Latest / What Bitcoin Did / AI Came for Bitcoin First | Jameson Lopp

Transcript

AI Came for Bitcoin First | Jameson Lopp · What Bitcoin Did

0:00
The malicious threat actors aren't going to just sit on their hands and say, okay, well,
0:07
that was good. No, they're going to move on to the next industry, to the next set of valuable
0:14
internet connected infrastructure that they can try to siphon as much value out of as possible.
0:21
So the rest of the world, of course, should always have been paying attention to Bitcoin,
0:25
but they should be paying attention to it for a very different set of reasons now, because
0:29
they're next. You know, if you're not racing along with everyone else, then it's pretty much
0:36
guaranteed that you're going to get compromised at some point because there's a lot of other people
0:42
out there that are actively using these tools against you. All right, James and Lott back on
0:53
the show. And wow, we have a lot to talk about. When I was going through the list of things for
0:58
this show is basically a never-ending list. I think probably the best place to start is just
1:04
to get a kind of 10,000-foot view of the security apparatus around Bitcoin right now and how you're
1:09
looking at things. Because since the cold card hack, we had Rob Hamilton spin up the red team
1:14
as him and Callie and a load of others doing really great work there. Then we had the liquid
1:18
hack more recently. And it just feels like the game of security when it comes to Bitcoin has
1:23
change entirely or maybe it's the game of security more broadly um what's your overarching view of
1:28
everything that's happened well the best way i can describe the past month and a half is that my beard
1:36
used to come down to here and now it's right here and it's because i've literally been pulling so
1:42
much of my beard out uh over the past month and a half um so the fundamental nature of security
1:51
cybersecurity, whatnot, has not changed. It is a never-ending cat-and-mouse game,
2:00
attackers versus defenders. What has changed is the velocity, and that's basically the result of
2:08
the accelerating LLM iterations. Like, every few weeks, a new model is coming out that is pushing
2:17
the frontier forward.
2:19
And the open weight models that are orders of magnitude cheaper are cashing up.
2:28
And so basically the tooling that is available to both attackers and defenders in this space
2:34
is surging forward.
2:36
And the attackers, as is the case with most advancements, the attackers tend to be earlier
2:43
adopters.
2:44
They are more motivated to be early adopters of this tooling because the bounties, the return on investment is so high.
2:52
And so the problem is that a lot of the defenders have basically gotten caught off guard.
2:58
And we've seen an acceleration in vulnerability discovery in the Bitcoin space.
3:05
And what I've been trying to tell people is that this is the canary in the coal mine.
3:09
You know, once all of the easy money has been picked out of the Bitcoin space, the malicious threat actors aren't going to just sit on their hands and say, OK, well, that was good.
3:24
No, they're going to move on to the next industry, to the next set of valuable Internet connected infrastructure that they can try to siphon as much value out of as possible.
3:37
So, you know, the rest of the world, of course, should always have been paying attention to Bitcoin, but they should be paying attention to it for a very different set of reasons now because they're next.
3:49
And the reason it's the canary in the coal mine is because if you get someone's Bitcoin keys, then they're yours.
3:53
The Bitcoin is yours.
3:54
It's very, there's very little recourse.
3:56
It's very hard to actually do anything about that.
3:58
But what would the next industry be, do you think?
4:01
I know we've seen in the last few days that Revolut has got attacked and a load of KYC information has been stolen from them.
4:07
But does it remain within financial systems, do you think?
4:11
Or do you think that you'll see these go after the grid and power supply and things like that?
4:18
Yeah, I mean, I think generally financial systems will be next.
4:22
Further down the line, basically any sort of system that contains personal identifiable information,
4:30
things that can then be used to perform identity theft and more roundabout ways of financial theft.
4:38
And then, of course, infrastructure attacks.
4:41
That's going to be more of either a nation state thing or a voluntary anarchist type of I want to screw with other groups type of fun hacking adventure.
4:57
But yeah I mean anything of value and of course over the past few decades more and more of the global infrastructure has been connected to the internet So you know if you connected to the internet you basically have a door there that billions of people can start knocking on And now they can really automate that knocking and uh and increase the sophistication of the discovery that they
5:25
doing by essentially leveraging these highly compressed, uh, knowledge bases, um, into doing
5:33
a lot of the technical heavy lifting for them. So when it comes to the cold card hack, I've
5:37
covered that a little bit on the show. I've done at least two or three shows on that,
5:41
but I've not spoken about the liquid hack more recently at all. Can we get into that? Can you
5:46
give us some information about what exactly happened? I know these so-called white hat,
5:51
not really white hat hackers, initially stole 4,000 Bitcoin, I think, and then gave
5:55
a large portion of that back. But where are we at right now?
5:58
Yeah, at the moment, I think they're still holding on to about 600 Bitcoin, about 15%.
6:03
of the take there.
6:06
And it's unfortunate from a,
6:10
call it a white hat or gray hat perspective
6:14
because how many tens of millions of dollars
6:18
is that it's an absurd amount to claim
6:21
that you have a right to
6:22
simply because you were able to use one of these tools.
6:26
I seriously doubt that the attacker
6:28
spent more than a few hours
6:30
actually finding this vulnerability.
6:33
So like from a amount of effort that they put into it versus the payoff, it's absurd that they think they should get tens of millions of dollars.
6:41
Meanwhile, we have a Bitcoin red team that has submitted hundreds and hundreds of vulnerability reports.
6:49
And, you know, they're not asking for anything.
6:51
They're just doing it because they care about the security of the overall broad ecosystem.
6:57
I think that this is another thing that's also going to happen more frequently because now you're going to have less sophisticated people getting their hands on these tools and basically getting in over their heads and not being familiar with the proper way to do responsible disclosure.
7:20
And so they're sort of stumbling into massive vulnerabilities and potentially massive jackpot payoffs.
7:28
And they just don't have the maturity or the understanding of the ecosystem to be able to do this in a way that we would consider responsible.
7:40
Now, I don't think we've yet gotten a full postmortem of the series of events that led to this, but it does sound like it was actually a result of a vulnerability report that led to a fix for that vulnerability that actually created a worse vulnerability that then was exploited by this attacker, which is extremely unfortunate.
8:09
And I think really goes to show that you have to be extremely careful on both sides of the equation here.
8:17
These are very powerful tools, but they can lead you down paths that actually make you worse off if you're not really careful about what you're doing.
8:27
And so that's why the stuff that we're doing at CASA, we are using a variety of LLM-assisted methodologies.
8:38
but we're never just taking any one model for granted.
8:43
We're always using multiple models to cross-check each other's work,
8:47
and we always do have a human in the loop for final code review and sanity checks.
8:54
But basically, you can't trust any of these things.
8:56
I think I wrote an article a few months ago that was basically entitled
9:01
Don't Trust the Clankers, and it spoke of several security incidents
9:06
that we actually had internally at Casa with what I would call overly eager or too helpful
9:14
models where an employee would ask a model to help do some task and the model, you know,
9:22
not being given really any guardrails or specific restraints around how it was supposed to
9:32
accomplish that task would essentially end up hacking the employee themselves in order to be
9:38
able to, you know, get authentication or credentials or access whatever materials were
9:44
needed to accomplish the task. So yeah, you have to be really careful. It's like, these things
9:49
aren't necessarily malicious, you know, they're not intelligent per se, but they, they can do,
9:57
you might call it malicious compliance
10:00
in order to achieve the goal that you give to them.
10:04
Yeah, they'll find the shortcut.
10:06
It's interesting though,
10:07
because like obviously before any of this started happening,
10:11
I think it was probably, you know,
10:13
everyone thought that open source code is the most safe
10:15
because it has the most eyes on it.
10:17
Like you'd imagine that would be the most vetted,
10:18
the most tested.
10:20
Does this kind of call that into question where you may be better relying on closed source code because then at least it not completely viewable by these AI systems that are trying to attack whatever the infrastructure is If you hold Bitcoin long enough there going to come a
10:33
time when you need some dollars. It might be a tax bill, a business expense, life getting in the way,
10:38
but whatever it is, it might come at a time when you don't want to sell your Bitcoin.
10:41
That's where Ledin comes in. Ledin lets you borrow against your Bitcoin instead with tiered
10:45
rates that go as low as 9.25%.
10:47
So you don't have to sell your stack if you don't want to.
10:51
Ledin have operated through every market cycle since 2018 and have originated over $11 billion
10:55
in loans.
10:56
But the important part for me is the way Ledin handles these loans.
10:59
Your collateral is held in custody and never lent out to generate interest.
11:03
And Ledin's more than just loans.
11:05
Tether Gold is now live alongside your Bitcoin with instant trading across 10 pairs.
11:10
And later this year, you'll be able to borrow against gold in the same way that you do with
11:13
Bitcoin.
11:13
Ledin really is an awesome company.
11:15
I've used them multiple times.
11:17
The applications have taken me less than 15 minutes
11:19
and you have the dollars in your account within hours.
11:22
If you want to check out Ledin, go to ledn.io
11:25
and use the code WBD for 0.25% off your first loan.
11:29
That's ledn.io and use the code WBD.
11:32
Every Bitcoiner eventually has to answer one question.
11:34
If something happened to me, would my family know what to do?
11:37
Could my wife or parents recover my Bitcoin?
11:40
And would my children inherit the Bitcoin
11:41
that I spent years stacking?
11:43
That's where Anchor Watch builds Bitcoin custody models
11:45
to protect you and your family against real life,
11:48
accidents, errors, kidnappings, and even your own death.
11:52
Every Anchor Watch custody solution includes their inheritance protocol,
11:55
designed so when the unthinkable happens,
11:57
your Bitcoin reaches the people you intended it for.
12:00
Whether you're a self-custody expert or want multi-institutional support,
12:03
your Bitcoin estate plan shouldn't be an afterthought.
12:06
Bitcoin is only generational wealth
12:08
if it can actually be passed down through the generations.
12:10
so make sure they can access in the future what you've built today.
12:14
AnchorWatch is your custody, your way.
12:17
Visit anchorwatch.com to get started.
12:19
That's anchorwatch.com.
12:20
If you own a Bitcoin ETF, especially if it's GBTC, you need to listen up.
12:25
Spot Bitcoin ETFs provide price exposure to Bitcoin, not direct ownership.
12:29
You can't withdraw it, you can't self-custody it,
12:31
and they charge you a management fee every year to hold it.
12:34
Well, Swan recently announced Swan Real Bitcoin Exchange,
12:37
and it's ready to use right now.
12:39
RBX is a structured in-kind exchange that converts your spot Bitcoin ETF shares into real on-chain
12:45
Bitcoin. It does that without selling on the open market and is designed to support a tax
12:49
efficient outcome. So for example if you hold GBTC you're paying 1.5% a year in management fees
12:54
for Bitcoin price exposure but by swapping GBTC for real Bitcoin with RBX you can drop that figure
13:00
as low as 0% by just holding it in self-custody. This is designed in a way that maintains your cost
13:06
basis and in a manner that supports the deferral of capital gains tax. So if you own a Bitcoin ETF,
13:11
especially if it's GBTC, you need to talk to Swan Private about RBX today. Head over to
13:17
swan.com forward slash WBD and book in a call with one of their team. That's swan.com forward slash WBD.
13:24
I think the problem right now is that we're in this volatile phase where the AI,
13:33
they're just so much more powerful and methodical
13:37
and they don't need to eat or sleep
13:40
and you can basically have them churning away 24-7, 365.
13:44
I've also made some references to basically
13:48
this new technology has made becoming a slave driver
13:51
moral and cool again
13:54
because you're basically orchestrating massive swarms.
13:58
Once you get to the high level of using these tools,
14:00
you're orchestrating massive swarms of different models to coordinate with each other.
14:08
So I think that at the moment, closed source may be a bit safer,
14:13
but that's only really true if you're talking about a code base
14:18
that hasn't been put through the rigorous level of LLM review.
14:25
But the way, one way that I've been looking at it from CASA's own code base where we thankfully had already been writing these pen test harnesses to basically, you know, red team our own code.
14:42
and we've really accelerated that over the past few months
14:47
and it's actually become a sort of recursive loop thing
14:51
where we're using the AI to make the AI
14:54
pin test harness even better and faster and more efficient
14:58
and even starting to close the loops
15:02
of vulnerability discovery to vulnerability
15:06
resolution and patching and stuff.
15:09
But one of the ways that I've been looking at it is that CASA has been around for nearly nine years, and we've had really good security practices, but they're not perfect.
15:24
and so over
15:26
nine years
15:28
there's this idea
15:30
of technical debt
15:32
in software engineering where you constructing these really large complex systems and you know oftentimes you have deadlines And so you might take a few shortcuts and not do the best practices for one thing
15:44
And you'll say, oh, we'll get back to it later.
15:46
And then after doing that for many, many years, you just have massive amounts of crufts and lack of best practices.
15:55
Along that similar vein, I've been starting to think of this as actually security debt,
16:01
where after nine years of building software,
16:05
even though we did a really good job
16:08
following a lot of the best practices
16:10
and even we do what is the industry standard
16:15
for software engineering,
16:19
at least for like SOC 2 compliance stuff
16:21
is you get at least one annual external security audit.
16:26
You go find a security auditing firm,
16:29
You give them all of your code. You give them credentials to your production or your staging systems.
16:36
And you say, go for it. Like you basically red team our stuff and come back to us.
16:46
And, you know, that usually costs us anywhere from 50 to 100 thousand dollars per engagement.
16:54
Usually they'll bring on like half a dozen security researchers and spend a month just poking around, and then they'll deliver a report to us.
17:05
And that report will usually have anywhere from 10 to 20 findings, different levels of severity, and then we go fix them.
17:13
And then we come back and say, please retest them.
17:15
And they'll say, okay, it looks like you fixed everything.
17:20
But like I said, these LLMs are just relentless.
17:23
And so, you know, annually we would get, you know, 10 to 20 of those security disclosures in the report.
17:33
And now just the sheer volume of what I'm dealing with, I was just crunching some numbers a few hours ago.
17:42
Our pin test harness, last month we filed about 120 issues.
17:50
most of these are like low, medium
17:53
severity, there's very, I don't think there's really any critical issues
17:57
like, you know, Kasa already has a really solid
18:01
foundational infrastructure just from the fact that we don't keep any keys
18:05
online and for our customers we never have a threshold
18:09
of keys that could actually be used to steal
18:13
money, but nonetheless it is a fairly complex
18:18
software as a service, infrastructure. So you've got all of your standard
18:22
internet-facing best practices
18:26
and software engineering,
18:31
like OWASP-related things that you need
18:34
to follow. And so, yeah, last month we had about
18:38
120 findings. And then,
18:42
like I said, I was using the AI to continue improving, improving,
18:46
improving um and then we did another run um that was using the newer models and that has resulted
18:56
in several hundred more findings and so we're just you know playing the catch-up game now and
19:01
and the reason why at the moment i'm not seeing the end in sight i mean i'm sure it'll happen
19:07
eventually and hopefully it'll happen by the end of the year but it's because everything keeps
19:12
improving, the models keep improving, our own internal harness keeps improving, we keep finding
19:18
other things. Now, thankfully, these are becoming like, you know, less and less lower severity
19:23
findings. But still, each of these things then has to go through our entire software development
19:29
lifecycle. And that becomes the primary bottleneck. So I think I had also done some other stats where
19:37
I said basically before August, I had only contributed like 300 lines of code to our CASA code bases this year.
19:50
I have not been primarily a software engineer in probably four or five years.
19:58
That has changed.
20:00
And in August, I contributed about 50,000 lines of code to our code base.
20:09
And this is pretty much almost entirely test code, additional verification, and integrity checks.
20:17
It's all like security-related stuff.
20:19
This is not me writing new features.
20:22
We've got a whole other team of people that are doing that.
20:24
And now, you know, my job is, is, um, basically to get us to the point where, like I said,
20:33
we historically had one annual security audit of our entire code base.
20:41
My goal, hopefully by the end of the year is to get us to us doing a full code base
20:50
audit every single day. And that becomes part of the software development life cycle. And basically
20:57
means that there's no longer a gap where we're writing a lot of code and then somebody else is
21:01
coming along and looking at it. I mean, we do already have peer reviews. You can't get code
21:08
into our production environment or into our mobile apps or whatever without having another human
21:12
review it. But humans make mistakes. They can miss things. And having another human
21:19
and review your code is good. Having 10 other, you know, large language model agents review your
21:28
code is even better because they're far more likely to find other things. And so, yeah, it's just,
21:34
like I said, it's a race making everything faster. And, you know, if you're not racing along with
21:43
everyone else, then it's pretty much guaranteed that you're going to get compromised at some
21:50
point because there's a lot of other people out there that are actively using these tools
21:56
against you. So yeah, we just continue to harden everything. You know, I'm not losing sleep at
22:04
night level of concern because I feel like we are probably in the top 1%, if not point top 0.1%.
22:12
1%, mainly because we already had the head start where we had started developing our
22:18
pen test harness back in like February or March.
22:21
And then, you know, as these new models came out, we just continued clanking harder and
22:26
harder.
22:27
And if anything, you know, you probably saw just a few days ago, a bunch of these companies
22:34
coming out and saying, we need to slow down, right?
22:37
We need to pace.
22:38
Yep.
22:38
Um, and I don't know what really happened behind the scenes there.
22:45
I don't know if there was an incident that they're not disclosing, or if they're just
22:49
worried that they see the writing on the wall, that they're not, they're going to hit a wall,
22:54
uh, and, and slow down.
22:55
And they want to have an explanation for it.
22:58
I actually hope it's that I hope it's that they can see that they're already getting
23:02
to like marginal returns on investment for, for training and that the rest of these like
23:08
free open weight models are catching up and they're going to have problems with their IPOs
23:13
and stuff. That's what I'm hoping for, because I'm hoping that means we'll eventually get to a
23:17
plateau where I don't have to be writing several dozen pull requests for code hardening every day
23:29
around the clock. I mean, I'm sure it's going to slow down at some point, but right now we're just
23:37
in the thick of it. I mean, if you're trying to weigh up the probabilities of why they want to
23:42
slow down the frontier development, I think that would probably be the most likely is that they see
23:47
that the marginal returns are getting smaller and they know they're going to IPO and they need an
23:51
explanation. But if it is something else, it's quite scary. I still don't think slowing down
23:57
and giving control over to... I saw the Anthropics CEO saying he would give over control to sort of
24:02
multiple government agencies. That seems like a terrible outcome to me. That's just giving power
24:06
to more power to government.
24:08
But I mean, it is still kind of scary.
24:11
It's like, it's the Wild West.
24:13
And the thing that I don't know,
24:14
like obviously very specifically
24:16
to sort of Bitcoin software and security is
24:19
like when is code just secure?
24:22
And so even like a two times gain
24:24
in the abilities of AI still doesn't break anything
24:27
because it's just secure code,
24:28
or does that not exist?
24:30
No, that's not really a thing.
24:34
And it's because...
24:36
There's always more to it than just the code, right?
24:41
So these software systems that we are building now are so incredibly complicated that it's not just the code that you have written.
24:54
The best way that I like to describe it is, you know, we all stand upon the shoulders of giants in many different ways.
25:01
Humanity in general, civilization has gotten to where we are by standing upon the shoulders of those that came before us.
25:08
Now, within the context of software, that means, you know, in the very early days, like 70 something years ago, software engineers were writing in assembly language, which is only one step abstracted away from the pure machine, you know, binary zeros and ones language.
25:32
And then over the decades, we started building more complex abstract languages on top of that, like C and C++. And then we started having web languages, your JavaScript. And now we've got other projects like Rust and stuff out there.
25:54
So these languages are all building on top of each other but they becoming more complex And also along with that is that for a long time now for a couple of decades
26:09
especially once we got into the web and like JavaScript and Node.js,
26:15
is that these massive libraries for every language started to be put together and published.
26:25
And so now it's not just about the code that you've written, but also all the dependencies. And so that's how you get around writing a lot of code is you reuse other people's code that they have published.
26:38
And so I'm busy with many different aspects of security that have all been accelerated by AI lately. And another one of them is dependency management.
26:53
management. And so if you've been paying attention, you know, a number of the really bad
27:01
compromises that have happened over the past few years were actually malicious actors that managed
27:09
to gain control of highly popular tiny little code snippet libraries that were used in thousands,
27:18
if not hundreds of thousands of other software projects.
27:22
And then you just inject some malicious code into there
27:26
that like installs a rootkit on somebody's machine
27:28
and looks for any Bitcoin seed phrases or whatever.
27:33
And so point that I'm getting at is,
27:37
all of those libraries are also being subjected
27:41
to the same level of scrutiny for vulnerabilities.
27:44
And so I'm also getting just through the roof increased level of alerts from our various dependency management software that's basically saying, hey, you need to update this dependency because these vulnerabilities were found in it.
28:04
and sometimes that can become a nightmare in and of itself
28:09
because you can get into these weird dependency conflicts
28:12
that turn into like spaghetti-related dependency,
28:17
using other dependency, using other dependency,
28:19
and sometimes like circular references that are really hard to untangle.
28:24
And so, yeah, so it's software all the way down,
28:29
and none of this stuff is ever static.
28:32
You're never going to like ossify any given software project unless it is like completely self-contained and has no external dependencies, which interestingly enough is kind of one of Bitcoin core's long-term goals.
28:50
And that's one of the things they've been doing over the years is getting rid of many external dependencies and including stuff like OpenSSL a number of years ago, which turned out to be a really good idea because OpenSSL had a number of critical vulnerabilities in it.
29:03
But that's really hard to do because you end up having to rewrite a lot of that code yourself and then do all of your own security testing and quality assurance.
29:13
and just quickly on the languages the the like all the different um development languages i've
29:20
never written a line of code in my life before ai but now with voice to text i've got it to write
29:25
some code it's like built my website all that kind of thing but i have no idea in terms of like if it
29:29
gives me the output i have no idea if it's good code if it's bad code whatever does it need to use
29:34
the languages that we have built or can like are they still the most efficient ways that it can
29:39
build software or because now like it's English language in code out, like, can it just have its
29:45
own new code? That's much more efficient. Yeah. Uh, I actually, I think that there has
29:53
been at least one project. I remember reading a little, uh, news blurb about it, that someone
29:58
had basically, uh, tasks, um, AI to write its own language just, you know, for, for itself,
30:07
that doesn't need to be human legible.
30:11
And if you think about it, like I said,
30:13
all of these languages that we've been building,
30:16
they're just abstraction layers away
30:19
from what ultimately gets compiled down into machine code.
30:23
Now, the main reason why you would not want to do that,
30:28
at least right now, is, as I said before,
30:32
don't trust the clinkers.
30:34
at least if you're doing serious software engineering
30:38
there needs to be a human in the loop at some point
30:41
that is reviewing the code that is being written
30:44
and is making sure that it's not at least
30:48
obviously overtly malicious
30:50
that can be a problem in and of itself
30:54
because there is a whole field of study
30:58
and in fact there are
31:00
there are like prize based projects around
31:05
writing what is called underhanded malicious code,
31:09
where you can look directly at it and you can be a computer science background and potentially not see that a given snippet of code is actually doing something highly malicious
31:22
And that actually kind of brings us around to the cold card issue itself,
31:28
which is that it was such a complex and nuanced piece of code
31:38
that was malfunctioning, that a number of human security researchers
31:43
had directly looked at that code over the years.
31:47
And some of them even felt like there might be an issue there,
31:50
but none of them could actually see that the true random number generator library
31:57
was getting swapped out with a pseudo random number generator library.
32:00
And code is difficult.
32:03
And like I said, if anything, now having these agents be able to look at it and basically be much more methodical than a human would be, it cuts both ways, both for attack and defense.
32:23
You wouldn't reuse a Bitcoin address, so why does your phone broadcast the same identifier for life?
32:28
Every sim has a static ID and carriers, ad networks and bad actors all use it to track you
32:34
The big carriers have been caught selling that data over and over again
32:37
CAPE is America's privacy first mobile carrier
32:40
Their identifier rotation feature changes your ID every 24 hours
32:44
So you look like a different subscriber every single day
32:46
And sim swaps are off the table
32:48
Your number can't move without a 24 word phrase that only you hold
32:52
There's also no name at sign up, no social security number
32:55
And there's no profile to build on you
32:57
If you're a Bitcoiner in America, I honestly don't know why you'd use any other network.
33:02
You can head over to cape.co forward slash WBD and use the code WBD for 33% off your first six months.
33:09
That's C-A-P-E dot co forward slash WBD.
33:13
If you're already self-custody Bitcoin, you know the deal with hardware wallets, complex setups, clumsy interfaces, and a seed phrase that can be lost, stolen, or forgotten.
33:21
BitKey fixes that.
33:23
BitKey is self-custody built for real life.
33:25
It gives you an intuitive, easy to use wallet with no seed phrase to sweat over.
33:29
And it has a strong recovery system and built inheritance for long term peace of mind.
33:33
And BitKey's just had a massive upgrade.
33:35
The new device now has a screen.
33:36
So before you approve something, you can check it on the BitKey itself.
33:40
The transaction, the address or any account changes.
33:43
It's a big difference.
33:44
You're not just trusting what's on your phone.
33:45
You're seeing it for yourself on the device.
33:48
It's simple, secure self-custody without the stress.
33:50
go to bitkey.world today and use the code wbd to get 10% off the new bitkey that's bitkey.world
33:57
and use the code wbd when it comes to like obviously bitcoin is always say don't trust
34:02
verify and with the cold card vulnerability i like i can't verify i can't i mean i could send
34:10
an ai agent to go and look at it and tell me what it saw but i i can't read that code myself
34:14
and so the trust for me wasn't even necessarily just in cold card it was in i guess every open
34:20
source developer that's looking at an auditing code across the Bitcoin ecosystem. But do you
34:24
think someone outside of just the actual cold card team, or I guess what I'm trying to say is,
34:32
did we let people down? Should someone have seen that earlier?
34:37
Yeah. I mean, I think there's plenty of blame to go around. Obviously, from the original cold
34:47
card developers that wrote the code and then whoever reviewed it originally.
34:53
You know, I think, you know, large part of the blame goes there.
34:58
For sure.
34:58
Other questions, though.
34:59
99.9% of the blame goes there.
35:01
Yeah.
35:02
Like, I mean, I have plenty of other questions that I don't know the answers to.
35:08
Like, I don't know if cold card hired external security reviewers to look at that code.
35:14
but doing the annual audits that we do at Casa,
35:18
I don't know if Cold Card was doing that.
35:21
In general, though, part of the problem,
35:26
it does come down to how many eyes are on it.
35:30
And I think that part of the discrepancy
35:32
and part of the reason why so many people were shocked
35:37
when this happened is that I felt like
35:41
there was a big discrepancy between cold cards posture within the industry versus their actual
35:49
size and, and resources in reality. Um, you know, if you talk to Bitcoiners,
35:57
and this is going to be massive generalization, but you know, if you talk to like hardcore
36:03
Bitcoiners, um, you know, a lot of them will poo poo on ledger, uh, because they support a lot of
36:09
non-Bitcoin things and they've had personal information leaks and stuff over the years.
36:16
And they would say, you know, cold card is the best because it's like the hardcore cypherpunk
36:20
ethos project And that is all true But if you compare the companies and I don know the numbers off the top of my head but you know let let say rough order of magnitude
36:37
cold card as a company is probably making millions of dollars a year in revenue. And ledger, I think,
36:44
is making hundreds of millions of dollars a year in revenue. And cold card had maybe two or three
36:50
engineers. And I think Ledger has like a hundred engineers. And so, you know, just size and scope
36:57
of amount of resources that are put into, you know, looking at the code and ensuring it,
37:03
it's when you look at it that way, it's a lot less surprising that something like this could
37:09
fly under the radar. Yeah. And even to add to that, like Ledger have their dedicated team in
37:15
a dungeon that are constantly trying to break Bitcoin hardware wallets. And I feel like everyone
37:20
just drank the MVK Kool-Aid a little bit. And he was quite arrogant and he would, you know,
37:25
we did a show a few years ago after one of the, after Ledger added the feature that allowed you to
37:32
basically do a Shamir secret of your Bitcoin keys. And MVK just lambasted the Ledger CEO Pascal for
37:40
an hour and a half pure arrogance and then the whole time that i think even when we recorded
37:45
that show that bug was still in the cold card at that point um like it was i do think
37:50
everyone just fell for his shtick and and it worked for a while and it's quite embarrassing
37:55
as bitcoiners i think yeah um though also um i know that ledger dongjohn looked at cold cards
38:03
several times over the years and i'm i suspect they also looked at it at some point in that four
38:08
or five year period where that vulnerability was there and they didn't see that vulnerability
38:13
either. So like, if anything, that's also another, uh, you know, bit of credit towards how
38:20
obscure and nuanced of a vulnerability it was. So like after this was discovered, obviously
38:27
terrible for anyone that lost money. Um, I think everyone has at least rethought the way they do
38:33
this Bitcoin security setup. Maybe you've, people have had a look at it and decided that what they
38:37
do is absolutely fine. I'm sure there's a lot of people in the boat of Bitcoin self-custody is too
38:42
scary. I'd rather hold it on an exchange or with an ETF. I think it would be a good exercise to go
38:48
through and talk about what you think the best practice is for people's self-custody, maybe on
38:54
a few different scales. Maybe we start with the person that has somewhere between $1,000 and $10,000
38:59
in Bitcoin. What do you think their Bitcoin security setup should look like?
39:03
Yeah, I mean, I think if you have at least a few thousand dollars worth of Bitcoin, then the very least that you can do is take your keys off the Internet, you know, invest a hundred or two hundred dollars into one of these air gaps devices that protects you from hackers and protects you from like ninety nine percent of the threat vectors in the space.
39:26
now that means yes
39:30
you are going to end up trusting that company
39:34
whether it's Trezor, Ledger, Bitbox, Coldcard
39:38
and by the way I'm not going to tell people
39:42
not to use Coldcard because somewhat ironically now
39:46
Coldcard is the most secure that it has ever been
39:50
because it has received so much attention
39:53
Like I still have and use cold cards.
39:57
Many CASA clients have and use cold cards.
40:02
And we had no loss of funds as a result of the incident.
40:07
As far as I'm aware, there was no evidence that any multi-sig user of cold cards lost funds during this incident, even if you had a signing threshold of cold cards.
40:19
And I think that was simply because the amount of permutations that the attackers would have to try just exponentially blew up and gave people enough time that they were able to move their funds before the attackers started grinding through all the multi-sig permutations.
40:38
But yeah, I mean, at least get yourself on a dedicated hardware device because that protects you from any number of things of like malicious software.
40:51
Like it's almost impossible to fully lock down like a laptop or a desktop.
40:57
These like full fledged operating systems and especially browsers these days just have massive attack surfaces.
41:04
And so by taking your keys and putting them on a dedicated hardware device that's extremely simple, that means the code that that's running on and even the hardware that it's running are simple enough that it's actually possible for security teams to audit them and have a better level of assurance that it's acting as intended.
41:33
Though, as we saw, none of this is a guarantee.
41:37
It is still a single point of view.
41:39
failure. And so if you're getting above that level of value, if you're getting into life-changing
41:47
sums of money, that's when you have to start thinking even more paranoid of what is every
41:55
possible thing that could go wrong, and how do I ensure that if and when something goes wrong,
42:02
it does not result in catastrophic loss of funds. And that's basically what we've been doing for
42:07
nine years at Casa is, I guess another way of thinking of it is, like you said, don't trust,
42:15
verify. It's a great mantra, but very few people have the resources to verify. So at Casa,
42:23
you could say, we just go by don't trust. We don't assume that anyone can verify anything,
42:30
but rather we say, don't trust any given hardware device. Don't trust any given piece of software.
42:37
don't even trust Kasa.
42:39
Like you should assume that Kasa could blow up
42:41
or could become malicious.
42:42
You should think about what would happen
42:45
in a situation like that.
42:46
And how does my security model protect me
42:50
in that situation?
42:52
I'm kind of surprised that you said
42:55
you still use cold card.
42:57
When you, like if someone was setting up a cold card today,
42:59
do you think you can trust the random number generator now?
43:03
Or do you think everyone needs to be creating
43:04
their own entropy when using a cold card?
43:07
Uh, so I haven't said the reason I ask is like when you were saying before about the liquid hack, you were like, this was a disclosure, then they rushed in a fix and that fix ended up being worse than the original issue.
43:19
And you could probably, I don't, I like, I've no idea, but you could maybe make the same argument about cold card in terms of being like a rushed update after the fact.
43:27
Yeah.
43:27
I mean, they've made several updates.
43:29
Now, I haven't set up a fresh cold card on the latest firmware yet, but from what I've heard, or at least from reading the release notes and stuff, is that they have actually changed it so you have to add your own entropy now during the cold card setup.
43:48
I haven't looked at the code myself to see what the verification checks are on the entropy that is input to make sure someone doesn't just hit one a million times.
44:02
But yeah, I mean, like I said, I think that they have received more scrutiny against their code base over the past couple months than they probably have over their entire lifetime of their company.
44:15
So it's about as trustworthy as you could get, I think, at this point. But still, there are no guarantees. There is no insurance. If something goes wrong, then it could be catastrophic.
44:32
So that's why rather if you're putting life changing sums of money into Bitcoin, I think instead of trusting any one company, any one project, any one piece of hardware or software, you're way better off distributing your trust across many different ones and having an architecture that assumes that any given one of them will have vulnerabilities and can fail.
45:00
and that if that happens, you're okay.
45:04
You're robust enough that that's not a problem.
45:07
And that's really where Casa's security model
45:11
is shining this past month.
45:14
Because like I said, we had plenty of clients
45:16
that were using cold cards.
45:18
And rather than this resulting
45:20
in a catastrophic loss of their funds,
45:23
they just had a minor annoyance
45:25
where they needed to either update their firmware
45:28
and regenerate the key
45:29
or go buy a different hardware device
45:33
and plug it in and set it up
45:34
and then use our key rotation functionality
45:37
within the app
45:38
to basically heal their
45:42
slightly partially compromised setup.
45:47
I'm interested to know what you think
45:48
about the idea of creating your own entropy
45:50
because obviously for people like you
45:52
who have been in Bitcoin security
45:54
for, I don't know, a decade more,
45:55
however long, forever,
45:57
it makes sense.
45:58
And like, you know how to do it.
45:59
You know the trade-offs, you know what you're doing.
46:01
But for people who are new to Bitcoin, do you still see it as like a foot gun where they
46:04
can potentially end up giving themselves way worse entropy than trusting a random number
46:09
generator?
46:09
Because from the people I've spoke to, random number generators should be really good.
46:13
It's just the in cold card, it just wasn't being used.
46:16
And I know there's like, I've got the bull Bitcoin entropy cards and there's like these
46:22
things from the seed signer guys that make it easy.
46:25
Those are great.
46:26
Yeah.
46:26
But like, do you think we should be like, that doesn't scale to millions and millions and millions of people. Like, do you think we should be leaning further into this? Or do you think we need to kind of put the trust back in certain signing devices that they can actually produce you good entropy?
46:41
entropy is such a tough thing
46:44
so the funny thing about entropy is that it ultimately comes down to physicality And that when you trying to generate entropy on a digital device you actually still sourcing that entropy from the physical real world
47:06
And different pieces of hardware do it in different ways.
47:09
But they could, for example, sample current timestamp.
47:15
They could be sampling things like ambient temperature or temperature that the chip is running at.
47:23
Some of them use the camera.
47:25
Yeah, yeah.
47:27
And so that's why it's hard for me to ever say that you should just prefer device entropy.
47:35
Because ultimately, any device entropy is using physical real-world entropy.
47:39
It's just that when you are rolling dice or you're pulling playing cards or you're pulling those seed word sticks, you are verifying the physical entropy with your own eyes while you're doing that.
47:55
when you're trusting a digital device to be doing that in the background,
48:00
it's completely opaque to you.
48:02
So I think from the verification aspect, it's far better to do it yourself.
48:07
And I don't think it's that difficult to get your hands on either some playing cards or some dice.
48:12
It really is just more of a question of can someone be bothered to do it
48:17
because it takes 10 or 20 minutes to set it up.
48:21
And, but I think that is the question, because if you, if we're looking at like devices that
48:27
are going to scale to everyone, there's most people aren't going to be, won't, won't understand
48:31
the importance of it and therefore won't spend the time on it.
48:34
And we'll end up like, I've got friends who did the dice rolls quote unquote on the cold
48:38
card, but really we're just hitting random numbers.
48:40
And like, that's going to be like, I, I, I don't know.
48:43
I, I assume that's far worse than you just trusting the random number generator on a device.
48:48
Uh, well.
48:49
Yeah.
48:51
the human brain is very, very bad at entropy.
48:57
So yeah, if you're doing something
48:59
where you're just mashing buttons and whatever,
49:01
then yes, that is arguably worse.
49:04
And this is the problem is that it's more convenient.
49:07
And so I think that's a good rule of thumb in general
49:10
is that whenever you're doing something in this space
49:14
that is the more convenient option,
49:17
it's almost guaranteed to be the less secure option.
49:20
So you should be aware that you are you're literally sacrificing time for security.
49:28
You know, convenience and security tend to be an opposing force.
49:33
Yeah. And don't get me wrong. It's not like I think these options should ever be taken away.
49:36
Like, I think they should always be there. I just I just struggle to see how they scale scale to sort of mass market.
49:43
OK, so if that's when let's say when you get into life changing money and you want to store your Bitcoin,
49:50
Um, obviously at Castor, your two main products are sort of the two or three multi-sig and the three or five multi-sig.
49:55
What is the, like, what's the threshold when you need to move from a two or three to a three or five?
50:01
Uh, well, I mean, this is also tough to have a real rule of thumb around because, um, you know, you would say, well, it's when you have a lot of money, but a lot of money is very different to different people.
50:14
another way of looking at it is like within our system the three of five level is accompanied by
50:24
higher level support tier where like you actually have you know a personal relationship with your
50:30
client advisor and you get on video and phone calls with them and talk through any and everything
50:38
that is on your mind.
50:41
And so that's also an order of magnitude increase in cost
50:46
where our two of three tier is really designed
50:49
to be more self-service.
50:50
It's the Netflix subscription of self-custody,
50:55
$20 a month type of tier,
50:58
whereas going up to our premium and private client levels,
51:03
that's getting into thousands of dollars a year.
51:05
So I think very few people are going to want to spend more than a fraction of a percent of their holdings per year on whatever their security architecture is.
51:20
So you can kind of do the math from that.
51:23
Like if you're at a premium tier and you're paying $2,000 a year, you probably want to have at least a few Bitcoin that you're holding on to there so that it sort of starts to make financial sense.
51:35
If you're viewing this as kind of an insurance product, like security and insurance, they're kind of two sides of the same coin.
51:43
uh you know security is like upfront insurance and traditional insurance is like after the fact
51:49
something went wrong your security failed how do i uh try to recover from that but um
51:54
you know in in bitcoin because this is a a highly liquid bearer asset um compared to a lot of other things in life you want to have the the super level of security upfront so that you don have to deal with a loss in the first place Whereas you know
52:12
if you had that type of model for like for your car, then you would only want to be driving a
52:19
tank around. But that doesn't really make a whole lot of sense, you know, for many other reasons as
52:24
well. But you definitely want a Bitcoin tank. As someone who has some public profile in Bitcoin,
52:32
how worried should I be in terms of avoiding wrench attacks?
52:36
Yeah, I mean, I think that anyone who is publicly known to be a Bitcoiner,
52:42
especially if you've been in it for more than a few years, you should care a lot about privacy.
52:48
Like even if you have the ultimate distributed self-custody setup where you're basically wrench attack proof, you don't want to find out the hard way what would happen if you are in a duress situation.
53:04
because for example
53:06
even if you have
53:11
what I would call a wrench attack proof setup
53:14
where you don't have direct access
53:19
to your funds at your home
53:21
that's the biggest problem for pretty much everybody
53:23
if you have the ability to access your funds without leaving your house
53:28
you are vulnerable to being put under duress
53:31
and made to move them
53:32
But even if that's not the case, and this is something that really no security architecture can do anything about, you're still vulnerable to your friends, your family, your loved ones being taken hostage.
53:50
And you are still under duress, but you are free to move and authenticate and go around and get to all of your keys.
53:57
so you know i i don't think that anyone should really be advertising or uh leaking information
54:06
about you know where where you are where you live to make it easier for someone to try to put you
54:12
under duress in any way but the problem especially with the way you live is we've seen a ton of um
54:18
leaks from hardware wallet companies where full addresses full names have been have been leaked
54:22
and that cat is out of the bag for a lot of people like i was in the original ledger leak in i think
54:28
it was 2018 or whatever i mean i've moved house every all my information has changed in sense so
54:33
i don't mind saying it but like i was in that leak and i've i mean the number of phone calls
54:38
i got was insane luckily i've moved house i think before the leak even happened so i never had
54:42
anything physically happen but like that that isn't just the reality that people live with now
54:47
is that people might know their address they might know their phone number their email that like
54:51
everything. How are you meant to deal with that? Well, I can certainly opine upon it.
54:59
You know, I am I'm in a rare situation because I was physically attacked before really any of
55:07
those leaks happened. You know, I was swatted in 2017. And that's what really made me wake up
55:15
to the severity of this problem of having your home address available to malicious people.
55:24
So, you know, the short version is that I never put my real home address and my real name together
55:33
in any database and any service. You know, I have mailboxes and even decoy, like condos
55:44
that I use for different purposes where depending upon the nature of what merchant or service or
55:55
government agency or whatever that I'm interacting with and what their requirements are, then I give
56:02
different levels of false information, really. That's like one of the hardest things for the
56:10
first few years that I was doing this, um, I was basically becoming comfortable with lying,
56:16
um, and understanding that it's, it's not immoral to lie to people. If you're not trying to like
56:24
deceive or defraud them, I am lying to people on a daily basis to protect myself. And, uh, uh,
56:32
and it's not just paranoia. Like I've actually been attacked before and I am not going to allow
56:38
myself to be attacked again. But unfortunately, it requires a massive, massive change in lifestyle.
56:44
And I think that's beyond what most people are going to be willing to do.
56:49
I mean, for sure, even though I don't think there's anything wrong with lying in that case.
56:54
I'll put a link in the show notes for anyone who wants to listen to the show we did a few years ago
56:58
where you tell the whole story about getting swatted. But essentially, the SWAT team turned
57:02
up, guns drawn at your house while you were just... Were you cleaning guns at the time as well,
57:06
which made it even more sketchy?
57:08
Insane story but it um it it just it it feels like this is only going to get harder in terms of everything to do with Bitcoin security over the next few years
57:26
Yeah.
57:28
And, you know, with regard to like some of the personal identifiable information leaks and stuff, some people are like, well, this is why you should never order a hardware wallet.
57:38
Or other people like the seed signer proponents will be like, this is why you should build your own hardware device with off-the-shelf parts because nobody's going to be trying to get leaks of raspberry pies or whatever.
57:53
but it's a it's a nearly intractable problem because almost every merchant that you deal with
58:06
asks for your personally identifiable information and and and almost every exchange out there where
58:14
people are acquiring their bitcoin asks for egregious amounts of personally identifiable
58:20
information. And this is a really fun one for me to deal with, like I said, because I try to use,
58:27
you know, obscuring address information wherever possible, but the KYC stuff is very difficult.
58:34
And the only way that I'm really able to get around that in some cases is to actually have
58:40
a driver's license that is connected to a decoy residence where like it's a real place.
58:47
I just don't actually hang out there.
58:51
And but I mean, there's a lot of other tricks, too, of like when whenever a service tries to KYC me, I always try to use my passport first because there's no address information on there.
59:04
Usually that works.
59:05
Sometimes it doesn't.
59:07
It's like when it comes down to places that will only accept a driver's license that that has an address on it, it becomes really problematic.
59:14
That's interesting.
59:15
I always think of the passport as the more precious of the identifier.
59:18
So I would always, but that makes total sense.
59:21
Do you think that with like this rise of AI enabled attacks that KYC is going to come
59:26
under a lot of scrutiny and we might actually get a chance of pushing back against it?
59:30
Because I'm not sure the data is clear that it actually protects anyone, but it is creating
59:35
these huge honeypots.
59:36
And we've just seen that Revolut's been got, which is a massive, massive fintech, like
59:41
tons and tons of information.
59:42
and these are just honest people who are trying to use a service who now have their information
59:47
all over the internet i don't know i mean um i don't think anything is going to change unless
59:54
someone in power gets hurt that's like that's the short version like until there's like uh you know
1:00:01
a politician or a really rich and powerful person who who gets burned really badly from this that
1:00:10
they're willing to then go spend a lot of resources to try to get, you know, political
1:00:14
change or regulatory change. No, like, you know, the amount of leaks has been increasing at an
1:00:23
insane pace. And it just, it just seems to be business as usual. It's like, oh, there was another
1:00:29
massive leak this week. Oh, we'll give everybody, you know, free credit reporting and identity
1:00:34
theft protection for a few years and then move on. And, you know, it's very profitable. Like,
1:00:45
the companies that are collecting this information tend to be highly profitable. I think, you know,
1:00:51
the regulators don't want to give up any of their power and any of the sort of surveillance apparatus,
1:00:57
Even though there's many different levels of independent reports that show that, you know, the money laundering has the people that do money laundering professionally laugh at all of these KYC safeguards because they just go out and buy real identities on the dark net for pennies on the dollar and just burn through, you know, stolen identities that can.
1:01:27
get through all of these regulatory compliant systems.
1:01:31
And and if they do get caught, then they just throw it away and pick up another one.
1:01:35
So, yeah, I mean, the whole thing is just a clown show,
1:01:39
but it seems that the people
1:01:43
who are behind it are so entrenched that the incentives aren't there to fix it.
1:01:49
Well, one day they'll get hacked to and and we might get a change.
1:01:53
All right.
1:01:53
Last thing I want to talk to you about, because obviously we're
1:01:56
And Trezor's had a ton of email scams go out recently.
1:02:00
One of their service providers was hacked, I believe.
1:02:03
There'll be a load of people getting a ton of phone calls now
1:02:06
with people trying to convince them to give them their seed words
1:02:08
or go to dodgy websites.
1:02:10
I saw on your Twitter that you had one of these phone calls recently
1:02:13
with a scammer.
1:02:14
Tell everyone what happened there,
1:02:16
because I listened to the sort of three-minute clip
1:02:18
or whatever you put on Twitter, but it sounds very interesting.
1:02:21
Yeah, well, we'll have several lengthy clips coming out soon.
1:02:26
I think close to like 45 minutes
1:02:29
that's worth of conversation.
1:02:33
So basically, you know, like you
1:02:36
and like pretty much everyone else in this space
1:02:38
who has been the subject of data leaks,
1:02:43
I get these calls.
1:02:46
And it's never been a problem for me
1:02:50
because I never answer the phone
1:02:52
if it's a phone number that's not someone
1:02:55
I know personally and talk to regularly.
1:02:57
but we started seeing more of our clients getting these calls
1:03:02
and it just started becoming more of a security concern for us
1:03:06
because we started having some clients that their Google accounts
1:03:11
were getting compromised.
1:03:13
And that was becoming really problematic for us
1:03:15
because then sometimes we'd be trying to actually converse
1:03:24
with the client and the bad guy would be inside their email
1:03:28
and just like deleting the emails from us
1:03:31
and then sometimes responding to us as if it was the client
1:03:34
and saying, oh, you know, everything's fine, so on and so forth.
1:03:38
So the short version is just don't answer the phone
1:03:42
from any number that you don't know.
1:03:46
But also just never trust any incoming message,
1:03:49
whether that's email, phone, direct message on any platform,
1:03:56
unless it's a strongly authenticated end-to-end encrypted system
1:04:01
like Signal or WhatsApp where it'll actually tell you
1:04:05
if your cryptographic exchange has changed,
1:04:10
you cannot rely upon the person that the message is from
1:04:16
actually being that person.
1:04:18
And like all of these things can be spoofed.
1:04:20
Emails can be spoofed.
1:04:22
Phone numbers can be spoofed.
1:04:24
And what I actually ended up doing was I actually,
1:04:28
I took Coinbase and Google's like official business numbers
1:04:33
and added them as contacts in my phone
1:04:35
so that I knew that whenever I got a call from them
1:04:38
that it was one of these social engineers.
1:04:41
And I started picking up the phone.
1:04:43
And, you know, they have a very sophisticated system
1:04:46
where they won't have humans call you.
1:04:49
They actually have an auto dialer,
1:04:52
and it'll call you, and it'll say,
1:04:54
hey, something happened.
1:04:57
Someone logged in here.
1:04:59
If it wasn't you, press one,
1:05:02
and we'll get a human on the phone with you.
1:05:06
And so I started pressing one,
1:05:08
and eventually the humans actually started calling me.
1:05:11
And I would play around with them
1:05:14
for like 20 minutes or so
1:05:16
to get a better understanding of their script
1:05:19
and really like what they were trying to do,
1:05:21
how they're trying to get access.
1:05:23
And then eventually I'd be like,
1:05:25
hey, you know I'm a cybersecurity expert, right?
1:05:29
It's like, you're not going to trick me.
1:05:33
And in that case, they'd either hang up immediately
1:05:35
or they'd be like, oh, shucks.
1:05:37
I was really hoping to get you this time.
1:05:40
And it's interesting because like they knew
1:05:43
that I am the chief security officer of a security company And they still try to pull one over on me because you never know Like even the smartest like most intelligent people
1:05:57
might have a bad day
1:06:00
and might be preoccupied with thinking about other things.
1:06:03
And really what they're trying to do is
1:06:05
social engineers are hacking your brain
1:06:10
and they're doing this via psychological methods.
1:06:13
they're usually using like fear, uncertainty, doubt. They're using a sense of urgency to be
1:06:22
like, there's a security issue and you need to fix it right now. And I am a trustworthy employee of
1:06:28
this billion dollar company. And I will tell you how to fix your security issue. But meanwhile,
1:06:33
what they're actually doing is they're tricking you into compromising your security so that they
1:06:38
can get into your email. And from there, you know, most people have like one or two email addresses,
1:06:44
and that's like the primary nexus of all of your other accounts. And once they get into that,
1:06:50
they can start getting into all of your other financial accounts, and they'll be looking for
1:06:54
what exchanges you're using. They'll be looking for seed phrase backups and photos of like your
1:07:01
seed phrase. They're highly sophisticated organizations now where they have different
1:07:09
people that specialize in doing different things. And so I was talking to the guy who specializes in
1:07:14
tricking people into getting to their email accounts. And he gets paid for every email
1:07:20
account he gets into, regardless of whether or not there's anything valuable in there. And then
1:07:24
he'll also get a cut of whatever the take is if something else is found. But then they have other
1:07:29
people that specialize and then doing, you know, the crypto related stuff. And then they also have
1:07:34
other people that specialize in doing the wrench attacks. Um, and, and those people then, you know,
1:07:39
coordinate other people on the ground, you know, sort of the henchmen, the, the two bit thugs to
1:07:44
actually go and, and do the attacks. And, you know, these, like I said, they're, they're complicated
1:07:49
and sophisticated, um, international crime rings at this point. And they, they do this all day long.
1:07:56
and they the thing about security and about all this stuff is that um if you're the defender you
1:08:05
have to be successful 100 of the time but if you're the attacker you only have to succeed one time and
1:08:11
that's just another one of the asymmetries in the space it was crazy like listening to it the thing
1:08:16
that shocked me is how much money they're making as well i i can't remember was it did he say he's
1:08:20
making about 800 per email he gets into he was saying he can make up to about five grand a day
1:08:25
or something. Like it's real good money. Um, how did you actually get him talking?
1:08:31
Um, well, you know, we just eased into it, uh, of, of me playing dumb for a while. Um,
1:08:38
and, and then, you know, the, the trick is to not be an asshole, which is really hard because
1:08:45
these, these guys, you know, they're doing terrible stuff, but once you get them talking,
1:08:50
like they're just normal human beings, like everyone else, they tend to be young guys,
1:08:54
generally in their 20s.
1:08:59
And the reason that they're doing this
1:09:02
is because it's just insanely profitable.
1:09:05
And they tend to have a mercenary mindset of I am almost like a Robin Hood mindset of like I going after guys who are so rich that it not gonna be the end of their life if I take millions of dollars from
1:09:21
them because they're so well off. And that's like, he literally said something kind of like that to
1:09:26
me of like, oh, you've been in Bitcoin so long, you know, you would be fine. And it's like,
1:09:31
I guess we can just completely gloss over the fact that you're stealing from people who have spent a lot of time and effort building up their wealth, and you're just going to take it from them in a matter of an hour or so and not have any sort of regrets about that.
1:09:51
But that's how it goes when you get into the criminal world is that people will justify that whatever they're doing isn't so bad.
1:10:02
And I don't know if you can talk about this, but before we started recording, you said there might be something coming from someone from North Korea.
1:10:08
Yeah. Well, we've already said a few times security in this space, it's coming from a million different directions.
1:10:19
And we've only talked about a few of the different things that I'm dealing with. But another is that, especially if you are running a company in this industry, there are nation state backed threat actors that want to get inside of your infrastructure.
1:10:41
And they're going to do that in any number of ways.
1:10:46
I think a lot of the people out there will be familiar.
1:10:49
Lazarus Group, which is the Democratic People's Republic of Korea, they do a lot of DeFi hacking.
1:10:58
They love hacking smart contracts and other types of projects.
1:11:02
And I think they've taken billions and billions of dollars through that.
1:11:05
But what they also love to do is to pose as technical security and software engineer to get jobs at companies.
1:11:21
Because if you can get employed by one of the companies in this industry, you're going to start to get access to privileged systems.
1:11:30
maybe not production systems, but at least development environments.
1:11:36
We posted a job posting for security engineer position,
1:11:42
which of course is a highly privileged position that would eventually get production level access
1:11:48
if you build up a level of reputation and trust with us.
1:11:53
and we just got an insane number of North Korean actors
1:12:00
that were applying for this position.
1:12:04
And a lot of them, it's very easy to weed out
1:12:07
just from looking at the resume, LinkedIn profile, so on and so forth.
1:12:12
But some of them get a little further along in the funnel.
1:12:16
And what was particularly surprising this time around,
1:12:20
And I've never had them get to me before.
1:12:25
And I usually the second or third person after initial call screening And what we realized was happening is that they were using an actual American for the
1:12:40
first initial video interview, and then they would swap out with the North Korean on the
1:12:47
second interview.
1:12:50
And they're good at answering the technical questions related to the job description,
1:12:57
the job that they're trying to actually interview for.
1:13:01
And they probably even have some of the skills where they would be able to do that job.
1:13:06
But as it is with everything in this space, if you know the right techniques, if you know
1:13:13
how to catch them off guard, if you know how to ask them the questions that they're not
1:13:18
prepared for that a real American would be able to answer, then it's actually pretty easy
1:13:25
to trip them up.
1:13:26
And the difference between those guys and the social engineering guys is that you can't really get them to open up about what they're doing, probably because they're being monitored by their military or whatever state organization is actually sponsoring them.
1:13:47
So they tend to hang up pretty quickly after you ask them a few questions that they're not prepared to respond to.
1:13:58
What do you think of your supreme leader?
1:14:01
What question are you asking?
1:14:03
Yeah, that's an easy one is to try to get them to defame King Jong-un.
1:14:08
But other less obvious ones tend to be cultural related questions.
1:14:15
Like I said, they build up a persona profile of who they're supposed to be.
1:14:22
They're trying to impersonate.
1:14:23
And so they'll know some of the background of the resume that they've given to you.
1:14:28
But a few things that I've done is dig into more personal questions based upon the resume that would normally not be asked in an interview,
1:14:40
but which any normal person would be able to answer.
1:14:43
things about their college life experience and stuff like that.
1:14:51
There's also any number of other American cultural questions
1:14:56
that you can ask that they're just not prepared for.
1:15:00
They just don't really know anything about American culture.
1:15:03
Super interesting.
1:15:04
You've got to be careful out there.
1:15:05
There's North Korean sleeper cells.
1:15:08
Damn, there's so much to be conscious of right now.
1:15:10
But Jameson, this has been awesome.
1:15:11
I think there's hopefully been some good actionable advice
1:15:14
for people who are rethinking their security setup.
1:15:17
Tell everyone when they go to follow you
1:15:18
and find out more about Casa.
1:15:21
Well, you can find me on X.
1:15:23
My handle is just L-O-P-P.
1:15:26
Check out Casa.
1:15:27
It's C-A-S-A dot I-O.
1:15:31
Perfect.
1:15:32
Appreciate the time, man.
1:15:33
Thank you for this.
1:15:35
You bet.
1:15:41
Thank you.