another attacker hits them.
• 19:14
  So the attackers came in small bursts, actually.
• 19:16
  I think there were four of them.
• 19:18
  Interesting.
• 19:19
  And so tell me how hard it is to run this attack.
• 19:22
  Are you assuming you did this with Kimmy K3?
• 19:25
  No, actually, I did it with Claude.
• 19:28
  I am in the security, whatever, cyber security program.
• 19:31
  Maybe not for long.
• 19:34
  But I did, like, I put safeguards in that I never get the seed words.
• 19:38
  I only ever get, only outputs me the public descriptors.
• 19:42
  Oh, nice.
• 19:42
  Okay.
• 19:43
  And so it was willing to go along with that,
• 19:44
  and Codex went along with it as well.
• 19:46
  Did any of them still have money in it?
• 19:49
  Yeah, but like the crap, like James OB has been like,
• 19:52
  putting test ones.
• 19:53
  Yeah.
• 19:54
  I think no one's going, there's no money there,
• 19:55
  so there's no point.
• 19:57
  There's still, there's tiny amounts of money.
• 19:59
  We could probably pay for dinner tonight if we took it all right now.
• 20:01
  Let's not do that.
• 20:03
  Tell me how hard it is to actually run this attack.
• 20:07
  Especially for someone like me who, I can't do any coding.
• 20:09
  Like, could I still have done this?
• 20:11
  Yeah, you could have.
• 20:12
  Yeah, it does look like it was someone who ran Kimi.
• 20:15
  I do think it was Kimi, so I do not think it was an insider attack.
• 20:17
  Yeah.
• 20:18
  I think it was someone who said,
• 20:19
  let's just throw it at these hardware wallets
• 20:21
  and had the gall to, you know, go at the cold card,
• 20:24
  the great, most secure hardware wallet of all time,
• 20:27
  and say, you know, go look at the entropy.
• 20:30
  They must have, like, because they would have,
• 20:32
  usually you would clone, like, the latest version, right?
• 20:36
  So in the latest version, it's not as bad,
• 20:37
  but they probably would have found the problem and said,
• 20:40
  Okay, so how bad is the problem across all these different versions?
• 20:42
  And then you would have found the Mark III is complete catastrophe.
• 20:46
  And then you say, like, let's write something to find these
• 20:50
  things and spend them, and the code was...
• 20:55
  I mean, it got half of it.
• 20:56
  It could have got too much more.
• 20:58
  And I think they made mistakes.
• 21:00
  Like, I think, I believe one of the issues was that it was going through
• 21:04
  the potential private keys, and if there was a gap, it was then stopping.
• 21:08
  Yeah.
• 21:08
  Yeah.
• 21:09
  Yeah.
• 21:10
  But, like, if it was me doing this, I put Kimmy on the case.
• 21:15
  Could I have spun something up in like a few hours and exposed this vulnerability?
• 21:19
  i don't think i'm thinking about you're doing a lot of research into like asking like models
• 21:26
  prior to kimmy whether those models like the ones when i was looking for this kind of bug whether
• 21:32
  those models at that time could have found it and you sort of came to conclusion that not really
• 21:37
  like opus and these other models they were not not not at the time like before at the time you
• 21:43
  were looking by the time that the attacker was looking, yes.
• 21:45
  Because Kimmy K3 was there.
• 21:47
  So, yes.
• 21:48
  So, I think, I don't know how, like, the thing is, you probably want to use the GPU.
• 21:54
  Okay?
• 21:54
  You can, but you can, if your laptop has, like, the special instruction for SHA-512,
• 22:01
  which is the real time-consuming thing that needs to be done over the password derivation
• 22:05
  thing in BIP39, which has, like, this password derivation algorithm, I think you can do it.
• 22:10
  I was looking at how long it would take my laptop,
• 22:14
  and it would take the whole day or something.
• 22:20
  No, it would take a half a year.
• 22:21
  At my original estimates, it's 2 to the 40.
• 22:24
  But now it's 2 to the 20.
• 22:24
  That's a million times easier.
• 22:25
  So I don't think it would take very long at all, actually.
• 22:27
  Now I think about it.
• 22:28
  So if you're using, yeah, you would be able to do it
• 22:30
  in a very little time.
• 22:31
  Sweep the space.
• 22:34
  And that wouldn't get you everything,
• 22:35
  because there's also how many times people click buttons.
• 22:37
  There's all kinds of little finesse things you have to do.
• 22:39
  But it's got the real low-hanging fruit.
• 22:42
  And to get the low-hanging fruit,
• 22:43
  it was like 1,000 Bitcoin.
• 22:44
  Yeah, you can do it on your laptop.
• 22:46
  Crazy.
• 22:47
  It's crazy that this was just looked over for so long.
• 22:50
  This was out in a while for five years.
• 22:51
  It's nuts.
• 22:52
  It's absolutely nuts.
• 22:53
  Yes.
• 22:53
  And that is a reason.
• 22:56
  That is a real fault.
• 22:57
  Like, whatever you say,
• 22:58
  that is a fault on behalf of CoinKai.
• 23:00
  Because I think it could have been...
• 23:01
  I think people...
• 23:02
  There was so much smoke around it,
• 23:05
  including people getting the wallet of someone else.
• 23:06
  It seems to be.
• 23:07
  Maybe those were all like, you know, people...
• 23:09
  I mean, still, listen, if you've got a feature,
• 23:13
  people get rugged on it.
• 23:15
  Don't have that feature.
• 23:17
  Or do it, because you could put in one dice roll, right?
• 23:19
  So people are coming like, I lost my money.
• 23:21
  And there's, oh, it's just another, you know,
• 23:22
  he comes in and says, oh, I lost all my money.
• 23:24
  It's like, oh, it's just another guy who put in one dice roll.
• 23:26
  Yeah.
• 23:27
  Because we let, but if you-
• 23:28
  And I think that gets to like,
• 23:30
  and many people have said this since,
• 23:31
  but I think that gets to the sort of arrogance of CoinKite.
• 23:34
  They were widely regarded, I think,
• 23:36
  as the best Harlow wallet before this happened.
• 23:38
  And I think they had believed their own hype with that.
• 23:41
  And maybe they felt they were too, you know,
• 23:43
  this couldn't happen to them.
• 23:45
  It must be.
• 23:45
  Yeah, I think, and maybe a distraction on like all the,
• 23:49
  you know, away from the fundamentals of what's most important
• 23:52
  and onto some of the more fancy features.
• 23:54
  Yeah.
• 23:55
  You know, that distraction and takes away the time
• 23:59
  from really like making sure the really...
• 24:01
  Which is insane.
• 24:02
  All you really need.
• 24:03
  The critical thing, yeah.
• 24:03
  All you need from it is three things.
• 24:05
  You need it to generate good entropy,
• 24:06
  sign transactions and store your private key.
• 24:09
  That's really all you need to do.
• 24:11
  And it failed at the most key fundamental one of those three things.
• 24:14
  Though it is true, if you're a developer,
• 24:16
  you put in the safeguards, you believe that was correct.
• 24:21
  You're not going to randomly revisit it.
• 24:23
  Except when people complain they lost their money.
• 24:25
  That's when you should be revisiting
• 24:27
  and people are sending you things about Yasmerang RNG
• 24:29
  in your security disclosure and saying,
• 24:32
  what are you doing with this Yasmerang RNG
• 24:33
  anywhere near any of this stuff?
• 24:35
  Like, that should have been, let's say, to take another look at this.
• 24:37
  But should they not have been having audits on that code?
• 24:40
  Especially the key parts of the code, every, like, six months or something.
• 24:43
  I don't know. I don't know how this works.
• 24:45
  It's a new question. Audits are an interesting one.
• 24:48
  We probably have a lot to...
• 24:49
  In retrospect, if I was...
• 24:52
  Yeah, but people in the community did order it.
• 24:55
  And James OB audited it.
• 24:57
  And you can bet that Ledger Donjon,
• 24:59
  I bet they looked, you know, through that code.
• 25:02
  Maybe not through that exact code,
• 25:03
  But you know, they would have looked through the hardware, TRNG, surely.
• 25:06
  You would have thought so.
• 25:07
  Maybe. You would have thought so.
• 25:08
  But it is very easy to get fixated on a certain thing.
• 25:12
  Because I had the cold card firmware.
• 25:13
  And I was planning to do a little attack on it.
• 25:16
  I was planning to do Dark Skippy on the cold card.
• 25:19
  Because we'd done it first on…
• 25:20
  For education purposes.
• 25:21
  Yes, of course.
• 25:22
  Yeah, and I was going to tell NVK about it and all that stuff.
• 25:25
  You know, to tell him it's coming.
• 25:27
  To demonstrate for educational purposes,
• 25:30
  to show that it doesn't matter how many secure elements
• 25:33
  you have on the thing.
• 25:34
  If it's got malicious firmware on the main chip,
• 25:36
  it doesn't matter what the secure elements do.
• 25:38
  Because when we did it on the seed signer,
• 25:40
  what we found is people like,
• 25:41
  oh, yeah, luckily I use secure elements.
• 25:43
  Nothing to do with that, actually.
• 25:45
  And so I had the firmware there,
• 25:47
  and I was fixated on how to deploy my malicious firmware
• 25:51
  onto the cold card,
• 25:52
  which I managed to do thanks to the charlatan,
• 25:55
  a Bitcoin Core developer,
• 25:56
  who also pointed out problems in cold card security not this problem but other problems and was dismissed And he pointed out this one And I thought oh I can use that to do Dark Skippy
• 26:07
  So I was like, I had the code there and, you know, whatever.
• 26:10
  And I didn't look at anything to do with RNGs.
• 26:12
  Of course I did.
• 26:12
  Because I was too, I was, of course,
• 26:14
  that's not going to, that's going to be correct, right?
• 26:15
  Yeah.
• 26:16
  I also don't want to look at a bunch of Python either.
• 26:18
  And see how it all links together.
• 26:20
  It's like, and people looked at it
• 26:22
  and they didn't catch the most basic thing.
• 26:23
  Like all this mess of pseudorandomness.
• 26:27
  was a mess and it was bad and it should not have been in the cold card itself.
• 26:31
  But that chip RNG was not from the chip.
• 26:36
  That was the whole real, you know?
• 26:38
  It was bypassing the actual chip.
• 26:39
  It was not even used. It was all a circle jerk of cryptography.
• 26:43
  Like all these different operations done on no randomness at all.
• 26:46
  Just going round and round of nothing, right?
• 26:49
  So that no one expected that.
• 26:50
  I mean, it's so hard to think that that would be real if you were a reviewer, right?
• 26:53
  Yeah. Yeah.
• 26:54
  I mean, for someone like me, I just assumed, like,
• 26:57
  randomness on the cold card would be elite.
• 26:59
  Like, that's just...
• 27:00
  Absolutely.
• 27:01
  Absolutely.
• 27:01
  So I do want to come back to the dark, skippy thing.
• 27:03
  But before we do, on the Mark 4s, 5s, and Qs,
• 27:07
  there was better entropy, but not great entropy.
• 27:09
  Yeah.
• 27:10
  I've not seen any reliable source that any of those have been cracked yet.
• 27:14
  Do you know where that's at?
• 27:15
  Yeah.
• 27:15
  I think that Kevin's analysis here is good.
• 27:19
  So, I mean, not Kevin, Wiz and Sardine,
• 27:20
  because he has a whole team there, and they're really good.
• 27:22
  and their analysis shows that actually it's really hard to do the Mark IV.
• 27:26
  I was initially, that's what I thought.
• 27:29
  But then I started seeing that the people were saying that the timer,
• 27:32
  they also add entropy from the timer.
• 27:34
  And I started seeing that that wasn't done at all correctly.
• 27:37
  And in fact, on the Mark III, there is nothing from the timer.
• 27:40
  Actually, the timer value get read in,
• 27:43
  but it's basically irrelevant
• 27:45
  because one of the timers was not set up.
• 27:49
  So on the Mark IV, it was set up.
• 27:51
  and so you get some entry from the timer.
• 27:52
  And so that plus the actual, and this is a massive red flag.
• 27:56
  How do you improve it in the Mark IV and not just totally fix it?
• 28:00
  Like, how the hell does that even happen?
• 28:03
  Say it again.
• 28:04
  How do they improve the Mark IV without fixing it?
• 28:07
  You know what I mean?
• 28:07
  How do you just get 132 bits in there instead of fixing the whole thing?
• 28:11
  Slightly better.
• 28:12
  How do you make it slightly better?
• 28:13
  Is that easily explained in the sense that I think,
• 28:16
  is it right that the Mark IV had an extra secure element?
• 28:19
  Does that do something?
• 28:20
  It was from, so the randomness from secure elements
• 28:23
  is not used in the Mark III in this pathway.
• 28:26
  The randomness from the secure elements
• 28:29
  was used in the Mark IV.
• 28:30
  Yeah.
• 28:31
  In this, but once again,
• 28:32
  for some reason, this randomness is taken from it
• 28:35
  and passed through this thing called Yasmerang RNG,
• 28:37
  which doesn't allow much data into it,
• 28:39
  because it's not a cryptographic secure.
• 28:41
  And so you only got 32 bits in there,
• 28:42
  which is like, what the heck?
• 28:44
  And so that's why you got 32 bits.
• 28:46
  it reseeded from these secure elements,
• 28:50
  but they have much more randomness than that in them.
• 28:52
  And you just pull out like this tiny, a little bit,
• 28:55
  and then it improves it.
• 28:56
  But it actually, in the end,
• 28:58
  like it is much harder to do the Mark IVs.
• 29:00
  You can do it though.
• 29:01
  And presumably those will happen.
• 29:02
  Like there's plenty of compute out there in the world right now.
• 29:04
  Yeah, if it keeps going, like you would think...
• 29:07
  I guess maybe everyone's moving their funds quicker.
• 29:09
  I think that's the thing.
• 29:10
  Because there are people moving it too fast.
• 29:12
  Maybe if someone's lost their pin
• 29:14
  and they didn't write down their passphrase,
• 29:16
  like something will be there for a while.
• 29:19
  In 10 years, when GPUs are just like falling out of our ears,
• 29:21
  we'll be able to like find those funds.
• 29:23
  But it's pretty, it's not economical.
• 29:26
  I thought it was because,
• 29:29
  but only the Mark III is economic to all attack.
• 29:31
  I don't believe the Mark IVs
• 29:32
  are actually profitable to attack right now.
• 29:34
  Okay.
• 29:35
  Unless Sailor's putting all his money on one of them
• 29:37
  and then it changes the average.
• 29:38
  I don't think he is.
• 29:39
  One of the things that's so messed up about this situation
• 29:42
  is even if they'd have found the vulnerability
• 29:44
  or someone else in the community had.
• 29:46
  There was really nothing they could do.
• 29:47
  Like, they would have had to put out a blog post, I imagine.
• 29:50
  I can't think of another way around it,
• 29:51
  saying, these are not secure, you need to move your funds.
• 29:54
  And then it's basically a race against an attacker then.
• 29:56
  To find it, yeah.
• 29:57
  I think you have to just literally call up
• 29:59
  every single person that you know.
• 30:01
  But they don't have the data on people.
• 30:03
  I mean, it turns out they manage to keep emails.
• 30:05
  Every Bitcoiner knows another Bitcoiner,
• 30:07
  and you just do word of mouth it.
• 30:09
  Yeah, you word of mouth it for a while,
• 30:11
  and don't tell anyone shady about it.
• 30:13
  That's the only way.
• 30:15
  I was originally thinking,
• 30:17
  and other people were thinking,
• 30:18
  that because there was this weird thing
• 30:19
  with the serial number
• 30:20
  from the individual device
• 30:23
  got mixed into the randomness,
• 30:25
  that when you recover,
• 30:26
  you can sort of see part of the serial number,
• 30:28
  but you actually can't.
• 30:29
  So that was an initial thing
• 30:30
  that many of us thought
• 30:31
  we could keep these serial numbers,
• 30:32
  and then you could actually
• 30:33
  get people to make a video,
• 30:34
  like, I've got this cold card,
• 30:36
  and show the serial number,
• 30:37
  and you could actually give it back to them.
• 30:39
  Prove that you owned that.
• 30:40
  Yeah, but in the end,
• 30:41
  So that's why people were telling people
• 30:42
  not to actually destroy them.
• 30:43
  Yeah, that's the reason why it doesn't really work.
• 30:45
  Kevin has convinced me that this was crap.
• 30:48
  His article destroys the idea.
• 30:50
  So you can burn the call cards.
• 30:51
  There were lots of duplicates, right?
• 30:52
  Lots of call cards have the same damn thing,
• 30:54
  the same damn number.
• 30:56
  I mean, that's a red flag on his own.
• 30:57
  I don't understand.
• 30:58
  It's called a serial number.
• 31:00
  Why is it?
• 31:00
  It's not serial.
• 31:01
  Serial means one after the other, anyway.
• 31:05
  It's such a mess.
• 31:06
  And one of the things,
• 31:07
  I was at the Bitcoin meetup in Brisbane last week,
• 31:09
  and obviously entropy was the topic of the day and we were talking about it And before this attack I would imagine the vast majority of at least like I guess part
• 31:20
  Bitcoin. People who just store their money in Bitcoin, they don't care about it, they're not
• 31:22
  listening to every Bitcoin podcast, probably never even heard of entropy when it comes to, like,
• 31:25
  generating a private key. And everyone at that meetup was convinced that everyone rolling dice
• 31:31
  is the only way forward. And I just can't accept that. Like, I think it's great. I think people
• 31:35
  should be able to generate their own entropy. I would never want to take that away from people.
• 31:38
  But you also can't expect this to scale to millions and millions and millions of people
• 31:42
  if everyone's doing 100 dice rolls.
• 31:44
  And I think there's also the problem that I know there was at least one person,
• 31:47
  I'm not going to dox them,
• 31:49
  that was at that meetup who had set up a cold card Mark III
• 31:52
  and done dice rolls, but instead of actually rolling dice,
• 31:55
  had just pressed random numbers.
• 31:57
  And like, so people are going to accidentally generate less secure private keys
• 32:01
  if they don't do this properly.
• 32:02
  And so I just, I don't know how we're meant to address this as Bitcoiners now,
• 32:06
  where it's like, generating your own entropy is great.
• 32:09
  People should be able to do it.
• 32:10
  But we also need to accept that that's not going to be the case.
• 32:13
  Like, how good are actual proper random number generators
• 32:17
  on the Trezors, the Ledges, the Bitkeys,
• 32:19
  like all the other hardware wallets that are out there right now?
• 32:22
  I'd say they're fantastic.
• 32:23
  Actually, one of the things humans are good at
• 32:25
  is actually making these high-precision microcontrollers
• 32:28
  and these instrumentations.
• 32:30
  We're not good at politics, economics,
• 32:31
  or any of these other things right now.
• 32:32
  We can damn cut a little silicon thing
• 32:34
  and make these little microelectronics.
• 32:37
  So the randomness is good.
• 32:40
  You have to read the manual a bit on them still.
• 32:43
  But yeah, you can,
• 32:46
  I don't want to say you can trust them,
• 32:48
  they function with overwhelming probability
• 32:51
  in your particular device.
• 32:53
  Now, does that mean what people are thinking is like,
• 32:56
  they're right.
• 32:57
  Why would I just trust?
• 32:58
  Like, I've got this device, right?
• 33:00
  I've taken my funds off the exchange.
• 33:02
  So, because I don't want to have a trust of the third party
• 33:04
  custody of my money and then i put on this device but then what's to stop those seed words i get from
• 33:10
  that device like living in an excel spreadsheet on some guy's computer like how do i fundamentally
• 33:15
  know that that's not the case and the point is you do not and that there's so hardware wallets
• 33:22
  are trusted third parties unless you're dice rolling oh well yeah i mean that's that's there's
• 33:29
  the nuance right and if they're doing it properly which is the yeah this is one of the things we're
• 33:33
  concerned about is that um because of the sort of uh how this one bug manifested the sort of the
• 33:41
  lesson that most people have learned is that if you add your own entropy then you're good if you
• 33:46
  roll dice you're good or add passphrase you're good yeah um but like it could have very well
• 33:51
  been the case that this there could have been you know a very similar bug that it just so happens
• 33:56
  that if you add dice rolls maybe that you know sets your entropy to just being like you know
• 34:01
  maybe a few dice rolls or something.
• 34:03
  It could have made it worse, right?
• 34:04
  Rolling dice could have made it worse.
• 34:05
  Some people suspect that Doc Hex
• 34:07
  was doing a malicious rug pull, right?
• 34:09
  I do not think so.
• 34:12
  Mainly because of how, if I was to do that,
• 34:15
  you know, I wouldn't make the code so bad around the RNG.
• 34:18
  It's like, it's a weird strategy
• 34:20
  to like draw all this attention
• 34:21
  to how terrible that thing is
• 34:23
  just so they sort of notice the main,
• 34:24
  don't notice the main problem, right?
• 34:26
  And I think I've met the guy also
• 34:29
  and it's like had a little conversation.
• 34:30
  It doesn't seem like it at the time.
• 34:34
  I found that whole theory hard to believe,
• 34:36
  although I'm not at the point
• 34:37
  where I'm willing to write anything off.
• 34:38
  Yeah, yeah.
• 34:39
  Yeah, we should be sort of paranoid.
• 34:41
  Like, what if a psycho...
• 34:42
  This is one guy, right?
• 34:43
  He could have been a more psychopathic version of himself,
• 34:46
  right?
• 34:47
  And done this.
• 34:48
  And so all the dice rolling and all the thingies
• 34:50
  doesn't actually do anything in that situation, right?
• 34:54
  Choosing your own seed words
• 34:56
  and giving them to the device,
• 34:58
  How do you know then that the public keys and the addresses
• 35:01
  are actually from those seed words?
• 35:03
  Yep.
• 35:03
  Right?
• 35:05
  It's more steps.
• 35:06
  And like you said, like Bitcoin spreads memetically, right?
• 35:09
  We give it to our friends.
• 35:11
  We see people we respect and they like Bitcoin
• 35:14
  and we want to be like them.
• 35:15
  And if you start saying now,
• 35:16
  this person I respect like breaks the illusion and say,
• 35:18
  now get out your dice and we start doing all this wacky stuff.
• 35:20
  And we need a second device to verify the dice.
• 35:23
  It ruins the process of spreading Bitcoin.
• 35:25
  So you cannot actually be doing this.
• 35:27
  So in our product, we really thought about this.
• 35:33
  We had to think about a lot of things from the ground up
• 35:35
  because we used totally new cryptography.
• 35:37
  And one of the things we said is like, listen,
• 35:39
  we're not going to trust the device to generate randomness.
• 35:42
  I can tell you, it does generate randomness.
• 35:45
  It does have a TRNG on it. It does get the randomness,
• 35:48
  but it's not the only randomness that goes into the public key.
• 35:51
  Okay. Every other architecture is just like,
• 35:54
  let's just take what that device says and then we say, okay.
• 35:56
  We say, okay, and there's the addresses,
• 35:58
  and we just take what the device says.
• 35:59
  We don't take what the device says.
• 36:00
  The device says, here's my public key
• 36:03
  that I want to use sort of thing.
• 36:04
  We say, okay, that's a cool story,
• 36:06
  and we're going to use it.
• 36:06
  We're going to randomize that before it goes on the chain.
• 36:08
  That's the phone or the app that is doing that.
• 36:12
  So that was our solution,
• 36:13
  and it was very comfortable for us in this situation
• 36:16
  because I did have a panic.
• 36:18
  I'm like, how deeply did I look at the TRNG, actually?
• 36:22
  Because I just trusted the manufacturer the APIs that they gave us And like what how does it actually work And I did some analysis and it turns out we okay Not totally it a little bit less
• 36:33
  than I thought it was actually,
• 36:35
  but still way more than you need from the TRNG.
• 36:38
  But I was not panicking while investigating
• 36:40
  because I know-
• 36:41
  It was never a single point of failure.
• 36:43
  It was never a single, exactly.
• 36:45
  So when you plug your devices into your phone,
• 36:47
  the phone is also mixing in randomness verifiably
• 36:51
  to that public key in it.
• 36:52
  The device cannot escape it.
• 36:54
  And so that's one other solution.
• 36:57
  But the thing is, that solution is only our product,
• 37:00
  and it's sort of a niche thing.
• 37:01
  It's very different.
• 37:02
  We're in a position where we're rethinking everything,
• 37:05
  and we're having a lot of fun doing that.
• 37:06
  Not everyone is in a position where they want to go
• 37:08
  and join the next revolution, right?
• 37:11
  And so the problem is taking something like this
• 37:15
  is BIP39, those seed words,
• 37:18
  the actual specification for those
• 37:20
  makes it very difficult for you to mix in randomness
• 37:23
  from multiple different sources.
• 37:26
  Verifiably.
• 37:26
  So it's like one device produces that seed words thing,
• 37:29
  and no one can really get in the way of that and inspect it.
• 37:33
  Because otherwise they'll know the secret, right?
• 37:35
  So when we mix...
• 37:35
  So there's no way of actually proving your randomness.
• 37:37
  Yeah.
• 37:38
  It's like, here's...
• 37:39
  I mean, you can get the randomness yourself
• 37:41
  and say, here's the seed words, right?
• 37:42
  You can do that.
• 37:43
  You can choose your own seed words.
• 37:44
  But that doesn't mean that the XPUB you give
• 37:47
  is those seed words either, right?
• 37:49
  So this is the difficulty thing.
• 37:52
  When you have a malicious device,
• 37:53
  it can say, here's the public key,
• 37:55
  let's receive money to it.
• 37:56
  And you can say, no,
• 37:57
  I'm going to mix into something with that public key.
• 37:59
  The public key is actually algebraic.
• 38:01
  You can add public keys together.
• 38:03
  You cannot add BIP39 entropies together sort of thing.
• 38:06
  That's the issue.
• 38:07
  And so what people will suggest is either like,
• 38:10
  yeah, you have to verify to multiple devices.
• 38:13
  You take the same seed words,
• 38:14
  you look at the XPUBs and multiple devices.
• 38:15
  Okay, that will work.
• 38:18
  You have to expose your seeds to multiple devices then.
• 38:20
  But, you know, if you're very careful about it and it's a one-time thing, it can be done.
• 38:24
  You know, I think the people who say just get a Linux laptop and forget about hardware
• 38:27
  wallets are not, you know, totally wrong in this kind of situation, right?
• 38:32
  Do you want to pay less in taxes and stack more Bitcoin?
• 38:35
  Of course you do.
• 38:36
  Well, by mining Bitcoin with Blockware, you can.
• 38:38
  Under section 168k of the US tax code, Bitcoin mining servers qualify for 100% bonus depreciation.
• 38:45
  This means every dollar you spend on miners can directly offset your income in a single year.
• 38:49
  And it's true for both business owners and W2 earners.
• 38:52
  So if you have $100,000 in ordinary income,
• 38:54
  you can purchase $100,000 in miners and potentially offset your tax liability entirely.
• 39:00
  Blockware's mining as a service does all the heavy lifting.
• 39:02
  They secure the rigs, they source the low-cost power,
• 39:04
  and they handle all the day-to-day maintenance.
• 39:06
  So you get to stack Bitcoin every single day while drastically shrinking your tax bill.
• 39:10
  Get started today at blockwaresolutions.com forward slash WBD and use code WBD for $100 off your first miner.
• 39:18
  That's blockwaresolutions.com forward slash WBD.
• 39:21
  If you're already self-custody Bitcoin, you know the deal with hardware wallets, complex setups, clumsy interfaces, and a seed phrase that can be lost, stolen, or forgotten.
• 39:30
  BitKey fixes that.
• 39:31
  BitKey is self-custody built for real life.
• 39:33
  It gives you an intuitive, easy-to-use wallet with no seed phrase to sweat over.
• 39:37
  and it has a strong recovery system and built inheritance for long-term peace of mind.
• 39:42
  And BitKey's just had a massive upgrade.
• 39:43
  The new device now has a screen.
• 39:45
  So before you approve something, you can check it on the BitKey itself.
• 39:48
  The transaction, the address or any account changes.
• 39:51
  It's a big difference.
• 39:52
  You're not just trusting what's on your phone.
• 39:54
  You're seeing it for yourself on the device.
• 39:56
  It's simple, secure self-custody without the stress.
• 39:59
  Go to bitkey.world today and use the code WBD to get 10% off the new BitKey.
• 40:04
  That's bitkey.world and use the code WBD
• 40:07
  Every Bitcoiner eventually has to answer one question
• 40:10
  If something happened to me, would my family know what to do?
• 40:13
  Could my wife or parents recover my Bitcoin?
• 40:15
  And would my children inherit the Bitcoin that I spent years stacking?
• 40:19
  That's where AnchorWatch builds Bitcoin custody models
• 40:21
  to protect you and your family against real life
• 40:23
  accidents, errors, kidnappings, and even your own death
• 40:27
  Every AnchorWatch custody solution includes their inheritance protocol
• 40:31
  designed so when the unthinkable happens your bitcoin reaches the people you intended it for
• 40:35
  whether you're a self-custody expert or want multi-institutional support your bitcoin estate
• 40:40
  plan shouldn't be an afterthought bitcoin is only generational wealth if it can actually be passed
• 40:45
  down through the generations so make sure they can access in the future what you've built today
• 40:49
  anchor watch is your custody your way visit anchorwatch.com to get started that's anchorwatch.com
• 40:56
  It's hard though, because I do understand those approaches.
• 41:00
  And maybe if you look, like, if your goal is for like,
• 41:03
  absolute perfect security, maybe they're the right way of doing it.
• 41:06
  But you also have to think about everyone in this, like every Bitcoiner,
• 41:09
  and not everyone's going to do these things.
• 41:11
  So like, obviously, there'll be going to be people freaked out about
• 41:13
  everything that's happened over the last few weeks.
• 41:16
  In terms of the other major hardware wallets,
• 41:18
  do you think there's any sort of huge red flags with any of them?
• 41:21
  Cool.
• 41:24
  We've been focused on ourselves.
• 41:26
  we've not been focused on other people.
• 41:28
  I don't think this is a once in a lifetime one.
• 41:31
  Where the actual entry, like the thing on chain,
• 41:34
  all the addresses on chain can just be discovered
• 41:36
  from a guy's laptop in his jack-off chair,
• 41:38
  that's like totally...
• 41:39
  It's totally unbelievable that this happened.
• 41:43
  It's like I still don't almost believe that it happened.
• 41:45
  So this will not happen again, ever.
• 41:49
  Except we already had this happen in Bitcoin, LibBitcoin.
• 41:51
  They actually did this on purpose, but that's another thing.
• 41:54
  They said the TRNGs are not good enough,
• 41:58
  so we're not going to use them at all.
• 41:59
  And so people generated ones that are totally not random at all.
• 42:03
  And so, yeah.
• 42:04
  Yeah, so I don't think the security of those other devices,
• 42:09
  I think everyone's going to be taking a hard look at them.
• 42:12
  I think that the key point that I would make at this point
• 42:15
  is like, are we going to just fix this one outlier
• 42:18
  or just treat it as like a black swan event?
• 42:20
  We're going to say, yeah, actually,
• 42:22
  we should not just get this device in the mail
• 42:24
  and put our life savings on some words it gave out.
• 42:27
  You know what I mean?
• 42:28
  But we also should not roll dice and do all sorts of wacky stuff.
• 42:31
  You know, we should just like say,
• 42:32
  hey, mixing randomness is actually one of the oldest problems in cryptography.
• 42:38
  There's this very old paper called Coin Flipping by Telephone by Manuel Blum.
• 42:43
  It's like in the 1970s.
• 42:44
  It's like explaining how you can have a phone conversation and flip a random coin.
• 42:50
  Like collaboratively.
• 42:51
  Yeah, collaboratively.
• 42:52
  And both of you agree that the coin is random at the end, right?
• 42:56
  And so there's a trick today.
• 42:58
  It's got commitment schemes, use hash functions, things like that.
• 43:02
  It's very much a solved problem.
• 43:05
  But we don't do it in Bitcoin.
• 43:07
  We just don't do it in Bitcoin.
• 43:08
  So there's two things.
• 43:09
  You're going to do all this dice rolling
• 43:10
  and interrogation of the device.
• 43:12
  It's like, I'm going to interrogate this thing so much,
• 43:15
  make it air-gapped and all this stuff.
• 43:18
  But the other thing is,
• 43:21
  I'm just going to get multiple devices.
• 43:23
  So even if I don't really need multi-sig,
• 43:25
  I'm just going to do multi-vendor, multi-sig.
• 43:27
  And so now, I don't have to interrogate each device as much
• 43:30
  because one of the devices,
• 43:31
  or at least the majority of the devices will be okay.
• 43:34
  And these are two solutions, right?
• 43:37
  I think they are solutions.
• 43:39
  If I were to choose either one of them,
• 43:41
  if I really didn't have a reason to use single multi-sig,
• 43:45
  like multi-sig I think is very important.
• 43:46
  That's my whole company does that, right?
• 43:49
  We do it because we shouldn't have your money in your house.
• 43:51
  Not for randomness.
• 43:52
  Randomness is actually a very easy one to do.
• 43:55
  So if I was like an everyday person,
• 43:57
  I would actually consider doing the cutting out of the seed words,
• 44:02
  getting a laptop,
• 44:05
  pulling them out of a hat,
• 44:06
  getting a laptop,
• 44:07
  checking the XPUB is correct,
• 44:09
  taking like some other device and putting it on there,
• 44:12
  checking they have the same addresses,
• 44:14
  clearing it off the laptop.
• 44:15
  And that's sort of like,
• 44:16
  but it's obviously unacceptable.
• 44:17
  Like it kind of,
• 44:18
  you cannot spread Bitcoin that way.
• 44:20
  And the other thing we haven't even mentioned is like,
• 44:22
  if you really want to have this system work
• 44:25
  where you don't trust the device to generate randomness,
• 44:27
  you have to do this dice.
• 44:29
  If you really want to do it properly,
• 44:30
  you have to do this dice rolling
• 44:31
  every time you sign a transaction
• 44:34
  because the device also gets to choose a random number
• 44:37
  as a nonce.
• 44:39
  It's like a one-time throwaway random number.
• 44:42
  And it's in this nonce that if it's weak
• 44:44
  or malicious, it can leak your seed phrase.
• 44:49
  And so that people don't actually dice roll
• 44:51
  to generate these nonces.
• 44:53
  If they really want to do it properly,
• 44:55
  they check what's called deterministic nonces
• 44:58
  that with the same private key and the same message,
• 45:03
  the transaction signatures will be the same.
• 45:06
  So they essentially, they get the transaction
• 45:08
  on two different devices, sign the same thing,
• 45:11
  and then compare the transaction signatures
• 45:14
  and check that, oh, actually, these devices are being honest,
• 45:18
  which is just crazy again.
• 45:20
  Like, you can't do this to spread Bitcoin.
• 45:22
  Totally. It might be the perfect solution
• 45:24
  if you're like only worried about security.
• 45:26
  But if you're expecting 100 dice rolls
• 45:28
  to generate your seed
• 45:29
  and then 100 dice rolls every transaction,
• 45:31
  like the vast majority of people
• 45:33
  are never ever going to do that.
• 45:35
  And the thing that I'm nervous about
• 45:37
  is like this has been a real hit to single SIG.
• 45:41
  And I really like the simplicity of a single SIG wallet.
• 45:43
  And I know obviously if you generate your own entropy,
• 45:46
  then it doesn't really affect it anyway.
• 45:47
  But I do think the sort of just social blowback of this
• 45:52
  is going to be,
• 45:53
  everyone's going to move to multi-seed collaborative custody,
• 45:55
  which are great.
• 45:56
  And people should use those if they're storing,
• 45:58
  you know, their life savings in Bitcoin.
• 45:59
  But the simplicity of single-seed is awesome.
• 46:02
  I don't want to see it go away.
• 46:04
  The sovereignty of it.
• 46:04
  I agree.
• 46:06
  So I used to be a single-seed person,
• 46:07
  but then I realized that my entire life is saying it's my house.
• 46:10
  It gets a bit scary.
• 46:11
  At some point you're like, my children are here
• 46:14
  and all my money's just over there or something.
• 46:16
  And it's like...
• 46:16
  You're traveling.
• 46:17
  It's too much.
• 46:18
  But yeah, if you're traveling,
• 46:20
  if you're a digital nomad or whatever,
• 46:22
  and you reckon you can do it, you're in a safe environment.
• 46:26
  There's something very simple about this USB device or whatever
• 46:29
  that has a PIN number and it's just all my money is there
• 46:33
  and no one can get it without physically getting to me.
• 46:37
  I think it is right for some people.
• 46:39
  And yes, we have to somehow make it work.
• 46:43
  It's just not what our company does, but I'm hoping that some...
• 46:45
  Maybe we can try and do it I don know But I think that like listen the other Okay like I said I said whenever whenever someone I always said like listen our device it doesn we don let them generate their own randomness whether even using one device right The our devices do not generate
• 47:01
  their own randomness by themselves. They mix it in and you can use a single frost snap device and
• 47:06
  it will work. It just doesn't have a pin number. It's designed for geographic distribution, right?
• 47:11
  And I always said, listen, I mean, this is what we say. And this is important. We think this is
• 47:14
  really important.
• 47:15
  This means we don't have to worry about our TRNGs being broken
• 47:17
  or any of that stuff,
• 47:18
  because we know that your phone is also mixing in there.
• 47:21
  So it's very unlikely attacker can control your phone
• 47:23
  and everything else is broken, right?
• 47:24
  It's a really hard gate to get through, as Claude always says.
• 47:29
  But all these companies are fine.
• 47:31
  You know, like, luckily, we have some great companies in Bitcoin
• 47:34
  and you can pretty much just trust them to generate the thing for you.
• 47:38
  It irritates me that we do that,
• 47:39
  because we have so many easy ways to do that in cryptography.
• 47:41
  We don't have to do it.
• 47:42
  But you can just let them do it.
• 47:44
  And now I gave this advice to so many people
• 47:47
  when they're asking me about our product
• 47:48
  and how important this fact is.
• 47:50
  And now I look at it, it's like, obviously, a crucial fact.
• 47:54
  The device now feels like bare minimum.
• 47:55
  It feels like a bare minimum.
• 47:57
  Like, why would you not be doing this?
• 47:59
  So that's where I'm at with that.
• 48:01
  I think that, listen, it is a black swan sort of thing.
• 48:04
  All these other devices are probably okay.
• 48:06
  And I think the silver lining of this,
• 48:08
  it'd be easy to hear this conversation
• 48:10
  and be totally freaked out about the state
• 48:12
  of self-custody, but the silver lining is it's going to get much better
• 48:14
  on the back of this, I think.
• 48:15
  There's going to be more eyes on code.
• 48:18
  Maybe this wasn't an issue for any of the other companies,
• 48:20
  but it's only going to make it stronger, I think.
• 48:22
  Yeah, the open source is important.
• 48:25
  Because now open source, the longer it's been alive,
• 48:30
  the harder that thing is to kill.
• 48:32
  Before, now ColdCard existed in this state of terrible code for a while,
• 48:37
  and now it just killed one of them, right?
• 48:40
  And so the longer these companies stay alive
• 48:42
  and keep their code open source,
• 48:44
  the more surety you have in each of their products.
• 48:48
  Is that a double-edged sword?
• 48:49
  I think there's an interesting thing, actually,
• 48:50
  that also, like, it's not so much that it's the length of time
• 48:54
  that it's sort of, you know, with stored, you know, survived for.
• 48:58
  But, you know, we saw this new model gets released
• 49:01
  and then all of a sudden, overnight, it's no longer secure.
• 49:05
  It's very interesting for us
• 49:06
  because we haven't had these paid audits done,
• 49:09
  but we've had an equivalent level audit
• 49:13
  done to cold card with Kimi K3 now
• 49:16
  and these other...
• 49:18
  The audits are just out in the open now.
• 49:19
  Yeah, which is interesting.
• 49:21
  I don't think it says that there's no value in human audits.
• 49:25
  I think having a good human auditor guide
• 49:28
  that LLM audit would be probably optimal
• 49:30
  but it's very interesting.
• 49:32
  Yeah, it is.
• 49:33
  And it's like...
• 49:35
  The open source thing,
• 49:37
  can that be a double-edged sword?
• 49:38
  because if your source code is closed source,
• 49:43
  then the LLMs can't pass through in the same way
• 49:45
  and they can't necessarily find those vulnerabilities.
• 49:48
  Yeah, I mean, though, I think we all agree
• 49:53
  that the level of trust you put in a closed source thing
• 49:56
  is like, it's a bit, the rug pull could be at any moment.
• 50:00
  Like if DocX or whatever is malicious
• 50:02
  and he's working at Ledger or whatever,
• 50:03
  like it's not really acceptable.
• 50:06
  It doesn't solve the problem,
• 50:06
  but does it make it harder to exploit the vulnerabilities
• 50:08
  Yes.
• 50:09
  I think so, yeah.
• 50:10
  Yeah, it does make it a bit harder.
• 50:12
  Because you're going to…
• 50:13
  Unless you can get…
• 50:15
  You have to…
• 50:16
  Because at some point, you can maybe dump the firmware or something,
• 50:19
  you know, that's on a ledger.
• 50:20
  Because you have the firmware updates and all that stuff.
• 50:22
  Like, I don't know.
• 50:23
  That would be interesting, right?
• 50:24
  Because some people are taking it and going to the machine code
• 50:27
  and decompiling things, right?
• 50:29
  Taking old, you know, PlayStation games they always loved,
• 50:32
  and like, decompiling and putting new things in it
• 50:34
  because the LLMs are so good at that.
• 50:37
  And I wonder if Ledger, that would be a technical question,
• 50:41
  can Ledger, does Ledger fully encrypt their firmware?
• 50:43
  Because I mean, is maybe like compiled binaries
• 50:46
  that you can't see the source code of
• 50:48
  is the same as, you know, or open source in the end.
• 50:52
  So that's the question.
• 50:54
  But you think open source is still the way to be doing all of this?
• 50:57
  Yes, I think so.
• 50:58
  I think that that will, the Darwinian selection process now
• 51:02
  is probably the right one.
• 51:04
  It probably also means you should probably centralize more
• 51:07
  on libraries and things.
• 51:09
  One of the interesting thing about multi-vendor,
• 51:11
  multi-sig and people saying,
• 51:12
  yeah, you know, but the thing is,
• 51:13
  do you really want everyone
• 51:15
  to be using a different software stack
• 51:16
  and like bugs over here, bugs over there?
• 51:19
  It would be like, everyone agrees.
• 51:21
  I think everyone agrees that LibSecP266K1
• 51:23
  is really good
• 51:24
  and that everyone should be using that.
• 51:26
  In fact, moving over to that
• 51:27
  was part of what Coldcard was doing
• 51:28
  when they messed everything up.
• 51:30
  And that was, so if we agree
• 51:33
  that like well-audited single libraries are good,
• 51:36
  then probably people should just use those, right?
• 51:39
  So having all these different implementations
• 51:43
  and different things is maybe not so good.
• 51:45
  I think the seed sign of people are not totally wrong, right?
• 51:49
  In creating like a sort of a standard thing
• 51:52
  that you can create yourself, it's all open source.
• 51:57
  I don agree with the fact that you can just swap out an SD card and steal everyone money with Dark Skippy but you can see the idea there right The idea is correct It just so happens that unfortunately due to the way you know signatures work and stuff like that there you trusting that
• 52:11
  device. So I think that probably more of that, I think standardization on how the hardware should be
• 52:18
  more open hardware and more that those kinds of things is probably the way things are going.
• 52:22
  And to be fair, like the companies in the space are pretty good with that stuff. That's open source
• 52:26
  hardware you can some people can you can create your own jades i think you can create your own
• 52:30
  treasures as well if you really want to and so you have companies that let you just create their
• 52:34
  thing but it's pretty difficult so you can probably just buy it from them it's sort of the business
• 52:38
  model and it's probably not like a huge business also like we're in the business and we don't never
• 52:44
  thought really it was going to be an amazing business because the number of utix owners is
• 52:48
  not going to go grow like incredibly right my 2x 3x 5x or something but uh maybe even 10x but it's
• 52:55
  That's not exponential growth.
• 52:56
  No one's looking at that saying, I need to invest in that.
• 52:59
  So probably consolidates and gets a bit more boring
• 53:02
  around more homogenous software packages
• 53:05
  and things that are more well audited.
• 53:07
  I want my hardware wants to be boring.
• 53:09
  That's everything I need.
• 53:10
  I did a show with the C-Signer guy,
• 53:13
  maybe, I don't know, over a year ago, probably.
• 53:16
  That has aged like fine wine.
• 53:18
  One of the things he was calling out was RNG on things like Coldcard.
• 53:21
  And it wasn't because he had inside knowledge on it or anything.
• 53:24
  He was just saying, these are the problems you have.
• 53:26
  And seed signer has always been one that I've...
• 53:29
  I've never really used a seed signer.
• 53:31
  I've played around with a seed signer.
• 53:32
  The thing I don't like is having to have my private key always there
• 53:36
  to actually sign a transaction.
• 53:37
  But I don't know, this makes me rethink a lot of things.
• 53:40
  Yeah, I mean, I think a lot of people forget, though,
• 53:43
  when they analyze, they're like, I want my PIN number.
• 53:44
  And then they have the piece of words there without any PIN.
• 53:47
  Yeah, yeah.
• 53:48
  Or they put a passphrase on the words,
• 53:50
  because they're thinking about it.
• 53:51
  And then they lose the passphrase, and they lose all their money.
• 53:54
  Back it up.
• 53:54
  It's like, oh, this, the trade, I think you really, like,
• 53:56
  Simplicity and boring sounds great.
• 53:58
  Yeah, with FrostNet, we go, we'd really take it to the most boring extent.
• 54:02
  Our devices do not even have pin numbers.
• 54:04
  Your only way of getting security is to put them in different locations.
• 54:07
  So it's multi-sig pretty much only.
• 54:10
  And there's no pin numbers.
• 54:11
  There's no passphrase on the thing.
• 54:12
  There's no descriptor backups either.
• 54:14
  So that's most multi-sig solutions.
• 54:16
  You actually have to back up some funny digital file.
• 54:19
  And if you don't have that, you lose all your money.
• 54:21
  We don't have that.
• 54:22
  So you just need two out of the three backups or whatever,
• 54:25
  whatever threshold and number you choose,
• 54:27
  and you'll get all the money back and it's all super boring.
• 54:30
  It's very, like, it is a risk.
• 54:32
  The user has a serious job to do, right?
• 54:34
  To make sure their devices and those backups are not obtained by anyone else.
• 54:40
  It usually is a job you have to do anyway.
• 54:42
  But it is a serious job.
• 54:44
  There is no PIN numbers in those devices.
• 54:45
  Those backups are probably with that device.
• 54:48
  But for me, once you do that job, it's, like, really comfy.
• 54:52
  Because there's nothing I need to remember.
• 54:54
  I know my wife can get them because there's nothing she needs to remember.
• 54:56
  She just knows… She has to figure out where…
• 54:58
  She knows the people who have them.
• 55:01
  She knows how to contact them.
• 55:03
  Anything should happen to me.
• 55:05
  There's nothing really that can go wrong in this kind of setup.
• 55:09
  It's really…
• 55:11
  I struggle to think about the things that can go wrong, right?
• 55:14
  That's the… The main thing that go wrong is that someone, you know,
• 55:18
  goes around and finds them, right?
• 55:20
  And so it's really just my job to make sure that no one can find them.
• 55:24
  Exactly.
• 55:24
  I have one job.
• 55:25
  Maybe back on the community, like the ecosystem damage for a minute.
• 55:29
  I think it's, you know, I've seen some people compare it to say
• 55:32
  they're comparing like the magnitude of the theft.
• 55:34
  They're saying, oh, you know, it's only a thousand Bitcoin.
• 55:36
  Look at Mt. Gox or look at FTX.
• 55:39
  I think, you know, these are completely different populations of people.
• 55:42
  Like the FTX people, you know, it's like people in their 20s,
• 55:45
  like degenerate long, like, you know, gambling shit.
• 55:48
  you know they go from 1k to like 100k and then they they lose it okay um the bitcoiners is these
• 55:54
  people all in on bitcoin yeah you know they're people with families like they're saving all
• 55:59
  their money in bitcoin and they're doing all the right things they're self-custodieding it
• 56:03
  and then overnight it's just is gone yep and it's with like probably what was perceived as the most
• 56:08
  sort of hardcore bitcoin a solution like this was the gold standard yeah and that being rubbed i
• 56:14
  think is going to have ramifications for quite a long time.
• 56:16
  And I just,
• 56:18
  the thing that I'm really nervous about
• 56:20
  is this is going to push people to use custodians, which
• 56:21
  it will already have done. There's certainly
• 56:24
  been people that have moved Bitcoin off cold cards
• 56:25
  to, you know, a river,
• 56:28
  a swan, a coinbase,
• 56:30
  whoever. And even if
• 56:32
  those companies are like semi,
• 56:34
  like are reasonable solutions,
• 56:36
  it's not what we want Bitcoin to be.
• 56:38
  No, not at all. And that's the problem.
• 56:41
  On that point,
• 56:42
  like it is really sad because i look at the chart because i can see when like when people are buying
• 56:47
  mark threes with this corrupted form firmware yeah and you can see the money starting to go into the
• 56:51
  insecure wallets and then you can see the mark four come out yeah but the money keeps going up
• 56:56
  in the mark threes because people are still stacking they're doing what they've been told
• 56:59
  right to stack sats and they like more than like double the amount of bitcoin in their
• 57:03
  compromised mark threes even after the mark four is out so it's um yeah that's that that bit is very
• 57:10
  sad years spent stacking on thing and it gone probably the only thing that saved me because I had a Mark III before I had the Mark IV is that I a nerd for light devices So I bought the new one
• 57:23
  That's the only thing that really saved me.
• 57:25
  Otherwise, I would have been one of those people.
• 57:27
  It could have been the other way around.
• 57:29
  It could have been the Mark IV had the problem.
• 57:31
  It's just so random, right?
• 57:34
  Before we go on to the FrostSnap devices,
• 57:37
  can we talk a little bit about Dark Skippy?
• 57:40
  Because I remember this coming up,
• 57:42
  but I'd never followed it very closely.
• 57:43
  Tell me what that attack was.
• 57:45
  It was an improvement on an existing class of attacks
• 57:50
  where a malicious device can choose these random nonces
• 57:56
  it uses during signing.
• 57:58
  And previously, it was thought in the literature,
• 58:00
  maybe a malicious device can leak its seed phrase
• 58:04
  over maybe 50 transactions.
• 58:06
  Maybe each signature has one or two bytes.
• 58:09
  And if you're the attacker,
• 58:11
  you can look on chain and you can sort of grab all these two bytes and if you get enough of them
• 58:15
  you get the the seed phrase um but in a sort of a a game of i guess cryptographer sort of code golf
• 58:22
  uh lloyd and and robin linus were going back and forth on on twitter um a few years ago and uh
• 58:29
  together they essentially figured out you can do it in just uh two signatures so so one transaction
• 58:36
  is enough for a malicious device
• 58:40
  to leak your seed phrase inside the signature itself.
• 58:45
  And this is any device?
• 58:47
  Any device.
• 58:48
  Yeah.
• 58:48
  That's allowed to choose its own random number for its nonce
• 58:52
  and that isn't, you know, that it's acting maliciously
• 58:56
  and you don't check that it's doing deterministic nonces
• 58:59
  or it's not doing an anti-XFIL protocol
• 59:02
  like Jade, Bitbox, or FrostSnap.
• 59:06
  Yeah, so this is why Nick is saying, you know,
• 59:09
  you probably need to roll random numbers during signatures as well.
• 59:12
  There's no API to do that.
• 59:13
  It would be totally insane to roll random numbers,
• 59:16
  but that's the issue, is you can do everything,
• 59:19
  make sure your seed is set up totally trustlessly
• 59:21
  and make sure everything's correct.
• 59:23
  But if I take your seed signer or your cold card
• 59:26
  and I get the malicious firmware on there,
• 59:28
  like, that's still a trusted party.
• 59:29
  How would you get the malicious firmware on there?
• 59:31
  On a seed signer, you literally just take the SD card out
• 59:35
  and you put a different, you put the SD card in.
• 59:38
  You have to have physical access.
• 59:38
  Yeah, so it's like you get physical access to the seed signer.
• 59:42
  Or a much better retirement attack would be to do Dark Skippy, probably.
• 59:46
  If you were a malicious manufacturer, it'd be a much better,
• 59:50
  rather than making weak randomness for the seed phrase,
• 59:53
  it might be a better attack just to say on,
• 59:56
  okay, if this transaction is spending over one Bitcoin,
• 1:00:00
  just fiddle with the nonce a little bit
• 1:00:01
  and exfiltrate the whole seed phrase.
• 1:00:03
  and it's completely covert pretty much
• 1:00:06
  unless they're signing on a second device.
• 1:00:09
  As the manufacturer, it's very trivial to do it.
• 1:00:12
  I guess if you want to try and hide it a bit,
• 1:00:15
  you want to ship it with them if they update firmware
• 1:00:17
  or maybe you want to...
• 1:00:18
  You can still do it.
• 1:00:20
  Even if they try and update firmware,
• 1:00:21
  there's nothing really you can do.
• 1:00:23
  Hardware is just a trusted party.
• 1:00:25
  It's a black box.
• 1:00:26
  You can't really penetrate without x-rays or something
• 1:00:29
  to figure out what it really, really is doing.
• 1:00:31
  but yeah so the problem
• 1:00:34
  the problem is it doesn't matter what you do
• 1:00:36
  it ends up being this trusted
• 1:00:38
  third party and that's the
• 1:00:40
  and it doesn't matter how many secure elements
• 1:00:42
  there are right because what I can do is
• 1:00:44
  if I can change the firmware and even if I'm
• 1:00:46
  like not the company I'm an attacker
• 1:00:48
  I don't have to go through
• 1:00:50
  all these very secure chips I can just go
• 1:00:52
  through the main chip right the main chip
• 1:00:54
  is enough to
• 1:00:55
  if I can change the firmware and this actually
• 1:00:58
  ledger demonstrated this for what it's worth on
• 1:01:00
  Trezor, they went and they changed, was able to change the firmware of the Trezor with the
• 1:01:05
  secure element on it. And so now, the secure element doesn't do anything.
• 1:01:09
  I remember them extracting keys from a Trezor. Is this how they did it?
• 1:01:12
  This is a more recent one. They didn't extract keys, they just changed the firmware.
• 1:01:15
  So they got rid of the secure boot thing, and they just were able to change the firmware. And so
• 1:01:20
  what this means is, yeah, what this attack looks like is someone, crazy person from Ledger comes in,
• 1:01:26
  they take your Trezor while you're on holiday or whatever, and they go into the lab a bit,
• 1:01:30
  and then they put it right back where it was.
• 1:01:32
  They still don't know the secret key at this point, right?
• 1:01:34
  They don't know anything secret on it.
• 1:01:35
  But you put your PIN number and you sign something
• 1:01:38
  and then that gets posted to blockchain
• 1:01:40
  and that signature has the data in it.
• 1:01:42
  Right.
• 1:01:43
  So this is the kind of thing that's very, very difficult.
• 1:01:46
  Stop it.
• 1:01:46
  But this is way further out on the risk curve
• 1:01:49
  that people should be thinking about
• 1:01:50
  because they have to have actual access to your device.
• 1:01:52
  With the devices that you plug into your computer,
• 1:01:54
  could it be loaded by malicious firmware on the computer?
• 1:01:59
  No, no.
• 1:02:00
  You need malicious firmware on the device.
• 1:02:02
  But what I'm saying is,
• 1:02:03
  if it's not an air-gap device and you're plugging it in,
• 1:02:05
  could it then be transferred to the device?
• 1:02:07
  Some devices.
• 1:02:08
  Like, most devices,
• 1:02:10
  I'm talking about not our device.
• 1:02:12
  Most devices need a PIN number
• 1:02:13
  before you can do a firmware upgrade.
• 1:02:15
  So it's kind of like you're in the security model
• 1:02:17
  where you cannot just do it by itself.
• 1:02:19
  But yeah, I mean, if it can be exploited
• 1:02:21
  and it's not signed firmware
• 1:02:22
  and you really don't know what you're doing, yes.
• 1:02:24
  So, like, same with SeedSign.
• 1:02:26
  Like, you could just put an SD card from your computer
• 1:02:27
  or you think it's all good and then bam, it's gone.
• 1:02:29
  But this is like, this isn't actually going to,
• 1:02:33
  we're not going to see this in the wild in the last year.
• 1:02:35
  We hope not.
• 1:02:35
  Yeah.
• 1:02:36
  Well, now that, I mean, now the clankers exist,
• 1:02:38
  like you can just point it at darkskippy.com
• 1:02:40
  and tell it to do it.
• 1:02:42
  But then you could have your actual device.
• 1:02:45
  Or they could release maybe a firmware of, you know,
• 1:02:48
  a device that doesn't check, you know,
• 1:02:51
  that it's signed by a manufacturer.
• 1:02:54
  They make a fake website or a fake GitHub and say,
• 1:02:56
  here, download the latest release.
• 1:02:57
  I see. Okay.
• 1:02:58
  People download that.
• 1:02:59
  and then they're trusting the device to generate that randomness.
• 1:03:02
  Yeah.
• 1:03:03
  Coldcard included, they will check this.
• 1:03:04
  They will not be able to just install random firmware.
• 1:03:07
  There's no FUD there.
• 1:03:08
  They check the secure boot.
• 1:03:10
  Although on ColdCard Mark III, you could because there's a bug.
• 1:03:13
  But other ones, you can't.
• 1:03:15
  And so you would really be...
• 1:03:16
  It's really more the point about this is you're trusting the manufacturer.
• 1:03:20
  It doesn't matter if you do all this stuff yourself.
• 1:03:22
  You're trusting the manufacturer.
• 1:03:23
  Just deal with that reality, right?
• 1:03:25
  I'm trying not to totally freak people out here.
• 1:03:27
  Yeah, yeah, yeah.
• 1:03:29
  I don't think you're doing a good job of that.
• 1:03:31
  Some people think Doc's Hex was like a malicious guy,
• 1:03:33
  and he was playing. So this, he could have done Dark Skippy, right?
• 1:03:36
  It would have been much better to do Dark Skippy in some ways
• 1:03:39
  than what he did, which was like, I mean, if he was,
• 1:03:41
  it was like an incredible galaxy brain, you know, attack.
• 1:03:45
  Because it is so messy, and so it doesn't look at all
• 1:03:49
  like someone was doing it maliciously.
• 1:03:51
  It looks totally like a mistake.
• 1:03:52
  And so I guess if you're very clever,
• 1:03:54
  you can make everything look totally like a mistake.
• 1:03:56
  But yeah.
• 1:03:57
  Okay, let's talk about FrostSnap.
• 1:03:59
  Can I see the device?
• 1:04:00
  I don't think I've ever actually seen these in person.
• 1:04:04
  So tell me how these work.
• 1:04:08
  Yeah, open a few up.
• 1:04:10
  I want to show the camera how they...
• 1:04:12
  I'm not the first person to make the joke,
• 1:04:15
  but it's the human centipede of hardware wallets.
• 1:04:17
  That's right.
• 1:04:18
  You love it or you hate it.
• 1:04:19
  Yeah, you can daisy chain them together.
• 1:04:21
  You daisy chain them.
• 1:04:21
  Tell me how they work.
• 1:04:23
  Yeah, so you want to make a multi-signature wallet.
• 1:04:26
  you just connect a few into them like that and then download the app um on your phone or your
• 1:04:32
  laptop click create a wallet you know give each device a name um and then it'll interactively
• 1:04:39
  generate a uh a group private key that never lives on any one device um so this is that that uh the
• 1:04:48
  phone actually contributes entropy during this step which is what lloyd was talking about before
• 1:04:52
  and at the end of this what's called a distributed key generation you have each device has sort of a
• 1:05:00
  share of this or a key to this wallet and you need say two out of three to spend the money
• 1:05:07
  and so from there you would leave them in different secure locations each device has
• 1:05:13
  its own backup so underneath those tins is a backup recovery card and then yeah you would
• 1:05:19
  leave them in secure locations.
• 1:05:21
  And when you want to sign,
• 1:05:22
  you visit them one at a time.
• 1:05:24
  Oh, so you don't need them all together
• 1:05:26
  at the same time.
• 1:05:27
  Yeah.
• 1:05:27
  Oh, that's cool.
• 1:05:28
  So you, yeah,
• 1:05:29
  you would make your transaction
• 1:05:30
  on your phone or your laptop
• 1:05:31
  and then, you know,
• 1:05:32
  pick which devices
• 1:05:33
  you're going to go and sign on
• 1:05:34
  and, yeah, visit them
• 1:05:36
  and get those signatures.
• 1:05:39
  The really cool thing is, yeah,
• 1:05:40
  it's using threshold signatures.
• 1:05:44
  It's not using, like, script multi-sig.
• 1:05:46
  and this has a bunch of downstream benefits.
• 1:05:50
  It looks like a single SIG on chain,
• 1:05:52
  which is really nice.
• 1:05:54
  No one can tell you're using a multi-SIG.
• 1:05:55
  What's the benefit of that?
• 1:05:57
  Well, it's a very strange feeling
• 1:06:00
  when you pay someone in Bitcoin
• 1:06:01
  from a multi-signature
• 1:06:03
  and you reveal that
• 1:06:05
  they can look your transaction up on chain
• 1:06:07
  and say, oh, Nick's using a four out of five
• 1:06:09
  or he's using a three out of five.
• 1:06:11
  And you shouldn't have to reveal this information
• 1:06:14
  when you're spending.
• 1:06:15
  Because you're just giving away something about your setup.
• 1:06:17
  It's your security setup.
• 1:06:18
  Yeah.
• 1:06:18
  It's a bit crazy.
• 1:06:19
  That's just one of many, many issues with it.
• 1:06:23
  Like, there's the privacy heuristics on chain,
• 1:06:26
  you know, much more easier to do when there's,
• 1:06:29
  you know, this script is very easy to follow.
• 1:06:32
  And this uses Frost, which I don't really know what it is.
• 1:06:35
  Can you tell me about Frost?
• 1:06:37
  Yeah.
• 1:06:38
  So it's maybe some people heard Shamir's secret sharing.
• 1:06:41
  Yeah.
• 1:06:41
  Maybe like one in three people listening to that show
• 1:06:43
  Shamir's secret sharing.
• 1:06:44
  Which is essentially where you break a private key up into three pieces
• 1:06:46
  and spread them.
• 1:06:47
  Yeah, and two out of three of them can spend,
• 1:06:49
  or whatever you choose, right?
• 1:06:52
  Trezor, for example, does this for backups.
• 1:06:53
  You can do that. I don't think many people do do it,
• 1:06:55
  but it's a cool feature.
• 1:06:56
  I think Ledger can do that as well, right?
• 1:06:58
  Oh, there was a...
• 1:07:00
  That was the backdoor thing that everyone was upset with them about.
• 1:07:03
  Which I don't think was actually a backdoor, but...
• 1:07:04
  No, but it wasn't a real backdoor.
• 1:07:06
  It was up-did, right?
• 1:07:07
  So it wasn't like instant backdoor.
• 1:07:10
  But yeah, they would split it up across different places.
• 1:07:13
  and so same tech
• 1:07:15
  I mean it's the same tech
• 1:07:16
  that is used in Coinbase custody
• 1:07:18
  to secure Michael Saylor's funds
• 1:07:20
  different computers have different shares of the key
• 1:07:23
  and you need three
• 1:07:25
  you need to corrupt like three out of five of them
• 1:07:27
  or whatever to actually steal the money
• 1:07:29
  so one location is not going to be enough
• 1:07:31
  and so the way
• 1:07:33
  the way it works is
• 1:07:34
  you mathematically split up the secret key
• 1:07:36
  and then our devices when they sign they don give a signature actually they give a Shemir secret share of a signature Okay And then the phone is actually taking those Shamir secret shares of the signature and turning them back into an actual signature
• 1:07:49
  And that goes on chain.
• 1:07:50
  That's why there's one public key and one signature.
• 1:07:53
  Now, the real...
• 1:07:55
  Like, Nick mentioned several of the benefits,
• 1:07:56
  but the real killer benefit for me,
• 1:07:58
  like the life-changing benefit,
• 1:08:00
  is there is no descriptive backup.
• 1:08:03
  So you take that foot gun out of the equation.
• 1:08:04
  Yes.
• 1:08:05
  That's what scared me off doing script multi-seg.
• 1:08:07
  Like when I learned about, you know, I was fully ready to go script multi-sig for my own, you know, setup.
• 1:08:13
  And then I learned about this descriptor backup thing on like a Bitcoin stack exchange, like, you know, post.
• 1:08:19
  And I'm like, no way am I doing this.
• 1:08:21
  Like I'd never heard about it before.
• 1:08:23
  It scared me senseless.
• 1:08:25
  It was terrifying.
• 1:08:26
  Yeah.
• 1:08:26
  So I just couldn't imagine my wife with this thing.
• 1:08:31
  Right?
• 1:08:31
  Like this extra bit of information.
• 1:08:33
  Like Frost Snap, what it really is, it's what multi-sig, you think multi-sig is.
• 1:08:37
  right it's got multiple keys and any two out of three of them can spend the money or three out of
• 1:08:43
  five whatever you choose and there is no ifs or buts that's basically it right so that's that's
• 1:08:49
  the key feature of it you know multi-sig and you know different when you have different hardware
• 1:08:56
  wallets you know multi-manufactured it's like it's complicated because of that there's different
• 1:09:00
  hardware walls you have to learn and learn but that thing where you have this possibly like
• 1:09:04
  people want to move to that because of the cold card thing right and yes now you've you it does
• 1:09:10
  do that so it does get rid of this entropy buggy entropy on the device problem uh in the sense that
• 1:09:16
  two out of three devices would have to be buggy right but it adds this thing this other way of
• 1:09:22
  losing money so you gotta when you're thinking about attackers you always have to think about
• 1:09:26
  what does the attacker want you to do right and there's one attacker that tim you know wizard of
• 1:09:31
  because he, or BTC Shelling Point,
• 1:09:33
  no, BTC Shelling Point, right?
• 1:09:34
  He calls it the fuck-up fairy.
• 1:09:36
  Yeah.
• 1:09:37
  Right?
• 1:09:37
  You've always got to think about the fuck-up fairy,
• 1:09:39
  and you've got to think about the actual attackers.
• 1:09:42
  And so we, in Frostnap,
• 1:09:44
  we think the fuck-up fairy is not super happy
• 1:09:47
  that you're going onto the Frostnap,
• 1:09:49
  because although it's a new company,
• 1:09:51
  it's new technology,
• 1:09:52
  and the fuck-up fairy might find something in there.
• 1:09:55
  At least the backup situation is totally pristine.
• 1:09:58
  It's like, you got two out of three, and that's it.
• 1:10:00
  You got all the money back, you're good.
• 1:10:02
  There's nothing else that needs to be backed up.
• 1:10:04
  And the thing that I always said about self-custody,
• 1:10:06
  which has not aged well,
• 1:10:08
  is that the most likely way you're going to lose funds
• 1:10:10
  is by your own fuck-up.
• 1:10:12
  And at the same time, I would have told anyone that asked me
• 1:10:15
  if Cold Car was good, I would have said, yes, it's good.
• 1:10:17
  So clearly, that didn't age very well.
• 1:10:19
  And no one fucked up who...
• 1:10:20
  Those people didn't fuck up.
• 1:10:21
  That's what I mean.
• 1:10:22
  Yeah, exactly. They did everything right.
• 1:10:24
  But I still think that's probably the way
• 1:10:26
  that most people will lose Bitcoin.
• 1:10:27
  It's not like a nation-state attack.
• 1:10:28
  That's not what's going to get most people.
• 1:10:30
  It is the fuck up.
• 1:10:31
  So taking that away is awesome.
• 1:10:32
  Yeah, but also, also,
• 1:10:34
  if you have all your life savings in Bitcoin,
• 1:10:38
  don't leave it all in your house.
• 1:10:39
  Yes.
• 1:10:40
  Spending five minutes.
• 1:10:42
  Although the fuck up fairy may come for you.
• 1:10:44
  Like there are actual people doing this now.
• 1:10:47
  Like people who are focused,
• 1:10:49
  criminals who are focused just on this.
• 1:10:51
  It's come down a bit since the price has gone down.
• 1:10:53
  Yeah.
• 1:10:54
  But their skills are there.
• 1:10:55
  They know what they're doing now.
• 1:10:57
  And they know how to target
• 1:10:58
  and they get information
• 1:10:58
  and they know how to do it.
• 1:10:59
  I think this is a good time
• 1:11:00
  to do a little bit of a one-on-one
• 1:11:02
  because I'm sure there's someone
• 1:11:03
  listening to this that's like,
• 1:11:04
  my life savings is in my house.
• 1:11:06
  What would be your sort of,
• 1:11:08
  I know it's different for everyone,
• 1:11:09
  but what would be a ideal situation
• 1:11:11
  for someone to actually,
• 1:11:12
  like where should people
• 1:11:13
  be storing their private keys?
• 1:11:14
  Oh, interesting.
• 1:11:15
  You want, yeah, go ahead.
• 1:11:17
  A good, like having,
• 1:11:19
  if you start,
• 1:11:19
  if you're thinking about multi-sig,
• 1:11:21
  having one key,
• 1:11:24
  at least one key
• 1:11:25
  in a place where you have to speak to someone
• 1:11:27
  or if there's like office hours,
• 1:11:30
  that's a really good one.
• 1:11:31
  Because like if someone comes to you
• 1:11:33
  in the middle of the night
• 1:11:33
  and you say,
• 1:11:35
  well, you're gonna have to take me
• 1:11:36
  to this person between nine to five,
• 1:11:38
  like that really throws them out of their,
• 1:11:41
  you know, their comfort zone
• 1:11:43
  in carrying off the attack.
• 1:11:44
  Yeah.
• 1:11:45
  But it's a much more risky situation.
• 1:11:47
  Like Nick said,
• 1:11:48
  I think like you can have a,
• 1:11:50
  what we found, okay,
• 1:11:51
  is that when we study the data
• 1:11:53
  is that the criminals in,
• 1:11:55
  when people have this thing
• 1:11:56
  where it's far away,
• 1:11:56
  okay, multiple,
• 1:11:57
  flights, if it's in multiple flights, you're rock solid. But of course, COVID or whatever,
• 1:12:01
  you know, World War III, then you're really in trouble. So if you're trying to predict things
• 1:12:04
  that people think like putting it far away, one common one is the holiday home, right?
• 1:12:10
  Wealthy person has lots of Bitcoin, they put it in their holiday home, it's a couple hours away.
• 1:12:14
  That is in practice not worked. They actually will just drive you to the holiday home.
• 1:12:19
  It's much better to have it with your accountant, lawyer or whatever down the street who's only
• 1:12:24
  open 9 to 5 and is very, you know, 1, 2, 3 with how they operate things.
• 1:12:30
  Yeah.
• 1:12:30
  Have, you know, security, have a safe or whatever and have it with them.
• 1:12:34
  Even your friend who's in an apartment in a security building,
• 1:12:36
  you have to like dial up, you know, to get into the building and go up a lift
• 1:12:40
  where you might encounter other people.
• 1:12:41
  Lots of cameras and yeah.
• 1:12:43
  The attackers don't want to do that stuff usually.
• 1:12:45
  The thing that scares me about it is like, as someone who's like,
• 1:12:48
  somewhat known in Bitcoin like if one of these attacks happened Someone could grab me off the street and say give me the Bitcoin And I could be like I can And you still might get fucking killed Like it a really horrible situation
• 1:13:03
  Yes.
• 1:13:04
  Though it doesn't like...
• 1:13:06
  People say that, but when I look at the data,
• 1:13:10
  it doesn't happen that.
• 1:13:11
  Like, people randomly killing people
• 1:13:13
  because they had Bitcoin and told them...
• 1:13:14
  Or like their finger chopped off.
• 1:13:15
  That one, yeah.
• 1:13:16
  So that does happen in the kidnapping case.
• 1:13:21
  In the kidnapping cases, kidnapping is a separate situation.
• 1:13:25
  And it's a really interesting situation.
• 1:13:27
  And I've been reading about it.
• 1:13:28
  And I super want to come up with a solution with it.
• 1:13:31
  And I want to get to, let's be fully honest,
• 1:13:32
  Frostnap doesn't help you with kidnapping.
• 1:13:34
  If someone...
• 1:13:35
  Nothing does.
• 1:13:35
  Yeah.
• 1:13:36
  Well, maybe I'm caught insurance.
• 1:13:39
  That's a spicy...
• 1:13:40
  I'm caught insurance does.
• 1:13:41
  Does it?
• 1:13:42
  Yes.
• 1:13:42
  Okay, does it?
• 1:13:43
  Okay.
• 1:13:44
  I think it does.
• 1:13:45
  Because in that scenario, you send them all your Bitcoin.
• 1:13:48
  Yes.
• 1:13:48
  And sure, you have price risk before you get paid out
• 1:13:50
  by your insurance policy.
• 1:13:51
  This is why when I was reading a book on kidnapping
• 1:13:55
  written by a guy who does lots of kidnapping stuff,
• 1:13:59
  it's to teach negotiators.
• 1:14:01
  Like one of the risk factors,
• 1:14:03
  one of the biggest risk factors
• 1:14:04
  in these kind of kidnappings that happen
• 1:14:06
  in the Middle East or whatever,
• 1:14:08
  like a guy working in an oil rig or whatever,
• 1:14:11
  they want to take the guy who has the insurance, right?
• 1:14:14
  And so if they know you have insurance,
• 1:14:16
  you become the number one target
• 1:14:18
  because yeah, there's no reason.
• 1:14:19
  They just got to pay it out.
• 1:14:20
  And so actually, the insurance, probably with Anchor Watch,
• 1:14:24
  but I would double check with Bob,
• 1:14:26
  you can't disclose you have that plan.
• 1:14:28
  Probably not. I don't know.
• 1:14:29
  Well, you can't get outside the US, so that's my disclosure.
• 1:14:32
  I do not have it. Don't kidnap me.
• 1:14:33
  Oh, you can't get outside the US.
• 1:14:35
  Okay. I wonder if it protects you if you go abroad.
• 1:14:37
  But the key thing is, yeah, you can't disclose it,
• 1:14:40
  but the really good thing about it, the insurance,
• 1:14:43
  is it not the bit where they pay you back,
• 1:14:47
  but the bit where they do the negotiation for you that's a thing you can't technically solve
• 1:14:53
  that is a real skill when you're like i don't know where you get the message on whatsapp or
• 1:14:58
  whatever yeah how you say things is just so critically important and how you use whatever
• 1:15:04
  leverage you have is just so critically important for the safety of the person
• 1:15:08
  and for not giving them all your money uh that's that's what i'd say so that that's what i'm really
• 1:15:14
  How can you provide that expertise to people
• 1:15:18
  without putting them in a situation where they say,
• 1:15:20
  yeah, I got insurance.
• 1:15:21
  Because then the attackers get more money
• 1:15:23
  and Bitcoin, they keep doing it.
• 1:15:25
  That's the other thing.
• 1:15:26
  You want to make sure they get as little money as possible,
• 1:15:30
  but you can't really do it yourself.
• 1:15:33
  You can't roll your own hostage negotiation system,
• 1:15:38
  unfortunately.
• 1:15:39
  It's not DIY.
• 1:15:40
  This has been a bit of a black bill, this episode.
• 1:15:42
  I mean, if we all get on, you know, strong multi-sig setups,
• 1:15:49
  there'll be no more like low-hanging fruit
• 1:15:51
  and the attackers will just be like,
• 1:15:52
  oh, we're going to go find something else to do.
• 1:15:54
  So right now, the low-hanging fruit is just people have all their money in the house.
• 1:15:57
  If you're doing physical attacks, it's just in the house.
• 1:15:59
  And you just figure that out.
• 1:16:00
  You figure out where they live and you do a home invasion style thing.
• 1:16:04
  And it works very often.
• 1:16:06
  It works very often, especially if they're prepared.
• 1:16:08
  Often the guy who's actually handling the money is remote, right?
• 1:16:11
  They're talking to them on the AirPods or whatever
• 1:16:13
  and telling them everything.
• 1:16:14
  They're looking up everything.
• 1:16:16
  You have to give them your phone first thing
• 1:16:18
  and get all the passwords for everything.
• 1:16:20
  They're in your email,
• 1:16:21
  looking at all the exchanges you signed up to,
• 1:16:23
  logging into them,
• 1:16:24
  just like doing a quick audit on you.
• 1:16:27
  So keep that in mind.
• 1:16:29
  That is the situation that the most experienced crews do.
• 1:16:32
  Put you in and you will not be able to pretend
• 1:16:35
  like you have some,
• 1:16:36
  oh, these are my decoy C words or whatever.
• 1:16:39
  That kind of stuff is not going to work.
• 1:16:41
  That's been my problem with decoy wallets is like,
• 1:16:43
  again, none of this stops you getting your fingers chopped off
• 1:16:45
  and your teeth pulled out.
• 1:16:46
  And like, it's...
• 1:16:48
  Might make it worse.
• 1:16:48
  It can make it.
• 1:16:49
  It can encourage them to do it
• 1:16:50
  because now you've started deceiving them, right?
• 1:16:51
  You want them to think you're super cooperative.
• 1:16:54
  That's my only advice.
• 1:16:55
  Just be like...
• 1:16:55
  Just be like...
• 1:16:55
  Just feeling straight truth.
• 1:16:56
  Just be cooperative.
• 1:16:58
  And the best thing to do is not have it in your house
• 1:17:00
  so you can be like,
• 1:17:01
  yes, let's go see my accountant tomorrow
• 1:17:03
  at 9 a.m. sharp, you know,
• 1:17:06
  about this problem.
• 1:17:07
  Or let's call him now
• 1:17:08
  and let's hope that he doesn't call the police.
• 1:17:10
  One thing is that they don't want the police called on them
• 1:17:13
  when they're in your house.
• 1:17:14
  That's the difference between kidnapping.
• 1:17:16
  In kidnapping, they're going to pretend,
• 1:17:17
  like they're going to expect that you're going to call someone, right?
• 1:17:20
  But when they're in your house,
• 1:17:21
  like any little trigger or whatever,
• 1:17:23
  someone suspicious of something,
• 1:17:25
  they're practically doing a kidnapping,
• 1:17:26
  but they're in your house,
• 1:17:27
  and that's not where they want to be.
• 1:17:28
  They're in an environment they're in control,
• 1:17:30
  and they could just get surrounded
• 1:17:31
  and go to jail for a very long time with getting no money.
• 1:17:33
  So anything that can trigger someone coming to check on you
• 1:17:37
  is good in that situation.
• 1:17:39
  Well, I'm terrified.
• 1:17:42
  But it's not a problem until the next bull market, actually.
• 1:17:44
  Yeah, true.
• 1:17:46
  So it's a good problem.
• 1:17:46
  This is the benefit of the bull market.
• 1:17:49
  You can relax for a while.
• 1:17:50
  So with these, this is a bit of a gear shift.
• 1:17:54
  With these devices, I can't use them on my iPhone, right?
• 1:17:57
  Not yet.
• 1:17:58
  Not yet.
• 1:17:59
  Is that coming?
• 1:18:00
  We're working on it.
• 1:18:01
  It doesn't, it can't use the same hardware.
• 1:18:03
  So we going to we working on a new edition at some point in the future And that just because Apple locked down the USPT If they even let us get it in the App Store and stuff Yes we believe that they will
• 1:18:16
  You know, you never know.
• 1:18:17
  They might ban all Bitcoin wallets by the time that we get there.
• 1:18:20
  I would not put that out of the equation.
• 1:18:21
  Exactly.
• 1:18:22
  But I could use these with my MacBook.
• 1:18:25
  Yeah.
• 1:18:25
  Mac, Android, Windows, and Linux.
• 1:18:29
  And Android phones you can do with, just not the iPhone.
• 1:18:31
  Okay, cool.
• 1:18:32
  And is that because you can sideload apps?
• 1:18:35
  We're in the Play Store as well.
• 1:18:36
  It's just that using the USB port
• 1:18:38
  is a lot less restricted on Android.
• 1:18:41
  And what about when they all get rid of the USB port?
• 1:18:42
  What should you do then?
• 1:18:44
  Oh, are they going to get rid of the USB port?
• 1:18:45
  At some point, I'm sure.
• 1:18:47
  I will have to do NFC or something.
• 1:18:50
  We'll figure it out.
• 1:18:52
  This is the first I'm hearing of this.
• 1:18:54
  I have no news, but it's the way we're going, surely.
• 1:18:58
  And so, like, obviously, everyone cares about AirGap devices,
• 1:19:01
  and these are not AirGap.
• 1:19:02
  you plug these in is there any risk in that we don't think so and and i'll be one to admit that
• 1:19:08
  i was um before i got into these deep conversations with lloyd i was sort of an air gapping proponent
• 1:19:14
  like it to me it felt like something that was you know it felt like it was adding security right
• 1:19:19
  there's the communication has to like go through this sort of this hop before it gets to the device
• 1:19:24
  um but dark skippy was one of the good examples that like it doesn't actually matter so much
• 1:19:30
  like the communication the information has to flow regardless um whether it's through a sd card a qr
• 1:19:36
  code a usb serial um there's always got to be some communication that flows and what really
• 1:19:42
  matters is does the firmware under the device like does it handle that communication securely
• 1:19:48
  um and we think we've done a really good job at that um by using you know solid programming
• 1:19:54
  languages and taking the time to do things really carefully.
• 1:19:59
  But you totally understand the intuition, right?
• 1:20:02
  You don't want to delve into all these topics.
• 1:20:04
  So you're like, if it's not connected to the thing, then it can't hack that thing, can't
• 1:20:08
  hack that other thing.
• 1:20:11
  That's, and actually in practice, that has been true.
• 1:20:14
  People who've plugged in had USB protocols.
• 1:20:17
  I can think of Trezor, Bitbox, I think, maybe even Jade.
• 1:20:21
  like they all had some kind of thing where they rolled their own decoder in c and when they're
• 1:20:29
  reading stuff off the wire it had a buffer overflow or something it didn't do the code quite correctly
• 1:20:34
  and you could do execute code on the device and so the theory the theory is that this is actually
• 1:20:41
  harder to do via images qr codes which i think is not true which is this is actually why i was
• 1:20:47
  looking at the cold card firmware in actually the first place like my initial prompts it was like
• 1:20:53
  eight weeks ago now was the reason i started out looking into it was i wanted to find a like a
• 1:20:59
  memory bug in animated qr codes i wanted to find something that sort of demonstrated that actually
• 1:21:05
  you know this air gapping with animated qr codes is really no different to doing communication over
• 1:21:10
  serial like over the usb no one is like you know inspecting these animated qr codes and like you
• 1:21:16
  know checking it all and even if you did you know there could be stuff covertly going through that
• 1:21:21
  anyway yes but in practice we couldn't find anything and in practice like these companies
• 1:21:26
  have been owned by the usb but it's actually it's it's a street it's just it's not a technical
• 1:21:30
  phenomenon it's a strange social phenomenon an engineer gets the job okay we have to talk over
• 1:21:34
  usb there's so many different ways to do it you can make a mistake with qr codes it's like very
• 1:21:39
  one way to do it and one guy has written that code correctly right yeah so it's like it's and
• 1:21:43
  everyone uses that thing. And so that, for some reason, actually works. So the much simpler thing
• 1:21:49
  is just to talk over a wire, but everyone goofs that up. And so, but the main, it's really a social
• 1:21:55
  engineering thing, not really a technical thing. And so when we're looking at it,
• 1:22:01
  we use the Rust programming language. So this means you would not be able to do that kind of
• 1:22:06
  thing where you send crazy bits over and it like starts taking control over the thing,
• 1:22:10
  which can happen if you use C.
• 1:22:12
  And C is what the cold card was trying to fiddle together with Python.
• 1:22:16
  We think that you should not use Python and C mangle together,
• 1:22:19
  just use Rust.
• 1:22:20
  And then you get rid of all these possible errors
• 1:22:23
  with memory and corruption.
• 1:22:25
  And so this idea that you're going to plug your device in
• 1:22:27
  and it's going to become corrupted by the laptop or something
• 1:22:31
  sort of goes out the window just at that level.
• 1:22:35
  That's what we bank on, at least.
• 1:22:38
  so we're all fucked and we should buy the etf
• 1:22:41
  yes etf will hopefully be custody by frost nap
• 1:22:46
  i love it um this has been awesome this has been a real deep dive i uh i think there's a lot of
• 1:22:52
  value in that thank you guys uh we're off to the bitcoin meet up in sydney let's go
• 1:22:56
  you guys you've got to do the same thing all over yes all right thank you guys thanks very much
• 1:23:08
  Thank you.