1
00:00:00,000 -->
00:00:12,120
Hello, everyone. Welcome back to another emergency broadcast of Bitcoin News Live. We've got a great
2
00:00:12,120 -->
00:00:18,180
panel ahead of us today to describe what is going on with the ongoing cold card exploit, the over
3
00:00:18,180 -->
00:00:25,440
1800 Bitcoin that have been stolen and what to do next. So let's get right into it. On July 30th,
4
00:00:25,440 -->
00:00:29,340
someone emptied 1100 Bitcoin wallets in 41 minutes.
5
00:00:30,020 -->
00:00:33,920
There wasn't a single person phished and nobody touched a single device.
6
00:00:34,200 -->
00:00:37,600
Those wallets were simply drained while in cold storage.
7
00:00:38,300 -->
00:00:42,380
Because five years ago, a build error meant the keys generated by cold cards
8
00:00:42,380 -->
00:00:45,620
were never really random in the first place.
9
00:00:46,220 -->
00:00:49,560
Every one of them was guessable from the day it was created.
10
00:00:49,560 -->
00:00:55,320
And the average coin taken had been sitting untouched for more than three years.
11
00:00:55,440 -->
00:00:59,240
These people believe that they did everything right.
12
00:00:59,940 -->
00:01:02,320
And the attack is still running now.
13
00:01:02,520 -->
00:01:06,280
This morning, at least 15 different thieves are hunting the same wallets.
14
00:01:06,840 -->
00:01:14,800
Today, we have three Bitcoin security experts to walk us through the situation and explain what to do next if you are still affected.
15
00:01:15,380 -->
00:01:17,840
Gentlemen, going to add you up on stage.
16
00:01:18,400 -->
00:01:20,800
Thank you so much for joining us.
17
00:01:20,800 -->
00:01:27,660
we have Jan, the head of security over at Treasure, Nick, the head of Casa, and Jameson,
18
00:01:27,780 -->
00:01:33,720
the CTO over there at Casa as well. Three gentlemen who I think have a very interesting
19
00:01:33,720 -->
00:01:41,180
and skilled perspective on this subject we are dealing with. So Jan, as the head of security
20
00:01:41,180 -->
00:01:47,900
over at Treasure, I'd like to start this question over to you. Please explain what happened with the
21
00:01:47,900 -->
00:01:54,040
cold card simply for people to understand? Was this software, hardware, where did it all go wrong?
22
00:01:55,120 -->
00:02:00,960
Sure. So there was a critical bug in firmware, in the most critical part of the firmware,
23
00:02:01,460 -->
00:02:10,980
which is seed generation. So this is the basic function of every wallet. The seed that it
24
00:02:10,980 -->
00:02:20,040
generates has to be truly random. It has to have enough entropy. You can imagine your wallet seed
25
00:02:20,040 -->
00:02:29,920
as a huge number and this number for it to be random has to be picked from a huge range of
26
00:02:29,920 -->
00:02:40,900
numbers. The biggest number on this range is or should be bigger than the amount of atoms in
27
00:02:40,900 -->
00:02:49,860
known universe so uh it is very huge and for someone trying to brute force to guess this number
28
00:02:49,860 -->
00:02:53,860
even using the most advanced technology they would have to spend their entire life
29
00:02:54,420 -->
00:03:00,500
and it would still not be enough in fact it has never happened in bitcoin history for anyone to
30
00:03:00,500 -->
00:03:07,060
brute force a wallet seat if the seed was generated correctly but that's the problem here with this
31
00:03:07,060 -->
00:03:14,180
vulnerability the seed was not generated correctly it didn't use the true random number generator
32
00:03:14,180 -->
00:03:22,180
module it was supposed to use true randomness comes from sources that are not predictable like
33
00:03:23,780 -->
00:03:30,180
temperature inside the microprocessor for example or some time variations between processes this is
34
00:03:30,180 -->
00:03:31,920
This is something no one can guess.
35
00:03:31,920 -->
00:03:36,160
And that was a function in cold cards code
36
00:03:36,160 -->
00:03:39,960
that was supposed to guarantee that this is used.
37
00:03:39,960 -->
00:03:44,340
But unfortunately there was a bug on one line,
38
00:03:44,340 -->
00:03:48,560
which was supposed to check whether this is enabled or not.
39
00:03:48,560 -->
00:03:51,120
But unfortunately it was just checking
40
00:03:51,120 -->
00:03:53,980
whether this function exists or not.
41
00:03:53,980 -->
00:03:58,680
And that's unfortunately a critical vulnerability
42
00:03:58,680 -->
00:04:02,060
that was introduced back in March, 2021.
43
00:04:02,060 -->
00:04:06,700
And probably no one really noticed until now
44
00:04:06,700 -->
00:04:09,720
and people started abusing it.
45
00:04:11,920 -->
00:04:16,400
So there was a fallback to a different source of entropy,
46
00:04:16,400 -->
00:04:20,300
but it's called pseudo entropy
47
00:04:20,300 -->
00:04:24,360
because it doesn't use these truly random inputs.
48
00:04:24,360 -->
00:04:29,360
Instead, it used things like ID of the microprocessor
49
00:04:30,800 -->
00:04:34,800
or system timer.
50
00:04:34,800 -->
00:04:37,860
And these are things that people can guess.
51
00:04:37,860 -->
00:04:39,380
They're not random enough.
52
00:04:39,380 -->
00:04:40,740
The entropy is lower.
53
00:04:40,740 -->
00:04:44,640
It's not 128 bytes as it should be.
54
00:04:44,640 -->
00:04:47,480
It was something between 32 and 40.
55
00:04:47,480 -->
00:04:52,480
So the attackers took advantage of that.
56
00:04:54,360 -->
00:05:04,800
What this means, if you initiated your cold card anytime between March 2021 and last week, you are affected.
57
00:05:05,360 -->
00:05:07,500
And no firmware update can fix it.
58
00:05:07,600 -->
00:05:19,343
It fixes seed generation But if your seed was already generated you are vulnerable and you should move your funds quickly just using a different wallet even
59
00:05:19,343 -->
00:05:25,023
treasure or anything does not help you you have to get this wallet generate a new seed and then
60
00:05:25,023 -->
00:05:33,663
send the funds to it theoretically you should be safe if you use some extra features on the cold
61
00:05:33,663 -->
00:05:40,623
card during the seed generation like the dice rolls but you would have to do 100 dice rolls
62
00:05:40,623 -->
00:05:46,943
and do that properly or you could have super secure passphrase that is at least eight random
63
00:05:46,943 -->
00:05:54,143
words or 16 random characters for you to be so so safe but still i would recommend to move the funds
64
00:05:54,143 -->
00:05:57,563
How this happened?
65
00:06:00,443 -->
00:06:05,723
ColdCard is an air-gipped device, which is a security layer.
66
00:06:06,123 -->
00:06:10,623
It means that it does not communicate directly with the host, the host being a computer here.
67
00:06:12,263 -->
00:06:23,723
Being air-gipped means that you would use partially signed transactions and QR codes for the devices to communicate, but there is no direct channel.
68
00:06:24,143 -->
00:06:28,683
So this prevents a theoretical man in the middle attack.
69
00:06:29,423 -->
00:06:30,963
However, there's a problem.
70
00:06:30,963 -->
00:06:36,243
This security layer means that you cannot use the host,
71
00:06:36,603 -->
00:06:39,423
the computer or phone as a source of entropy
72
00:06:39,423 -->
00:06:40,803
when you generate the seed.
73
00:06:42,083 -->
00:06:48,203
So ColdCard was only relying on the one source of entropy.
74
00:06:48,763 -->
00:06:51,723
And because of this bug in the code, it was not used.
75
00:06:52,603 -->
00:06:59,803
so this is different in trezor in trezor we're not pair gapped we use cable or bluetooth because
76
00:06:59,803 -->
00:07:07,243
we don't think the security benefits of the air gap are enough and obviously there are drawbacks
77
00:07:07,243 -->
00:07:14,283
to this approach so we always use uh entropy from host and it's also validated by the entropy check
78
00:07:14,283 -->
00:07:17,763
in Trezor Suite that this entropy is used.
79
00:07:19,423 -->
00:07:23,043
Also an extra measure, we don't have any sort of fallback
80
00:07:23,043 -->
00:07:26,523
to the testing module of pseudorandom generating
81
00:07:27,483 -->
00:07:28,603
in our firmware.
82
00:07:28,603 -->
00:07:30,743
So also this should not happen.
83
00:07:33,903 -->
00:07:34,903
So basically that's it.
84
00:07:34,903 -->
00:07:37,883
What's also interesting about this vulnerability
85
00:07:37,883 -->
00:07:39,783
is how it was introduced.
86
00:07:39,783 -->
00:07:43,223
Coldcard was initially forked from Trezor.
87
00:07:43,223 -->
00:07:46,223
That's why people sometimes ask whether this vulnerability
88
00:07:46,223 -->
00:07:48,943
is also present in Trezor, but it is not.
89
00:07:48,943 -->
00:07:53,943
Because later Coldcard's code was also forked
90
00:07:54,343 -->
00:07:58,583
by their competitor and they decided to change
91
00:07:58,583 -->
00:08:01,963
their licensing so that no more competitors
92
00:08:01,963 -->
00:08:04,023
can use their code.
93
00:08:04,023 -->
00:08:07,343
And in order to do this, they had to rewrite the code base.
94
00:08:08,383 -->
00:08:12,663
And during this rewrite, they introduced this bug,
95
00:08:12,663 -->
00:08:21,183
proportionally. So that's why only cold card is vulnerable and no other hardware wallets at this
96
00:08:21,183 -->
00:08:28,623
point. Thank you for that great explanation there. And Jameson, people have looked at this firmware
97
00:08:28,623 -->
00:08:33,943
problem from back in 2021. Some people have brought up this issue over the last couple of years.
98
00:08:34,423 -->
00:08:39,423
How inexcusable is it for this company CoinKite, as well as the wider Bitcoin community,
99
00:08:39,423 -->
00:08:46,943
that this was not addressed sometime since 2021? That's a difficult question to answer
100
00:08:46,943 -->
00:08:54,863
because you can play coulda, woulda, shoulda all day long. The short version is like there
101
00:08:54,863 -->
00:09:05,023
is no such thing as perfect software. We assume all software, all hardware has some level of
102
00:09:05,023 -->
00:09:16,063
vulnerabilities. Really, I think the problems that come up are, first of all, people having this
103
00:09:16,063 -->
00:09:23,423
assumption that open source software is automatically secure. And that is not the case.
104
00:09:23,423 -->
00:09:30,623
The reason that open source software is generally more secure, at least in the case where it is
105
00:09:30,623 -->
00:09:35,303
popular software is because you end up with more eyes on the code.
106
00:09:36,083 -->
00:09:41,783
I think that one of the issues that happened here is that, you know,
107
00:09:41,783 -->
00:09:46,563
CoinKite is one of the smaller companies in the space. You can, you could,
108
00:09:46,643 -->
00:09:50,963
you know, compare CoinKite to Trezor or Ledger along any number of vectors,
109
00:09:50,963 -->
00:09:56,003
such as like employee headcount or revenue or total number of devices shipped
110
00:09:56,003 -->
00:10:03,683
or whatever. And I think that in comparison, your coin kite is probably an order, if not several
111
00:10:03,683 -->
00:10:09,663
orders of magnitude smaller. And therefore, you know, they just have fewer resources devoted to
112
00:10:09,663 -->
00:10:15,583
looking at this, fewer contributors looking at the code. I think coin kite only had like one or two
113
00:10:15,583 -->
00:10:32,646
engineers like full time that we actually working on this There have been you know as As this has come out a few other random security researchers have piped up and said hey I was looking at the code a few years ago and noticed some weird stuff
114
00:10:33,286 -->
00:10:38,406
And some of them have even said I was looking directly at that line of the code and something
115
00:10:38,406 -->
00:10:45,606
felt wrong, but I couldn't actually find the problem. And so another part of the problem with
116
00:10:45,606 -->
00:10:56,326
this is that, as he said earlier, the actual bug was arguably not in the main part of the
117
00:10:56,326 -->
00:11:02,726
micro Python code, but rather it was in the build system. And I think that when people are looking
118
00:11:02,726 -->
00:11:08,966
at the code, they're just less likely to look at the build system. We've also heard from a number
119
00:11:08,966 -->
00:11:18,166
of security researchers that have used LLMs to audit the firmware of Coldcard is that this is not
120
00:11:18,166 -->
00:11:24,646
something that all of the LLMs are catching either. It really has to do with how much context
121
00:11:24,646 -->
00:11:30,326
you're giving to the LLM. You're basically having to tell it, look at the entirety of all of the
122
00:11:30,326 -->
00:11:36,966
submodules within the code base simultaneously and try to find any ways that they could be linked
123
00:11:36,966 -->
00:11:42,506
together poorly. Because if you're just looking at the code line by line, it's a lot less obvious
124
00:11:42,506 -->
00:11:48,526
that this is a problem. And I think right now is a good juncture, 10 minutes in to give a PSA. If
125
00:11:48,526 -->
00:11:53,186
you are watching this and don't know what's going on, if you have a cold card from 2021 or later,
126
00:11:53,186 -->
00:12:01,386
you need to move your funds off of that device as calmly, but as quickly as possible. They are at
127
00:12:01,386 -->
00:12:08,506
risk this attack is ongoing since july 30th over 1800 bitcoin have been stolen thus far
128
00:12:08,506 -->
00:12:14,346
uh nick i would love to get your perspective on the attack uh how it's played out as you
129
00:12:14,346 -->
00:12:19,626
as somebody who's always thinking about bitcoin security um what's what's transgressed over the
130
00:12:19,626 -->
00:12:28,026
last four days well so actually one thing to add to your psa there is some so you know originally
131
00:12:28,026 -->
00:12:34,666
the cold cards that were getting hacked were the mk3s and we think that a lot of the just like
132
00:12:34,666 -->
00:12:41,866
default mk3s are basically either drained by the attackers or people have moved the assets to safety
133
00:12:41,866 -->
00:12:50,586
by now and so there may not be a lot left and so then for mk4s q cold card q and mk5 those are a
134
00:12:50,586 -->
00:12:55,146
a little bit harder to crack than MK3 for various reasons.
135
00:12:55,946 -->
00:12:59,366
And we think that there haven't been any cracked yet,
136
00:12:59,366 -->
00:13:01,106
but that it might still be possible.
137
00:13:01,946 -->
00:13:05,026
And so you should still move off of those
138
00:13:05,026 -->
00:13:07,106
if you're on a single SIG with those.
139
00:13:08,386 -->
00:13:11,506
And then the last thing is some people have been saying,
140
00:13:11,726 -->
00:13:16,746
hey, if you have a passphrase on your MK3, then you're okay.
141
00:13:16,966 -->
00:13:18,666
And Jan mentioned this earlier.
142
00:13:18,666 -->
00:13:24,466
and Jan said this, but the really critical point that I want to re-highlight is often the pass
143
00:13:24,466 -->
00:13:30,026
phrase is called the 25th word to your seed phrase. And so people might just think of it as like, ah,
144
00:13:30,146 -->
00:13:36,186
I just had one more word in here. And if you did one word, your wallet is definitely not safe
145
00:13:36,186 -->
00:13:41,926
because the next step that they're going to do after they went through all the MK3s with
146
00:13:41,926 -->
00:13:48,266
no pass phrases, and I think they're already doing this, is they're starting to just go through very
147
00:13:48,266 -->
00:13:57,146
low entropy, AKA like small pass phrases and try to grind through those, you know, from a compute
148
00:13:57,146 -->
00:14:02,766
perspective to fit, to, to guess what they are. So if you're using a bad pass phrase, that isn't like
149
00:14:02,766 -->
00:14:07,086
the eight words that Jan was saying earlier, which I think a lot of people don't necessarily
150
00:14:07,086 -->
00:14:13,346
take that approach. You still need to move off your cold card very quickly because your funds
151
00:14:13,346 -->
00:14:22,546
are up next to be attacked um so it like the blanket advice is just if you are using a cold
152
00:14:22,546 -->
00:14:31,106
card move your assets not worth risking it um the second thing uh to answer your question about like
153
00:14:31,106 -->
00:14:37,826
what's taken place over the last few days unfortunately like it's kind of the nightmare
154
00:14:37,826 -->
00:14:44,466
fuel scenario of the whole situation of like cold storage in general because um you take this
155
00:14:44,466 -->
00:14:49,906
approach where you're like well i've got this air-gapped hardware wallet the only way somebody's
156
00:14:49,906 -->
00:14:56,386
going to get this is if i mistakenly put my seed phrase into the internet somewhere or maybe if
157
00:14:56,386 -->
00:15:01,426
somebody like wrench attacks me or tricks me into giving them information so that they can steal
158
00:15:01,426 -->
00:15:07,786
my money. But this was just straight up like, no, you could have done kind of the default setup
159
00:15:07,786 -->
00:15:13,406
on an air-gapped hardware wallet, thought you were safe, and somebody was suddenly able to
160
00:15:13,406 -->
00:15:22,106
remotely crack it. And so this is, it's a very bad situation for the people who owned these
161
00:15:22,106 -->
00:15:29,666
wallets, obviously, but it's also just kind of sad because I think it has a, it puts a bad
162
00:15:29,666 -->
00:15:46,749
reflection on like self hardware wallets in general if you not really like if you just thinking it like kind of looking at it from the outside like i seen people say oh this this shows you how hard self custody is and and you know maybe people should just trust a custodian and i don think that
163
00:15:46,749 -->
00:15:50,909
necessarily should be the takeaway from this i actually have a very different takeaway which we
164
00:15:50,909 -->
00:15:57,629
can go into but like the unfortunate part of this type of vulnerability and attack is that is the
165
00:15:57,629 -->
00:16:03,089
kind of naive conclusion to make from this. And so I'm afraid a lot of people might make that
166
00:16:03,089 -->
00:16:09,529
conclusion. Yeah, we're going to dive into the future of self-custody and best practices moving
167
00:16:09,529 -->
00:16:14,009
forward. But there are still some basic things I want to touch on before we get there. And that's
168
00:16:14,009 -->
00:16:22,309
the idea of entropy and how to generate it. Lop, I saw you post, you had some mycelium
169
00:16:22,309 -->
00:16:26,048
entropy generator that you played with a couple of years ago.
170
00:16:26,668 -->
00:16:31,729
Talk about how to properly generate entropy and how much is enough.
171
00:16:34,489 -->
00:16:42,889
Yeah, I mean, the real problem that comes down to is how do you know if you have the
172
00:16:42,889 -->
00:16:44,428
appropriate level of entropy?
173
00:16:44,428 -->
00:17:05,369
And, you know, in general, the other hardware devices like Trezor, Ledger, whatnot, as far as I know, and I think we can be pretty comfortable saying that, you know, they are properly generating sufficient level of entropy.
174
00:17:05,369 -->
00:17:09,869
Now this, you say, how do you know?
175
00:17:09,869 -->
00:17:13,589
Well, Trezor is open source.
176
00:17:13,589 -->
00:17:18,049
I'm sure even more people are gonna be going
177
00:17:18,049 -->
00:17:20,549
and inspecting all of that code now.
178
00:17:20,549 -->
00:17:22,689
In fact, like there are entire teams of people
179
00:17:22,689 -->
00:17:24,948
that are devoting tens of thousands of dollars
180
00:17:24,948 -->
00:17:27,909
of hardware and compute time to doing that.
181
00:17:27,909 -->
00:17:31,968
So, I mean, that's kind of the bright side to all of this
182
00:17:31,968 -->
00:17:34,889
is that whenever there is a security incident
183
00:17:34,889 -->
00:17:39,968
The result is Bitcoin and this whole ecosystem is anti-fragile.
184
00:17:39,968 -->
00:17:42,488
And so we are going to get stronger as a result.
185
00:17:42,488 -->
00:17:46,708
We are going to continue to improve our best practices.
186
00:17:46,708 -->
00:17:54,728
But for the average, like normal person who they may have heard this concept of don't trust, verify.
187
00:17:54,728 -->
00:18:04,248
I think we should probably have a bit more self-reflection on that mantra and be more honest with ourselves
188
00:18:04,248 -->
00:18:11,849
that very few people actually have the capability of verifying, especially at the software level,
189
00:18:11,849 -->
00:18:15,928
and especially at the hardware level. Like even myself with a computer science background, I can
190
00:18:15,928 -->
00:18:22,488
read code generally. I don't have the capability to inspect hardware. Like that's something that,
191
00:18:22,488 -->
00:18:28,409
you know, like maybe the Ledger Donjon team has the capability to do, but like almost nobody has
192
00:18:28,409 -->
00:18:34,248
the capability to do that. So point being at some level, you're probably going to be trusting
193
00:18:34,889 -->
00:18:43,688
someone or something in this process, unless you're doing your own entropy generation.
194
00:18:43,688 -->
00:18:47,529
What does that mean? Well, you know, like even the device that I showed that that was
195
00:18:47,529 -->
00:18:54,968
an interesting little toy that never really took off. Though the way to be sure is if you are
196
00:18:54,968 -->
00:18:59,708
physically doing something with your own hands. So that's where you start to see stuff about,
197
00:18:59,769 -->
00:19:06,188
you know, rolling dice or, you know, getting playing cards and picking them up. But then of
198
00:19:06,188 -->
00:19:10,988
course, you're having to take that and you're having to do something to translate that into
199
00:19:10,988 -->
00:19:18,789
the number, which ultimately results in the huge, you know, two to the 128 size number that Jan was
200
00:19:18,789 -->
00:19:25,349
mentioning earlier. And this is where once again, the sort of don't trust verify thing becomes a
201
00:19:25,349 -->
00:19:33,349
problem, because you're probably going to be using some software to do that translation. Are you going
202
00:19:33,349 -->
00:19:38,089
to then go read the software that's doing that translation? Probably not. There is something
203
00:19:38,089 -->
00:19:45,369
called Codex 32, which is I think a sort of pencil and paper way of doing it. But you know, that is
204
00:19:45,369 -->
00:19:50,349
going to take a lot of work. So you've got to be pretty dedicated to do that. So, you know, what,
205
00:19:50,529 -->
00:19:57,109
what I guess would be the best practice for a non-technical person? If you want to be super
206
00:19:57,109 -->
00:20:02,409
duper sure, I mean, there's a few options. Of course, there's the like multi-key multi-vendor
207
00:20:02,409 -->
00:20:07,109
option of just, you don't trust any one vendor and you're, you're, you're generating entropy
208
00:20:07,109 -->
00:20:11,948
on multiple different pieces of hardware and software from different vendors. And, and then
209
00:20:11,948 -->
00:20:17,409
And it's okay if one of them has weak entropy because it doesn't bust your whole wallet.
210
00:20:17,409 -->
00:20:22,289
If you're doing single SIG though, I think you would want to do something similar where
211
00:20:22,289 -->
00:20:26,909
you're going to want to have multiple different pieces of software and hardware.
212
00:20:26,909 -->
00:20:33,869
They're all running that same numerical translation so that you're basically, you're not trusting
213
00:20:33,869 -->
00:20:38,129
anyone, but you're basically verifying or you're attesting them against each other to
214
00:20:38,129 -->
00:20:40,809
make sure that they're both doing the same thing.
215
00:20:40,809 -->
00:20:42,849
Therefore, the likelihood that they both have
216
00:20:42,849 -->
00:20:47,208
the same exact vulnerability or bug becomes much lower.
217
00:20:47,208 -->
00:20:49,968
I think the thing with this,
218
00:20:50,011 -->
00:20:53,071
This is, we're talking a lot about entropy right now.
219
00:20:53,571 -->
00:20:57,831
The chance of there being another entropy bug feels pretty low,
220
00:20:58,111 -->
00:21:02,351
because because of this, everybody's paying a lot of attention to entropy.
221
00:21:02,911 -->
00:21:08,871
The chances of there being a different kind of bug that might affect your funds in a different way,
222
00:21:08,951 -->
00:21:14,871
maybe it's not as catastrophic as the entropy bug, but some other kind of security vulnerability,
223
00:21:15,631 -->
00:21:16,451
this is security.
224
00:21:16,451 -->
00:21:24,251
It's a constant game of cat and mouse, whereas people make updates to the products that they put out there for people to use for this.
225
00:21:24,511 -->
00:21:26,791
They have a chance of introducing bugs.
226
00:21:26,971 -->
00:21:36,131
And there are attackers out there that are always searching for holes in the code or whatever product you're using that they can take advantage of.
227
00:21:36,131 -->
00:21:48,131
And so you want to plan to protect yourself with multiple levels of defense so that you are prepared no matter what the vulnerability is.
228
00:21:49,571 -->
00:21:55,211
And another way to add entropy on top is the passphrase, 25th word.
229
00:21:55,351 -->
00:21:56,871
We mentioned that briefly before.
230
00:21:57,531 -->
00:21:58,631
Jan, talk to us.
231
00:21:58,731 -->
00:22:01,911
How do you properly make a passphrase in this environment?
232
00:22:01,911 -->
00:22:24,911
Yeah, so passphrase, in order to be really safe, has to be super long and random. In order for it to be random, you should use some software, probably, that generates a random passphrase, like password manager.
233
00:22:24,911 -->
00:22:29,991
manager, then again, you're trusting some software, but a lot of these tools are open
234
00:22:29,991 -->
00:22:34,091
source and battle tested.
235
00:22:34,091 -->
00:22:36,631
So that's one way to generate the passphrase.
236
00:22:36,631 -->
00:22:40,931
But of course, if you do this, there is the drawback that you digitalize the passphrase.
237
00:22:40,931 -->
00:22:47,971
So there is some digital footprint, maybe controversial, but I think that is fine as long as the seed
238
00:22:47,971 -->
00:22:50,831
itself doesn't have a footprint.
239
00:22:50,831 -->
00:22:57,391
again if if there is a vulnerability in the seed generation then this doesn't help you much so
240
00:22:58,591 -->
00:23:04,511
all in all i'm a little bit skeptical about passphrases uh it's a very advanced feature we've
241
00:23:04,511 -->
00:23:10,031
been recommending with trezor for a long time but it's also a massive foot gun for people so
242
00:23:10,751 -->
00:23:17,071
it's no longer a default feature in treasure suite because what people do is that they set
243
00:23:17,071 -->
00:23:22,831
a passphrase then they forget about it because they treat it as a password and then they reach
244
00:23:22,831 -->
00:23:28,671
out to our customer support hey can i reset the passphrase and unfortunately no you lost your
245
00:23:28,671 -->
00:23:38,751
bitcoin um so passphrase is a way um that can help you here but really it's an advanced feature
246
00:23:38,751 -->
00:23:47,611
not for everyone so not not really a silver spoon that can help you yeah just
247
00:23:47,611 -->
00:23:55,131
i wanted to point out real quick that like uh i'm so glad that jan just said that because
248
00:23:55,131 -->
00:24:02,611
um if you're going around listening to twitter spaces for the last few days you're hearing all
249
00:24:02,611 -->
00:24:09,631
of the kind of like influencer guys being like, use a passphrase, roll dice, do these different
250
00:24:09,631 -->
00:24:16,191
things to add entropy. And when you talk to the people who are building products used by lots of
251
00:24:16,191 -->
00:24:22,371
people to do these things, they're telling you people tend to mess up passphrases because they
252
00:24:22,371 -->
00:24:27,131
forget that they did it. And then they think it's a password and then they lose all their money.
253
00:24:27,131 -->
00:24:46,631
And so like it behooves people to listen to the people who have the battle scars of like, we have actually dealt with lots and lots of customers using Bitcoin wallets. And like some of these things that are being suggested as so easy by the experts are for many people, big time foot guns.
254
00:24:46,631 -->
00:24:56,151
Yeah, it's very easy to do what I would call actually perfectly securing your Bitcoin.
255
00:24:56,711 -->
00:25:08,231
And this is one of the things about security in general. And I think this is what makes a lot of people uneasy in the space is that actually like there is no such thing as a guaranteed security or perfect security.
256
00:25:08,231 -->
00:25:16,191
unless you're talking about something where, you know, if you want to perfectly secure your Bitcoin,
257
00:25:16,471 -->
00:25:21,651
you basically generate a private key, send the Bitcoin to the corresponding address,
258
00:25:21,651 -->
00:25:26,191
and then you destroy the private key. Great. You now have perfectly secure Bitcoin.
259
00:25:26,731 -->
00:25:32,211
However, it's not very useful Bitcoin to you. So like the problem with the security game and the
260
00:25:32,211 -->
00:25:38,671
reason why this is a big industry and the reason why this is never going to stop being a back and
261
00:25:38,671 -->
00:25:44,951
forth is that what all of us here, like everyone who works at a security related organization,
262
00:25:44,951 -->
00:25:51,671
what we're trying to do is we're trying to find the right balance between security and convenience.
263
00:25:52,351 -->
00:26:08,488
We want people to be able to use their Bitcoin when they want to while not allowing unauthorized people to use their Bitcoin And that the real challenge especially then when you have been in the space long enough and you start seeing just all of the
264
00:26:08,488 -->
00:26:17,268
ways that people can naively and accidentally harm themselves. And it's an unfortunate
265
00:26:17,268 -->
00:26:24,228
problem that I think is the natural result of just freedom in general, is that people love
266
00:26:24,228 -->
00:26:29,188
exercising their freedom, but they don't always like having to put in the effort required to
267
00:26:29,188 -->
00:26:35,108
actually take the responsibility that comes along with it. And one thing that was jarring really
268
00:26:35,108 -->
00:26:40,588
this week is that a lot of people had to move their funds under a state of duress, right? Like
269
00:26:40,588 -->
00:26:46,088
this was Friday, you heard the news on Twitter, you needed to either send your single SIG or put
270
00:26:46,088 -->
00:26:51,508
your multi-SIG together and get those Bitcoin off a cold card. And a lot of people just didn't have
271
00:26:51,508 -->
00:26:56,188
the practice. They had sent the Bitcoin once to a cold card and then had just never touched it.
272
00:26:56,528 -->
00:27:01,708
And when you do that, the device itself could just malfunction sitting in a drawer somewhere,
273
00:27:01,708 -->
00:27:07,748
or you just get too scared and you mess up, you fat finger it. How do you say people should
274
00:27:07,748 -->
00:27:12,468
practice using their Bitcoin, playing with their Bitcoin so that they're ready in a situation like
275
00:27:12,468 -->
00:27:17,988
this? Start with Nick and then go around the whole entire table. Everyone should have fun
276
00:27:17,988 -->
00:27:22,368
playing with their Bitcoin. Yeah, Trump was right at the Bitcoin conference. Like you need to have
277
00:27:22,368 -->
00:27:29,268
fun playing with your Bitcoins because this gives you the comfort to use it when the time comes.
278
00:27:29,768 -->
00:27:35,748
And so like we always say that you should always, any wallet that you're using, you should test,
279
00:27:36,048 -->
00:27:40,928
send, before you start using it, send a little bit in, send it back out, make sure that you feel
280
00:27:40,928 -->
00:27:46,468
comfortable with that process. But then a lot of people treat cold storage as something where you
281
00:27:46,468 -->
00:27:51,588
kind of lock it up, you dig the hole in the backyard, you bury it, you don't think about it
282
00:27:51,588 -->
00:27:58,368
for years, and that's that. Actually, in self-custody, you need to be doing very regular
283
00:27:58,368 -->
00:28:04,308
maintenance of your setup. And it's important to do that because of all the things that you said,
284
00:28:04,308 -->
00:28:10,928
like what happens if your key, your hardware device malfunctions and breaks? We've seen over
285
00:28:10,928 -->
00:28:15,928
the years, we've seen hardware wallets just completely stop working, like the screen will
286
00:28:15,928 -->
00:28:22,468
stop working or, you know, battery doesn't work, whatever it is. And so what we recommend is every
287
00:28:22,468 -->
00:28:29,068
six months you do a health check, which is just you're taking your key, you're either signing a
288
00:28:29,068 -->
00:28:33,728
cryptographic message with it if the software that you're using allows you to do that, or maybe you're
289
00:28:33,728 -->
00:28:38,008
just sending a little transaction in and out of the wallet just to make sure that you know how to
290
00:28:38,008 -->
00:28:47,428
do it. I think this is partly a problem with just how Bitcoin is used today. So there's a lot of
291
00:28:47,428 -->
00:28:53,008
focus around Bitcoin as digital gold. You invest in it, you don't spend it, you keep it for the
292
00:28:53,008 -->
00:28:58,208
long term as your savings. And that's where we are right now with Bitcoin. I hope that we will
293
00:28:58,208 -->
00:29:03,928
transition over time to a mode where people are using their Bitcoin more, they're using it as
294
00:29:03,928 -->
00:29:08,008
money i think that's better for bitcoin as a whole i think it's also going to make people
295
00:29:08,008 -->
00:29:15,448
more comfortable with doing these things in in the long run jan do you have any tips on how to
296
00:29:15,448 -->
00:29:22,248
make sure you're ready in a situation like this yes uh i agree with nick and i would say uh it's
297
00:29:22,248 -->
00:29:27,288
it's not only about transactions but also about checking your backup i think that's that's a
298
00:29:27,288 -->
00:29:36,008
critical feature in wallets where you have the ability to to verify that your backup is valid
299
00:29:36,008 -->
00:29:42,088
so i'm not sure about all other competitors but for example in suite you just click check backup
300
00:29:42,088 -->
00:29:48,648
and then you enter your uh backup words on your treasure and in the end you learn it's correct
301
00:29:48,648 -->
00:29:54,328
or it's not uh if it's not you have you have a real problem and you should move your funds uh
302
00:29:54,328 -->
00:30:02,968
to a different wallet and also i agree about the health check it should be regular so people can
303
00:30:02,968 -->
00:30:10,008
set up some notification to their calendar to do it once or twice a year we actually we wanted to
304
00:30:10,008 -->
00:30:15,128
add this feature to suite so so that it sends a notification to users that they should do the back
305
00:30:15,128 -->
00:30:21,048
of a backup check i don't think it's implemented yet but it's somewhere in the backlog and then
306
00:30:21,048 -->
00:30:21,808
then Lopp, any tips?
307
00:30:26,168 -->
00:30:28,428
Yeah, I mean, just the main thing is to understand
308
00:30:28,428 -->
00:30:31,708
that security is not set it and forget it.
309
00:30:31,748 -->
00:30:33,268
As we've already said several times,
310
00:30:33,328 -->
00:30:35,248
this constant cat and mouse game.
311
00:30:35,248 -->
00:30:39,208
And so that means that if you want to ensure
312
00:30:39,208 -->
00:30:41,968
that you are staying on the forefront
313
00:30:41,968 -->
00:30:44,108
of the best practices of security,
314
00:30:44,248 -->
00:30:47,048
you need to be paying at least a little bit of attention
315
00:30:47,048 -->
00:30:48,368
to what's going on in the space.
316
00:30:48,368 -->
00:30:54,548
And now, Jameson, I'd like to get a little bit deeper with you on just the current state
317
00:30:54,548 -->
00:30:55,828
of the attack, right?
318
00:30:55,828 -->
00:31:00,568
We've had this Kimi K3 openweight Chinese model come out, and since then we've seen
319
00:31:00,568 -->
00:31:02,148
a lot of different cyber attacks, right?
320
00:31:02,148 -->
00:31:06,948
Like there are water facilities under attack in Minnesota from under cyber threat, and
321
00:31:06,948 -->
00:31:23,824
now we got this big exploit with the cold card What changed in the last couple of weeks and is everything vulnerable now Kind of going back to my earlier point I think we should operate under the assumption that everything is vulnerable
322
00:31:23,824 -->
00:31:27,384
We just don't know the extent to which it is vulnerable.
323
00:31:27,384 -->
00:31:49,144
So the main thing that has been happening over the past year with the acceleration of advancement in large language models is just the fact that the capabilities of these models are progressing so quickly.
324
00:31:50,044 -->
00:31:52,284
And so like we said, security is a cat and mouse game.
325
00:31:52,444 -->
00:31:55,824
And normally it's just like a little bit at a time.
326
00:31:56,284 -->
00:31:58,744
You know, one little new thing here, one little new thing here.
327
00:31:58,884 -->
00:31:59,964
Attacker finds a new thing.
328
00:32:00,064 -->
00:32:01,924
Defender comes up with a new defense.
329
00:32:02,944 -->
00:32:13,724
And now it's just that the step functions of the capabilities in both the attackers and the defenders, you know, assuming we all have access to the same models, which isn't always the case.
330
00:32:13,724 -->
00:32:15,284
That's a whole other issue.
331
00:32:15,284 -->
00:32:21,684
but because the sort of delta
332
00:32:21,684 -->
00:32:23,864
and the capabilities of models
333
00:32:23,864 -->
00:32:27,104
is changing at almost like a monthly pace,
334
00:32:27,624 -->
00:32:33,564
the incentives are now for the attackers to go
335
00:32:33,564 -->
00:32:38,744
and basically they set up all of their auditing harnesses,
336
00:32:38,844 -->
00:32:39,884
frameworks and whatever.
337
00:32:40,104 -->
00:32:41,624
And as soon as the new model drops,
338
00:32:41,664 -->
00:32:43,244
they're just going to be slamming it
339
00:32:43,244 -->
00:32:44,864
against all of the software,
340
00:32:44,864 -->
00:32:49,944
you know, all of the infrastructure that they think might have anything of value behind it.
341
00:32:50,484 -->
00:32:54,744
Therefore, if the defenders are not doing the same thing, there's going to be a lag.
342
00:32:55,044 -->
00:32:58,624
The attackers are going to be able to get and hit them until the defenders can react.
343
00:32:59,024 -->
00:33:10,264
And I think, you know, this kind of gets into why some of the Western companies are trying to like gate access to their models to try to give defenders a lead time on that.
344
00:33:10,264 -->
00:33:19,424
But of course, I think any sort of essentially KYC and gating and nannying of technology is ultimately going to fail.
345
00:33:20,464 -->
00:33:30,204
We just have to get all of the defenders on the same page that they just have to be faster to react and take advantage of the tooling.
346
00:33:30,364 -->
00:33:33,404
Otherwise, they will get taken advantage of.
347
00:33:33,404 -->
00:33:42,084
Yes. And Nick, I want to hop this over to you because it seems like Bitcoin is a very valuable
348
00:33:42,084 -->
00:33:46,684
asset, of course, to go after. There's lots of open source projects to try to poke and prod at.
349
00:33:47,044 -->
00:33:53,344
But once they've swept that Bitcoin, all eyes are on it, right? And I think 90% of the Bitcoin that
350
00:33:53,344 -->
00:33:57,724
has been stolen thus far has made one move to another wallet, but then hasn't moved since,
351
00:33:57,724 -->
00:34:03,524
not to any mixes or anything like that. Can you give some color on what's going on there?
352
00:34:03,964 -->
00:34:07,004
What do you think is going to happen to that Bitcoin that has been moved out of people's
353
00:34:07,004 -->
00:34:15,264
wallets? Yeah, I mean, this is hard to say because there are... So on the one hand,
354
00:34:15,724 -->
00:34:22,624
law enforcement, especially in the US, has gotten way more advanced over the last few years around
355
00:34:22,624 -->
00:34:29,444
tracking these kinds of stolen funds flows. And actually, they've gotten much more advanced
356
00:34:29,444 -->
00:34:36,104
thanks to all of the problems in the rest of crypto. So this actually doesn't happen in Bitcoin
357
00:34:36,104 -->
00:34:45,124
so much, but every time there's a new $100 million L2 bridge hack over on Ethereum or something
358
00:34:45,124 -->
00:34:53,804
by North Korea, there's a pretty well-established group of companies or groups in law enforcement
359
00:34:53,804 -->
00:34:59,524
that are tracking those funds flows and trying to freeze them before when they go to exchanges
360
00:34:59,524 -->
00:35:06,204
or whatever. Unfortunately, there are still ways to get past all of that and effectively
361
00:35:06,204 -->
00:35:13,864
launder the money through exchanges or platforms that will take the money and refuse to comply with
362
00:35:13,864 -->
00:35:21,784
freezing orders from like us fbi or some of these other um you know three letter group law enforcement
363
00:35:21,784 -->
00:35:27,944
groups like that and so um i don't really i can't say for sure what's going to happen from here i
364
00:35:27,944 -->
00:35:33,464
know that some people have been doing really excellent work with tracking the funds flows and
365
00:35:33,464 -->
00:35:39,544
and trying to identify not just that original wave of still of stolen assets but i think up to like
366
00:35:39,544 -->
00:35:45,864
four waves now by multiple different types of attackers. Alex Thorne over at Galaxy Digital
367
00:35:45,864 -->
00:35:52,384
has been doing a ton of work around this. And so I hope that through that kind of work,
368
00:35:52,784 -->
00:35:58,364
law enforcement will have what they need to then submit, you know, assets, seizure notices when
369
00:35:58,364 -->
00:36:03,064
these assets eventually do try to go to an exchange. But there are groups that are very
370
00:36:03,064 -->
00:36:09,384
good at moving this type of uh these types of funds and laundering them and so um it's also
371
00:36:09,384 -->
00:36:14,904
possible that some of it doesn't or some of it gets away now if they're able to freeze it uh
372
00:36:15,544 -->
00:36:22,104
in in that best case scenario or freeze some of it you then have this quite difficult process of
373
00:36:22,104 -->
00:36:34,620
identifying who to give it back to which is like you know that i i saw some people talking about doing like white hack uh white hat hacking here it happening yeah yeah and so where they
374
00:36:34,620 -->
00:36:40,140
actually going and stealing preemptively stealing the Bitcoin from these wallets and I think it's
375
00:36:40,140 -->
00:36:45,180
like it's happening but I haven't necessarily seen it happening to the extent that the black
376
00:36:45,180 -->
00:36:50,220
hats are getting stuff but even in that scenario it's like how are you going to figure out who the
377
00:36:50,220 -->
00:36:56,040
original owner of this wallet was like coin kite doesn't really keep that many records so
378
00:36:56,880 -->
00:37:02,280
you can't really cross reference versus them you could arguably say like maybe if they bring the
379
00:37:02,280 -->
00:37:07,740
actual cold card physically which has a unique identifier on it you could potentially use that
380
00:37:07,740 -->
00:37:13,260
as some way to identify them but logistically it's just going to be a huge challenge and I think
381
00:37:14,100 -->
00:37:18,300
that's like the whole next it's going to take years to figure out how to do that from here
382
00:37:18,300 -->
00:37:26,000
It's super messy. And the whole entire ethics behind the question, you steal these things,
383
00:37:26,100 -->
00:37:30,120
you steal these Bitcoin preemptively, then you got to lawyer up if you're a white hat hacker,
384
00:37:30,180 -->
00:37:35,160
right? You got to get a lawyer and give these things to a government, right? And is that what
385
00:37:35,160 -->
00:37:39,580
we want to be doing here? And then the people have to wait for a decade plus to get their Bitcoin
386
00:37:39,580 -->
00:37:45,480
back. As we saw with Mt. Gox, I mean, it's just such a messy situation. The number one thing you
387
00:37:45,480 -->
00:37:50,660
can do is get the word out like we're trying to do right now. If you have a cold card that is MK3,
388
00:37:51,180 -->
00:37:59,340
4, 5, or Q that has firmware from after 2021, be sure to move your Bitcoin as calmly but as quickly
389
00:37:59,340 -->
00:38:06,020
as possible. Huge thing. And so, and now Jan, kicking it over to you in this age of AI,
390
00:38:06,380 -->
00:38:10,800
what are you guys doing to make sure that your devices at Trezor are safe against these attacks?
391
00:38:10,800 -->
00:38:20,160
yeah so ai has changed the game uh we can definitely feel it like i can talk about our
392
00:38:20,160 -->
00:38:27,200
bug bounty program for example where anyone can report vulnerabilities they find in our open source
393
00:38:27,200 -->
00:38:34,720
code under responsible disclosure guidelines which means they report the vulnerability
394
00:38:34,720 -->
00:38:44,400
we fix it and after it's fixed it's disclosed to the public and in the past we had a couple reports
395
00:38:44,400 -->
00:38:51,760
a year but it's changed massively we we get several reports daily and most of the reports
396
00:38:51,760 -->
00:38:58,320
are spam because they're super easy to generate with ai but actually in fact when i look at the
397
00:38:58,320 -->
00:39:06,080
statistic we fixed in unprecedented amounts of security bugs in our products and I don't want
398
00:39:06,080 -->
00:39:14,400
people to panic. It's normal to have vulnerabilities in products. It's nothing as critical as the cold
399
00:39:14,400 -->
00:39:24,000
card exploit. There are some things that can be hardened and improved and we pay out bounties for
400
00:39:24,000 -->
00:39:27,300
for these rewards to the researchers.
401
00:39:27,300 -->
00:39:29,960
And there's been so many of the reports
402
00:39:29,960 -->
00:39:33,800
that we have to create a position dedicated
403
00:39:33,800 -->
00:39:37,220
just to deal with these researchers.
404
00:39:37,220 -->
00:39:40,560
And we're grateful for all their reports.
405
00:39:40,560 -->
00:39:43,100
However, it takes a lot of time to triage all of them
406
00:39:43,100 -->
00:39:45,380
and then fix it.
407
00:39:45,380 -->
00:39:50,380
And then of course, we use AI internally for code reviews.
408
00:39:51,260 -->
00:39:53,560
We have several layers.
409
00:39:53,560 -->
00:39:57,320
We have AI to fix each pull request.
410
00:39:57,320 -->
00:39:59,760
It's kind of industrial standard these days,
411
00:39:59,760 -->
00:40:02,960
but we also have a second layer to check
412
00:40:02,960 -->
00:40:06,980
whether a backdoor was introduced to our product.
413
00:40:06,980 -->
00:40:10,840
Maybe a stolen developer account
414
00:40:10,840 -->
00:40:12,840
or a rogue developer could do that.
415
00:40:12,840 -->
00:40:15,780
So we also have AI to check that.
416
00:40:15,780 -->
00:40:20,780
And we are working on getting all sorts of licenses
417
00:40:20,780 -->
00:40:25,740
to have the most advanced models
418
00:40:25,740 -->
00:40:29,360
to perform security analysis on our code.
419
00:40:29,480 -->
00:40:30,560
So we're doing that.
420
00:40:31,080 -->
00:40:32,980
We're doing these with AI.
421
00:40:33,440 -->
00:40:35,420
We're using better and better tools.
422
00:40:35,680 -->
00:40:38,280
But as Jameson already hinted at,
423
00:40:38,740 -->
00:40:43,280
the process can be long before you get the approvals
424
00:40:43,280 -->
00:40:45,300
from Anthropaic, OpenAI, et cetera.
425
00:40:46,920 -->
00:40:48,080
It's a new game.
426
00:40:48,300 -->
00:40:49,040
It's a new era.
427
00:40:49,280 -->
00:40:49,700
Absolutely.
428
00:40:49,700 -->
00:40:59,760
And as we enter into this new era, we realize that single SIG, Bitcoin hardware is somewhat, we just saw a huge exploit, right?
429
00:40:59,860 -->
00:41:00,820
And so what's next?
430
00:41:01,000 -->
00:41:02,040
What steps do we take?
431
00:41:02,260 -->
00:41:07,680
And the words of this moment are multi-vendor, multi-SIG.
432
00:41:07,860 -->
00:41:11,460
And you guys at Casa have been doing that for many years now.
433
00:41:12,360 -->
00:41:15,800
What are the benefits of multi-vendor, multi-SIG?
434
00:41:15,800 -->
00:41:20,800
and when did you guys decide that that was the way to go forward?
435
00:41:20,800 -->
00:41:25,800
Well, we started building this at Casa in 2018.
436
00:41:25,800 -->
00:41:28,800
So we've been doing it for eight years now.
437
00:41:28,800 -->
00:41:31,800
And multi-vendor, multi-sig was like,
438
00:41:31,800 -->
00:41:34,800
maybe we didn't talk about it with those exact words,
439
00:41:34,800 -->
00:41:36,800
but that was what it was from the beginning.
440
00:41:36,800 -->
00:41:39,960
We've always had within your,
441
00:41:40,237 -->
00:41:48,457
Multi-sig, we've always had like at least two different types of hardware wallets that make up the keys.
442
00:41:49,117 -->
00:41:54,497
And then you've got your phone involved, and then you've got a key that's held by Kasa involved.
443
00:41:54,937 -->
00:42:04,757
And so it becomes, you know, many layers of different types of devices that have to fail at the same time in order to lose your assets.
444
00:42:04,757 -->
00:42:13,057
And so this is the whole, like, I feel like this is the thing with multiseg that just people need to think about it.
445
00:42:13,417 -->
00:42:24,617
Like the simplest way to think about it is it is just adding layers of security where all of them have to fail at the same time in order for you to lose something.
446
00:42:25,457 -->
00:42:32,417
And when you say multivendor, multiseg, it sounds kind of complicated and people are like, whoa, that's maybe over my head.
447
00:42:32,417 -->
00:42:34,857
and it really doesn't have to be.
448
00:42:35,297 -->
00:42:37,777
I mean, you can have this very simply
449
00:42:37,777 -->
00:42:43,257
by taking one Trezor and connecting it to Kasa
450
00:42:43,257 -->
00:42:44,857
and a two of three multi-sig.
451
00:42:45,017 -->
00:42:47,397
And then you've got, that gives you a key on your phone,
452
00:42:47,857 -->
00:42:50,037
a key on the Trezor and a key held by Kasa.
453
00:42:50,037 -->
00:42:53,737
So if you were already using a Trezor as a single-sig wallet,
454
00:42:54,217 -->
00:42:56,397
you can significantly improve your security
455
00:42:56,397 -->
00:42:58,637
by just connecting it to multi-sig
456
00:42:58,637 -->
00:43:01,237
without needing to manage all these extra wallets.
457
00:43:01,237 -->
00:43:19,897
Because I think when people think about this, like they're often hearing about it from the same kind of X space influencer crowd, which is like, okay, go buy one of these hardware wallets, one of these hardware wallets, one of these hardware wallets, and then connect them all in Sparrow and like, or Electrum and do all these things.
458
00:43:20,117 -->
00:43:21,577
It just feels like a lot.
459
00:43:21,917 -->
00:43:23,197
And it doesn't have to be that way.
460
00:43:23,197 -->
00:43:29,697
And even to like not show only Casa's book, like there's other companies that do a great job of helping you set this up.
461
00:43:29,697 -->
00:43:35,777
bit key is good unchained is good um so there's other people that have been doing this for a long
462
00:43:35,777 -->
00:43:40,777
time along with us and you can kind of see like which product has the right uh set of trade-offs
463
00:43:40,777 -->
00:43:52,097
for you i think one other important point to bring up is that um some i think common pushback that
464
00:43:52,097 -->
00:43:58,797
you get is you know why would i need to involve you know yet another company uh in my setup when
465
00:43:58,797 -->
00:44:04,717
I can do this all myself. And to be clear, you can, and you always have been able to,
466
00:44:05,757 -->
00:44:11,517
before any of these like multi-sig coordinator companies existed, you could go get like an
467
00:44:11,517 -->
00:44:19,277
Electrum wallet and create multi-sig or even at like, you could use command line Bitcoin core
468
00:44:19,277 -->
00:44:26,317
to create multi-sig. It's always been possible, I think since like 2012, 2013 at the protocol level
469
00:44:26,317 -->
00:44:36,397
to do multi-sig. But I think the problem with doing self-custody, really the problem with
470
00:44:36,397 -->
00:44:46,677
architecting a custody solution is that, as Jan has also said, there are foot guns. And so once
471
00:44:46,677 -->
00:44:52,497
again, you always have the freedom to do whatever you want within the confines of the protocol.
472
00:44:52,497 -->
00:45:21,677
But if you are not a really, really deep technical expert and security nerd, the problem that you're going to run into is kind of in a way the same problem that CoinKite ran into, which is, as I said earlier, the strength of any given system, open source or otherwise, is going to be correlated to how many eyes are on it.
473
00:45:21,677 -->
00:45:27,137
how many people are using it, how many people are trying to attack it, how many people are defending
474
00:45:27,137 -->
00:45:33,077
it. And so when you're architecting a custody solution just for yourself and nobody else is
475
00:45:33,077 -->
00:45:39,497
looking at it, it's just a lot more likely that you make a mistake. We are all humans. We're all
476
00:45:39,497 -->
00:45:45,197
fallible. We all make mistakes as individuals. We all make mistakes as organizations. And I think
477
00:45:45,197 -->
00:45:49,757
that that's like one of the primary things that these companies, these multi-state coordinator
478
00:45:49,757 -->
00:45:55,137
companies are trying to do is they're trying to say, look, we understand everybody makes mistakes.
479
00:45:55,137 -->
00:46:02,377
How can we orchestrate a system that tolerates mistakes rather than allowing a single mistake
480
00:46:02,377 -->
00:46:08,237
to result in catastrophic failure? And Lop, another question for you. There's been a lot
481
00:46:08,237 -->
00:46:14,137
of people talking about how do exchanges generate keys? How does Kasa generate a key for a user?
482
00:46:14,717 -->
00:46:32,447
Does it look like a hardware wallet or do you guys have a completely different process Yeah I mean in general we don know right So very few custody companies I can really think of any off the top of my head disclose
483
00:46:32,447 -->
00:46:38,227
the like, inner operational details of how they do their own key management.
484
00:46:38,227 -->
00:46:47,607
Now, for the past eight years, I've been on the advisory committee for the cryptocurrency security standard.
485
00:46:47,607 -->
00:46:58,947
And that is essentially an organization that does nothing other than try to codify every single best practice when it comes to key management.
486
00:46:58,947 -->
00:47:07,867
From generation to storage to access to rotating keys and offboarding personnel.
487
00:47:08,227 -->
00:47:20,147
And to date, I only think maybe two or three companies have gone through that whole audit process and proved publicly that they follow all of those best practices.
488
00:47:20,447 -->
00:47:26,067
Now, I'm sure that many of these other companies do follow many, if not all of those best practices.
489
00:47:26,067 -->
00:47:32,227
It's just we don't have that additional layer of public attestation that this is the case.
490
00:47:32,227 -->
00:47:51,267
So, you know, the short version is you should generally assume the worst. I mean, you should assume the worst even when it comes to CASA. And that's like the entire point of our system is that even if the CASA key is weak or compromised or whatever, it does not result in loss of your funds.
491
00:47:51,267 -->
00:48:05,927
Well, there you have it. And then I'd love to get Jan's view on multi-vendor, multi-sig. You make the Trezor, but do you think that it is best practices to put multiple wallets together in a multi-sig for security?
492
00:48:05,927 -->
00:48:17,127
um this entirely depends on your threat model i think uh if you put all your life savings
493
00:48:17,127 -->
00:48:25,687
into bitcoin um then yes uh i think you should consider upgrading i'm i'm not saying
494
00:48:25,687 -->
00:48:32,107
treasure is not safe enough we make it safe enough for everyone but uh there is a level
495
00:48:32,107 -->
00:48:40,987
of trust as we talked about so i think for for any people uh like that who trust bitcoin to the
496
00:48:40,987 -->
00:48:48,747
amount that they put substantial amount of money into it then it is on the table for them to consider
497
00:48:49,867 -->
00:49:00,027
a more robust solution another thing they can do is perhaps diversify from bitcoin a little bit i
498
00:49:00,027 -->
00:49:05,907
I think this is controversial, but I wouldn't recommend to anyone to be 100% in Bitcoin.
499
00:49:06,047 -->
00:49:07,587
I'm a Bitcoiner.
500
00:49:07,907 -->
00:49:08,727
I love Bitcoin.
501
00:49:08,847 -->
00:49:10,167
I think it's the best asset.
502
00:49:11,527 -->
00:49:19,287
But I wouldn't sleep well if I relied on Bitcoin, even if I had multisig.
503
00:49:19,427 -->
00:49:22,667
You know, Bitcoin itself, something can happen to the protocol.
504
00:49:23,667 -->
00:49:29,547
So perhaps think about diversifying between vendors, but also between assets.
505
00:49:30,027 -->
00:49:31,727
Just go buy some NVIDIA.
506
00:49:32,407 -->
00:49:33,207
Yeah, there you go.
507
00:49:34,007 -->
00:49:37,667
No, but I mean, this whole process leaves us with a lot of questions.
508
00:49:38,067 -->
00:49:41,227
And you guys think about self-custody all day, every day.
509
00:49:41,947 -->
00:49:43,087
Where does this leave us?
510
00:49:43,267 -->
00:49:43,907
What's next?
511
00:49:44,287 -->
00:49:49,787
How do we pitch to the average person that they should self-custody Bitcoin after an event like this?
512
00:49:50,007 -->
00:49:50,727
Let's take it, Nick.
513
00:49:51,547 -->
00:49:58,027
I think that I've been thinking about this a lot because obviously we are trying to build a business around self-custody, right?
514
00:49:58,027 -->
00:50:12,827
And so I think that, as I said at the beginning of the call, the naive kind of maybe like easy take or conclusion to make is like, oh, this is a this is hugely terrible for self-custody.
515
00:50:13,027 -->
00:50:16,167
It shows that the average person can't do self-custody.
516
00:50:17,127 -->
00:50:19,987
You know, they should just keep it at a custodian or an exchange.
517
00:50:20,367 -->
00:50:27,147
And I think that's the wrong conclusion, because if you think about this, what actually happened?
518
00:50:28,027 -->
00:50:33,407
The community trusted people that they thought were experts to write code that was secure.
519
00:50:34,827 -->
00:50:43,727
At an exchange, if you're keeping your assets with Coinbase or whoever else, you are trusting people that you think are experts to write code that is secure.
520
00:50:44,247 -->
00:50:46,827
If you're trusting, like if you're using Trezor, same thing.
521
00:50:46,827 -->
00:50:53,827
And so a lot of the, like if this was a scenario where,
522
00:50:53,827 -->
00:51:09,138
oh we had this mass event where people were giving up their seed phrases or they were getting tricked or wrench attacked or whatever And on this hugely massive scale that was something unique to self Maybe that
523
00:51:09,138 -->
00:51:14,558
a little bit different. But in this scenario, it's just the makers of a product that we trusted
524
00:51:14,558 -->
00:51:20,238
made a mistake and that resulted in a lot of people losing money. And that has happened many
525
00:51:20,238 -->
00:51:27,678
times over the years that Bitcoin has existed for other types of custody setups, especially
526
00:51:27,678 -->
00:51:28,818
in custodians.
527
00:51:29,578 -->
00:51:36,698
And so what I think is interesting, and maybe the very small white pill in this whole scenario,
528
00:51:37,138 -->
00:51:45,638
is that if this type of vulnerability had happened at a custodian, a ton of Bitcoin
529
00:51:45,638 -->
00:51:50,798
would just be gone in the snap of your fingers because they're getting access to a wallet that,
530
00:51:51,218 -->
00:51:54,738
you know, maybe the exchange uses a couple of different cold wallets, but
531
00:51:54,738 -->
00:52:02,718
many more customers' assets are centralized in one wallet in that scenario. And so if you have
532
00:52:02,718 -->
00:52:08,358
that type of vulnerability, then it can all be swept very easily. Whereas in this scenario,
533
00:52:09,218 -->
00:52:14,478
it was many different wallets and the attackers had to go one by one cracking each wallet and
534
00:52:14,478 -->
00:52:22,258
then sweeping the assets out of it. And so that actually gave time for people who were going to be
535
00:52:22,258 -->
00:52:30,558
stolen from it, gave them time to move their assets to safety. That's a huge benefit of
536
00:52:30,558 -->
00:52:37,298
self-custody because it's this defense through distribution in the Bitcoin network. And it just
537
00:52:37,298 -->
00:52:45,038
increases the resilience of Bitcoin as a protocol and as an asset overall when you have more people
538
00:52:45,038 -->
00:52:51,318
who are self-custodying because the catastrophic events like this just can't be carried out as
539
00:52:51,318 -->
00:52:56,518
efficiently as they would if everything was sitting in a custodian. And so to me, that's
540
00:52:56,518 -->
00:53:02,118
the argument for why more and more people should be doing self-custody. I think that's a great
541
00:53:02,118 -->
00:53:08,018
point. And Jameson, what do you think? What about the pitch of self-custody now to regular people?
542
00:53:08,978 -->
00:53:17,838
Yeah. So I think that trying to just orange pill the average person and say, you need to
543
00:53:17,838 -->
00:53:24,458
take on this responsibility is going about it the wrong way. And that's probably how you end up
544
00:53:24,458 -->
00:53:28,718
with this situation where we saw a lot of people who didn't even know how to use their cold cards
545
00:53:28,718 -->
00:53:31,098
because they had just been, they just did what they were told.
546
00:53:31,238 -->
00:53:34,038
They bought a cold car, they put the money on it, and they forgot about it.
547
00:53:34,538 -->
00:53:37,458
So if I could like wax philosophical a bit,
548
00:53:37,538 -->
00:53:43,898
I think the quote that really drives me when it comes to just this entire space
549
00:53:43,898 -->
00:53:48,558
and like trying to tell people what to do is this quote that goes like this.
550
00:53:49,118 -->
00:53:53,498
If you want to build a ship, don't drum up people to collect wood
551
00:53:53,498 -->
00:53:55,718
and don't assign them tasks and work,
552
00:53:55,718 -->
00:54:03,178
but rather teach them to long for the endless immensity of the sea. And so I think the point
553
00:54:03,178 -->
00:54:10,138
there is that we shouldn't just be telling people what to do. We should be teaching them to long
554
00:54:10,138 -->
00:54:15,918
for the level of freedom and sovereignty that this protocol and network promises.
555
00:54:17,238 -->
00:54:23,498
And by promise, I mean offers the potential of, because as we've basically been saying this entire
556
00:54:23,498 -->
00:54:30,438
time, you have to be willing to take on the responsibility that comes with that if you
557
00:54:30,438 -->
00:54:34,618
want to actually be able to take advantage of it and sleep at night.
558
00:54:36,838 -->
00:54:38,518
Yeah, that's a great point.
559
00:54:38,658 -->
00:54:42,958
That the most important thing is that you show people what is possible, right?
560
00:54:42,958 -->
00:54:45,898
But don't tell them this is exactly what you have to do or you're not a real Bitcoiner,
561
00:54:46,078 -->
00:54:46,298
right?
562
00:54:46,318 -->
00:54:50,998
I think there was a lot of that going along with the cold card and a lot of people got
563
00:54:50,998 -->
00:54:51,838
burned because of it.
564
00:54:51,838 -->
00:54:53,338
And it's so sad to see.
565
00:54:53,498 -->
00:54:59,358
And Jan, what do you think is the state of self-custody now in 2026 in the light of this
566
00:54:59,358 -->
00:55:00,358
attack?
567
00:55:00,358 -->
00:55:07,898
I think the self-custody narrative is shaken, but it survives.
568
00:55:07,898 -->
00:55:10,378
Bitcoin survived worse things.
569
00:55:10,378 -->
00:55:15,198
And actually, I think when you think about it, there's no way out of it because ultimately
570
00:55:15,198 -->
00:55:16,818
someone has to hold the key.
571
00:55:16,818 -->
00:55:20,438
So even if you move your coins to an exchange, they still have to hold the keys.
572
00:55:20,438 -->
00:55:22,738
Maybe they have a better setup, maybe they use multisig,
573
00:55:22,738 -->
00:55:25,618
but then you can use Kasa and you have the same.
574
00:55:25,618 -->
00:55:27,518
But when you're on an exchange,
575
00:55:27,518 -->
00:55:30,138
you add an extra attack vector
576
00:55:30,138 -->
00:55:33,878
because someone can gain access to the wallet
577
00:55:33,878 -->
00:55:34,978
and drain the funds,
578
00:55:34,978 -->
00:55:52,109
or someone can get access to your account on the exchange and withdraw the funds So i don really see a reason for people to turn to exchanges instead of self in the long run yeah it self
579
00:55:52,109 -->
00:55:57,549
all the way down or in other words uh third-party custody is just self-custody with extra steps
580
00:55:58,749 -->
00:56:04,749
there you go um yeah and as we round this out what about resources where should people go to
581
00:56:04,749 -->
00:56:09,709
learn more if they are in need if their first time hearing about this exploit uh what kind of things
582
00:56:09,709 -->
00:56:16,669
are there to give people a helping hand in this time nick do you have anything well i guess to
583
00:56:16,669 -->
00:56:26,109
learn about the exploit i've just been seeing a lot of info from a lot of people on x um so i don't
584
00:56:26,109 -->
00:56:31,309
i guess some of the people that you can follow that have been i think really that sounded the
585
00:56:31,309 -->
00:56:38,189
alarm early um are like kevin from liana i think he was the first one to really sound the alarm on
586
00:56:38,189 -->
00:56:46,669
this and then there's um rob hamilton has been talking about this a lot um but i think as far
587
00:56:46,669 -->
00:56:53,709
as like what resources casa can provide you know we're going to be posting kind of a overview later
588
00:56:53,709 -->
00:57:00,829
today on our blog just so people can understand what went down have a you know a place on the
589
00:57:00,829 -->
00:57:09,229
internet that isn't x in the timeline to go and then um you know we're for people who are uh
590
00:57:09,229 -->
00:57:15,789
actively like hey i'm on a cold card and i need help moving off of it we have places on our site
591
00:57:15,789 -->
00:57:20,909
you can book calls with our team like we have so many people that we're talking to that i put myself
592
00:57:20,909 -->
00:57:26,509
on the calendar so like i'm doing calls with people so uh it's a very busy time but we're
593
00:57:26,509 -->
00:57:29,549
we're happy to help people get to better security.
594
00:57:31,309 -->
00:57:34,889
Yeah, and Lopp, I mean, you've got a website with all the resources there.
595
00:57:35,629 -->
00:57:39,289
Yeah, basically every security resource that I've ever come across
596
00:57:39,289 -->
00:57:44,189
that I thought was halfway decent is on Lopp.net, L-O-P-P.net.
597
00:57:45,309 -->
00:57:46,109
There you go.
598
00:57:46,809 -->
00:57:50,389
And Jan, if people are in need and want to learn more,
599
00:57:50,769 -->
00:57:53,309
do you have any resources or ideas of where they should go?
600
00:57:53,309 -->
00:57:59,309
When it comes to Trezor, we have our knowledge base on our website where they can learn about
601
00:57:59,309 -->
00:58:02,309
entropy in general in our security checks.
602
00:58:02,309 -->
00:58:07,309
When it comes to this topic, I've seen a good podcast just yesterday.
603
00:58:07,309 -->
00:58:10,309
It was what Bitcoin did with Rob Hamilton.
604
00:58:10,309 -->
00:58:11,309
I like that one.
605
00:58:11,309 -->
00:58:14,309
I think it's worth watching.
606
00:58:14,309 -->
00:58:15,309
Yes.
607
00:58:15,309 -->
00:58:18,309
Shout out to the sleepless warriors.
608
00:58:18,309 -->
00:58:26,909
Wicked Smart Bitcoin, Portland HODL, Rob Hamilton, Kevin from Liana, and many, many more people who
609
00:58:26,909 -->
00:58:31,909
have been on XBases for the last four days straight, haven't really slept and have taken
610
00:58:31,909 -->
00:58:36,729
a lot of questions, handheld people through the process of migration and made sure that
611
00:58:36,729 -->
00:58:42,169
people didn't completely freak out, right? This is a problem with one hardware wallet,
612
00:58:42,169 -->
00:58:47,129
not the Bitcoin protocol. And if you are able to make moves, there's still a chance that you can
613
00:58:47,129 -->
00:58:52,869
make sure everything is safe and has the highest level of security. Well, gentlemen, thank you so
614
00:58:52,869 -->
00:58:57,869
much for this hour of your time. It's very important that we do everything we can at this
615
00:58:57,869 -->
00:59:02,709
time to make sure that people know what is actually going on and what they can do about it
616
00:59:02,709 -->
00:59:11,789
in terms of where people should go. Nick and then Jan. Yeah, so you can find Kasa at Kasa.io. You
617
00:59:11,789 -->
00:59:15,849
You can follow us on Twitter at Casa HODL, H-O-D-L.
618
00:59:16,329 -->
00:59:21,189
And then you can follow me at N Newman, N-N-E-U-M-A-N.
619
00:59:21,669 -->
00:59:25,149
And then Jameson, I think you're at Lopp, L-O-P-P on Twitter.
620
00:59:26,569 -->
00:59:27,649
Beautiful. And Jan?
621
00:59:29,329 -->
00:59:31,989
You can find all about Trezor at trezor.io.
622
00:59:32,329 -->
00:59:38,449
We are on socials, X, Instagram, LinkedIn, I think TikTok as well.
623
00:59:38,449 -->
00:59:43,309
it's impossible to follow me. I'm not really on socials.
624
00:59:44,629 -->
00:59:49,309
Yes. Wonderful. A true security professional. Yeah. That's what you want out of your head of
625
00:59:49,309 -->
00:59:55,009
security at a hardware wallet. Absolutely. No, no footprint. Cool. Well, guys, thank you very much
626
00:59:55,009 -->
01:00:00,469
for your time. As I said, this was very trying for the whole entire community and as many
627
01:00:00,469 -->
01:00:05,929
knowledgeable people that can get out there, spread the word and ensure people what the proper next
628
01:00:05,929 -->
01:00:10,989
steps are, I think, the better. So thank you everyone for tuning into this emergency broadcast
629
01:00:10,989 -->
01:00:16,949
of Bitcoin News Live. Stay on board and make sure you see all the latest coming out because
630
01:00:16,949 -->
01:00:21,629
we are keeping you up to date. Gentlemen, thank you. Thank you.
