AI Has Changed Bitcoin Security Forever

[0:02] Yo, welcome back to another episode of
[0:05] the Jack Mallers Show. I am your host
[0:07] Jack and you are listening to yet
[0:09] another edition of Mailbag
[0:12] Monday episode 130.
[0:16] One of the biggest pieces of feedback
[0:18] over the last few weeks is my
[0:20] microphone. You guys are writing
[0:22] comments like, "Yo, your audio sucks
[0:24] balls." Whoa.
[0:26] Whoops. Kid show, kid show. Hey now.
[0:30] Um but I'm sorry about the audio. Hey,
[0:31] not a professional podcaster, but I went
[0:33] to Best Buy and I got a new mic. Let me
[0:36] know how it sounds. I think I got
[0:38] everything hooked up. So, without
[0:40] further ado, let's get this show on the
[0:43] road.
[0:44] Ladies and gentlemen, I'm talking to you
[0:45] all at a Bitcoin price of $63,910.
[0:50] Bitcoin's market cap sits at 1.28
[0:53] trillion. All-time high remains
[0:55] $126,160.
[0:58] We are 49.3%
[1:00] off that all-time high, about halfway
[1:02] down.
[1:04] That all-time high was made on October
[1:05] 6, 2025. It's now been 308
[1:08] days since Bitcoin was at its prior
[1:11] all-time high. The last Bitcoin block
[1:14] mined since I hit stream was block
[1:17] height 961,925.
[1:21] Working our way towards 1 million blocks
[1:24] mined in the Bitcoin blockchain.
[1:26] Okay, today's episode. So, here's the
[1:29] deal.
[1:30] Uh another piece of feedback you guys
[1:32] had for me last episode. You guys loved
[1:33] last episode. Last episode was more
[1:35] about Bitcoin fundamentals, some of the
[1:37] technology behind Bitcoin, what happened
[1:40] during the cold card incident. It was
[1:41] much more um relevant
[1:45] right now Bitcoin show as opposed to
[1:47] macro stuff. So, we're going to try and
[1:50] do it again because that's pretty much
[1:52] what you guys said. You're like, "Hey,
[1:54] uh we know the Strait of Hormuz is still
[1:55] closed. Uh so, how about you just keep
[1:58] going on this Bitcoin stuff? There's a
[1:59] lot happening in Bitcoin. We'll get back
[2:02] to the macro stuff later. So, keep
[2:04] giving me feedback. If you guys want
[2:05] more of the Bitcoin stuff, we'll do more
[2:07] of the Bitcoin stuff. Like I said, this
[2:09] show no ads. This is not how I pay my
[2:12] rent. There's no corporate incentive or
[2:15] motive that I have other than just
[2:18] trying to be helpful and hang out with
[2:19] you guys at least once a week. So, we're
[2:22] going to do more Bitcoin stuff and no
[2:24] macro stuff today. The other thing is
[2:26] this show should be shorter.
[2:29] Famous last words, I hope. But shorter
[2:31] in the sense that I want to leave room
[2:33] for Q&A. So, like the content in the
[2:35] slides themselves should not take up 90
[2:37] minutes this time because last week was
[2:40] a bit shorter on Q&A and I want to give
[2:42] you guys more opportunity for Q&A this
[2:44] week.
[2:46] So,
[2:47] today we're going to talk about AI and
[2:50] Bitcoin. So, since we last spoke,
[2:52] there's been lots of bugs found in
[2:54] Bitcoin software, not just Coldcard BTC
[2:57] BTC Pay server had a vulnerability where
[3:01] people lost money. There's now a Bitcoin
[3:03] red team running around trying to find
[3:06] vulnerabilities in open-source Bitcoin
[3:08] projects or I don't know, maybe
[3:09] non-open-source. I think you can hit
[3:11] them up if you want them to scan your
[3:13] code base. Strike has wrote written a
[3:16] few blog posts. So, we're we've been all
[3:18] over this. We've been running an
[3:19] internal red team of agents, which I
[3:21] think some people have misunderstood
[3:23] what I meant by that. So, I'll talk
[3:24] about that. But today's episode will be
[3:26] all about education around AI and
[3:28] Bitcoin, the intersection and the unique
[3:30] time we're living through.
[3:32] Some of the fud and destroying a lot of
[3:34] the fud that seems to be spreading about
[3:36] this topic and then hopefully answering
[3:38] some questions. So, before I get
[3:41] started,
[3:43] I'm just checking my phone to make sure
[3:45] the audio's coming through. It looks
[3:48] like it is.
[3:50] All right, let's go. Okay.
[3:53] Uh here we go.
[3:54] AI has changed Bitcoin security forever.
[3:57] And really, it's changed security
[3:59] forever. So, uh the cold open chapter
[4:01] one, what the [ __ ] just changed? Kids
[4:04] show now, kids show, be careful.
[4:06] Um the last 10 days of Bitcoin has been
[4:08] a doozy, okay? Um and there's other
[4:11] things that have happened in Bitcoin
[4:12] that I haven't even included in here.
[4:13] So, this is what bear markets feel like,
[4:15] this is what it's all about. Don't let
[4:16] these times scare you out. Don't let
[4:18] these times wear you out. Stay strong,
[4:20] young lad. Stay strong, stay humble,
[4:22] stack those sats, okay? But, what the
[4:24] hell is going on? Um over the last 10
[4:27] days, Coldcard had a critical
[4:29] vulnerability. We talked about it last
[4:31] episode. Securing Bitcoin all comes down
[4:33] to your ability to generate a large
[4:35] enough and random enough number and then
[4:37] secure that number.
[4:39] Uh Coldcard didn't do that, okay? So,
[4:42] there was a critical vulnerability, uh
[4:44] very terrifying, very sad. The victims
[4:47] of what happened, um sucks. It really
[4:50] sucks. There's just no doubt about that.
[4:51] There's no other way to spin that. Um
[4:54] after that, we saw this kind of
[4:57] amplified security research effort
[4:59] within Bitcoin. So, a bunch of frontier
[5:01] AI models continue to be released, which
[5:04] we'll talk about in a second, the
[5:06] difference between an American AI
[5:07] frontier model and Chinese AI frontier
[5:10] models. What's the difference? Why do
[5:12] you choose one over the other? What are
[5:13] Bitcoin researchers choosing? What does
[5:15] it mean about American policy and the uh
[5:19] really the kind of cold war that's being
[5:21] fought between China and America.
[5:24] But, all these AI models continue to
[5:26] release products, continue to raise
[5:28] money. It continues to be the hottest
[5:30] technology trend in quite some time. And
[5:33] there's now a team of researchers both
[5:36] within Bitcoin and really around the
[5:38] world that are using these frontier
[5:39] models to find deep vulnerabilities in
[5:42] software uh at dramatically lower costs,
[5:45] okay?
[5:46] A result of that has been Open Sats
[5:48] Bitcoin Red Team. So, Open Sats has been
[5:51] funding a team, they call themselves the
[5:54] Bitcoin Red Team. They are using AI and
[5:57] LLM to find Bitcoin software
[6:01] vulnerabilities in primarily open-source
[6:03] projects that they deem to be critical
[6:05] to our industry. And as a result of
[6:08] that, BTCPay Server
[6:11] last week Yeah, today's Monday. Last
[6:13] week, there was an urgent critical
[6:15] vulnerability patched. Uh some people
[6:17] lost some funds there. Um they came out
[6:20] with a blog post today talking about
[6:22] what happened and their go-forward next
[6:24] steps. I actually think that they
[6:25] donated 0.21 Bitcoins to Open Sats
[6:30] Bitcoin Red Team as a thank you for
[6:32] helping find and patch the
[6:34] vulnerability. So, there's a lot that's
[6:36] going on, okay? It feels like the world
[6:38] is changing editing at a neck-breaking
[6:41] pace uh cuz it is.
[6:44] And uh this show, we're going to kind of
[6:46] break it all down. What's real, what's
[6:48] not, what's fud, what's not, um what to
[6:50] do about it, and what not to do, okay?
[6:53] Um so, AI has collapsed the cost of
[6:57] expertise. That's kind of the way that I
[6:59] would put it, okay? The vulnerabilities
[7:02] were always there in the code. The
[7:04] Coldcard vulnerability has existed for 5
[7:06] years, over 5 years, almost 6 years at
[7:08] this point. The vulnerability in BTCPay
[7:11] Server has existed for quite some time,
[7:13] believe it or not. Um the cost of
[7:16] finding these vulnerabilities is what
[7:19] has changed, not the vulnerabilities
[7:21] themselves.
[7:23] Does that make sense?
[7:24] Okay? And by the way, guys, let me say
[7:27] Bitcoin, as we've talked about on the
[7:29] show, has a way of being first, leading
[7:33] the world cuz it's it's it's um we talk
[7:36] about it all the time. It's a truly free
[7:38] market. And so, there are no central
[7:40] planning intermediaries that interfere
[7:43] with Bitcoin's ability to express what's
[7:45] real, what's honest, what's true,
[7:47] reality, okay?
[7:49] An example of that was in the 2022 bear
[7:51] market, FTX blew up first before Silicon
[7:55] Valley Bank. They both blew up for the
[7:57] same reasons. Monetary policy got tight.
[8:00] There was capital that was misallocated,
[8:02] misinvested. There was risk that was
[8:04] mispriced, and customer deposits weren't
[8:06] actually there.
[8:08] But, Bitcoin, it's just in I guess FTX
[8:11] was broader crypto, but the point is
[8:13] it's it's such a more free market. It
[8:15] doesn't close on the weekends. It
[8:16] doesn't close at 5:00. It isn't over
[8:19] regulated in in who can participate and
[8:22] how they can participate isn't managed
[8:25] by politicians and unelected officials.
[8:29] It just is.
[8:30] And because of that, you know, Bitcoin
[8:32] fell before the stock market this year.
[8:35] FTX collapsed before Silicon Valley
[8:37] Valley Bank. And the the analogy that
[8:40] you guys can tell I'm I'm bridging here
[8:42] is I think that Bitcoin is experiencing
[8:45] the true pain of software
[8:48] vulnerabilities that AI is detecting and
[8:52] bringing the cost down before it hits
[8:55] the real world.
[8:57] Like make no mistake. This is not a
[8:58] Bitcoin specific issue. This is a the
[9:02] cost of finding vulnerabilities in
[9:04] software has gone from being immensely
[9:07] expensive or just not possible because
[9:10] the level of expertise you needed to
[9:12] acquire to actually go through the
[9:14] critical vulnerable paths of a software
[9:17] repository, you just it didn't even
[9:19] matter how much money you had. Acquiring
[9:21] that level of expertise, managing them,
[9:23] directing them, leading them was just
[9:25] only so many there's only so many people
[9:28] in the world that could do that. And now
[9:30] it costs 200 bucks a month if you want
[9:32] an an American model, and if you want a
[9:34] Chinese model, it costs a hundredth of
[9:36] that.
[9:37] That's what happened. And so we will we
[9:39] will see the same thing is my prediction
[9:42] happen to I'm I'm sure someone is going
[9:45] to hack a bank. I'm sure someone is
[9:48] going to hack a a Mag 7 business. I
[9:52] mean, it wouldn't surprise me. It
[9:53] wouldn't surprise me. So, what has AI
[9:56] changed? And again, this is about the
[9:58] cost of expert security research has
[10:00] collapsed overnight. That is the step
[10:03] function. That is the like, "Oh my god,
[10:04] it feels like the world's changing so
[10:07] fast." And that's because it is. The
[10:09] cost of expert security research went
[10:11] from
[10:12] sometimes just not even an option to or
[10:15] like really really expensive to like I
[10:18] said, couple hundred bucks to
[10:20] you know, free open source software. So,
[10:22] before
[10:24] let's put ourselves back in a world
[10:26] before AI.
[10:28] Okay?
[10:29] Before artificial intelligence, finding
[10:31] a deep vulnerability, a critical
[10:33] vulnerability, required these things.
[10:35] One, you had to hire scarce expert
[10:37] engineers. So, these are not you know,
[10:39] security engineers are are not you know,
[10:42] normal web developers, okay? And the
[10:45] level of expertise really scales to
[10:48] likely the type of vulnerability or type
[10:52] of code base that you want to scan.
[10:54] You know, again, there's a scarcity to
[10:56] scanning
[10:58] uh I would say cryptographic libraries
[11:01] versus scanning
[11:03] uh HTML and CSS, right? So, one, you got
[11:06] to find scarce expert engineers.
[11:08] Two, you have to spend
[11:11] a really large amount of time reading
[11:14] unfamiliar code and
[11:17] unfamiliar uh edge cases and unfamiliar
[11:20] business logic and unfamiliar
[11:22] application logic. Like getting a group
[11:24] of scarce engineers and growing them to
[11:28] the place where they totally understand
[11:29] what the application is intended to do,
[11:31] how it's set up, what is the flow of
[11:33] funds. Like that takes time. That takes
[11:35] human beings time. Those human beings,
[11:38] uh you can't just task them to do it
[11:39] 24/7 over a weekend. They need to eat
[11:41] dinner. They have families. They have a
[11:42] wife. They have kids. Okay?
[11:46] Then you need to trace all the
[11:48] dependencies and the architecture
[11:49] itself. So what is this thing rely on?
[11:52] What are the assumptions that it's
[11:53] making? Is it using other open-source
[11:56] libraries? Like what if
[11:58] its software is secure, but the software
[12:00] it's using is not secure, right? There's
[12:03] dependencies built. Then you generate a
[12:06] hypothesis as to where it could be
[12:08] insecure, where it can be exploited.
[12:10] Then you build these proof-of-concept
[12:12] exploits, and then you try, here's the
[12:14] last part that's really critical,
[12:16] you try and exploit it in an
[12:18] economically viable way. You know,
[12:20] unless you are politically motivated or
[12:22] motivated for some weird reason, you
[12:25] would not attack something that costs
[12:27] you more than you would gain.
[12:30] So, you know, if you if you have these
[12:32] niche tiny little projects, like why
[12:34] would you care? You're going to you're
[12:36] going to pay all these expert engineers
[12:38] that are really scarce that need
[12:40] hundreds of thousands if not millions of
[12:41] dollars a year on payroll, you're going
[12:43] to pay them over weeks or months or
[12:45] years to build up all of this work only
[12:48] to get nothing in return. So there had
[12:49] to be like an economic benefit, you
[12:51] know, the
[12:52] Again, incentives are incredibly
[12:54] important. Now,
[12:56] take that to today. So that's what used
[12:58] to have to happen. And so the amount of
[13:00] even just attempts to hack somebody are
[13:03] it's you know, you you'd have to be
[13:05] relevant enough to attack. You can't,
[13:08] you know, these tiny tiny little niche
[13:10] Bitcoin projects, no one gave a [ __ ]
[13:13] And I'll get to that in a second.
[13:16] Nowadays,
[13:18] all that it takes is access to a
[13:20] frontier AI model.
[13:23] You can ingest the entire code base of
[13:25] someone else in minutes. Minutes.
[13:29] Like I can
[13:31] run a Frontier AI lab model, go make
[13:34] myself an espresso, by the time I get
[13:36] back and sit at my desk, it it
[13:38] understands the entire codebase.
[13:41] You can explain unfamiliar systems and
[13:43] trace dependencies instantly.
[13:46] You can search Git history.
[13:48] So, you can go through the entire
[13:51] history of how this codebase was
[13:52] written. So, you know, for for those
[13:55] that are unfamiliar, what Git history is
[13:57] is if I make a change to a codebase and
[14:00] I want to push an update, like I just
[14:02] changed the homepage. I just changed the
[14:05] login button. You know, engineers will
[14:07] write little messages that document the
[14:10] change they just made
[14:12] and update the codebase. And so, one of
[14:14] the things that attackers are doing is
[14:16] going through the history of all the
[14:17] changes. So, not only do I understand
[14:20] the entire codebase and I understand all
[14:21] the dependencies, but I also understand
[14:24] how it was built. Like I'm reading the
[14:26] messages of the developers. The
[14:27] developer wrote a message that said,
[14:29] "Refactored the security system." And
[14:32] then these models are able to say, "Hey,
[14:34] that might be a one of the changes to
[14:37] look at. Let's over inspect that change.
[14:39] Let's I don't care about changing the
[14:41] color of the button. Let's inspect all
[14:43] the comments that touched this file."
[14:46] Okay?
[14:47] So, I get to look at all of the history
[14:50] of how this codebase was built. Imagine
[14:51] if you were a human and you had to do
[14:53] this without AI. I mean, this is the
[14:55] weeks or months you're paying guys that
[14:58] need 500 grand a year minimum to do this
[15:01] work for you. And again, like you need
[15:03] to pay yourself back. Who's Who's
[15:05] financing this work?
[15:07] Okay?
[15:08] Then generating an attack hypothesis,
[15:11] again, and writing proof of concepts,
[15:13] this is this is work that could take
[15:15] minutes, hours, days, a week if it's
[15:19] really, really complicated. Um these
[15:21] things can work continuously. So, these
[15:24] AI agents don't have families, don't
[15:27] have wives, don't have kids, don't need
[15:29] to eat dinner.
[15:30] Like, they're good.
[15:31] You know, some of the things we do at
[15:32] Strike, which I'll explain in a second,
[15:34] AI agents are a first-class citizen at
[15:37] the company now. And so, we've been able
[15:39] to task AI agents to build proof of
[15:41] concepts of features that we're
[15:42] interested in over a weekend. Like, I'm
[15:45] able to say like, "Hey, agent. I'll see
[15:48] you on Monday." And by the time I get
[15:49] back on Monday, an entire proof of
[15:51] concept for for brand new feature is
[15:53] entirely built and I have an ability to
[15:55] play around.
[15:57] It the It did not need to eat that
[15:59] weekend. It didn't need to go on a walk.
[16:01] It didn't need to go to the gym. It
[16:02] didn't need to sit in the sauna. All it
[16:04] did was just grind out the proof of
[16:06] concept. It has continuous work.
[16:10] And then the last one is it's low cost.
[16:13] It's available to everybody. So, the
[16:15] economics of doing this,
[16:17] I mean, there is no reality where it's
[16:19] not worth it. I mean, worst-case
[16:22] scenario, you spend a couple hundred
[16:23] bucks or a couple couple thousand bucks
[16:25] not finding a vulnerability.
[16:27] But, you don't have to spend millions of
[16:29] dollars to find a vulnerability and then
[16:31] hopefully a way to pay yourself back.
[16:35] You understand the the
[16:37] the difference here is I mean, this is
[16:39] insane.
[16:41] You know, I I say often, you can look at
[16:42] it in a glass half empty or a glass half
[16:44] full. I look at it in a glass half full.
[16:46] What an awesome time to be alive.
[16:49] I I mean, I can't wait to tell my kids,
[16:53] God willing, knock on wood, and their
[16:55] kids that your dad and your grandfather
[16:59] was born
[17:00] during the time when Satoshi released
[17:02] the white paper and when frontier AI
[17:05] models became accessible and powerful
[17:08] enough to like truly change the world
[17:09] overnight.
[17:11] I mean, this is awesome.
[17:13] This is
[17:14] If If you are a doer and you care and
[17:18] you want to participate in what the
[17:19] future will look like and you're not
[17:20] just a couch potato consumer of whatever
[17:23] politicians decide, we're going to go
[17:25] out there and we're going to design and
[17:29] build and architect the future that we
[17:30] want to live in.
[17:32] I mean what better time? This is a time
[17:34] of change. This is whatever fourth
[17:36] turning, whatever you want to call it.
[17:38] So this is cool, but make no mistake
[17:40] about it.
[17:42] This is real [ __ ] This is not dramatic.
[17:45] Nobody's upselling how impactful AI is
[17:49] to sell you secondary sales of Anthropic
[17:53] equity. This is all legit, guys. This is
[17:55] real, okay? So in summary, AI did not
[17:58] make these vulnerabilities exist. So
[18:00] this is one of the fud pieces. Again,
[18:02] this show by the common man for the
[18:04] common man, okay? When people say, "Wow,
[18:07] AI is causing all these issues." That's
[18:10] not how I would phrase it, guys. When
[18:12] you hear that on the street, that's
[18:13] incorrect. AI did not cause these
[18:16] vulnerabilities. It made them cheap to
[18:19] find. That's it. But that matters, okay?
[18:23] That matters. So let's talk about the
[18:26] asymmetry, okay?
[18:28] Defender versus the attacker. Um
[18:30] the defender
[18:32] and we'll we'll talk about kind of
[18:35] the the the inevitable and persistent
[18:38] infinite duel between the defender and
[18:40] the attacker.
[18:42] Um but the defender must protect every
[18:44] meaningful path,
[18:46] okay? Let's
[18:48] So the asymmetry here that I'm trying to
[18:49] explain is
[18:51] the attacker only needs only needs to
[18:53] find one exploitable path, one
[18:55] vulnerability and they win.
[18:57] The defender has to defend maybe
[18:59] millions and millions and millions of
[19:01] paths.
[19:03] And that's the asymmetry. That's the
[19:05] challenging part of building a defense.
[19:12] Do Do understand?
[19:14] So, a defender has to
[19:16] map all of their code paths, all of
[19:18] their edge cases, all of their
[19:20] infrastructure and permissions, what
[19:21] employees have access to what,
[19:24] what admins have access to what, what
[19:26] infrastructure providers have access to
[19:28] what, what vendors are we using for
[19:30] what, what supply chain dependencies
[19:32] what do we have, what open source
[19:34] repositories are we using? It's one
[19:36] thing for our source code to be secure
[19:39] and safe, but what about everyone else's
[19:41] code that we're also using? Do we also
[19:43] need to check on their code?
[19:46] Okay.
[19:47] A defender has exponentially more work
[19:50] to do just to prevent one exploitable
[19:52] path, where all an attacker needs is one
[19:55] leaked password or one misconfigured
[19:58] commission
[19:59] uh permission or one overlooked
[20:01] dependency or one logic error, one if
[20:04] and statement that
[20:05] oops, I didn't mean the cold card, I
[20:08] didn't mean to set that to zero. That's
[20:10] all the attacker needs.
[20:12] The historical advantage of the defender
[20:15] was that they knew their systems better
[20:17] than anybody else.
[20:20] They were able to build products on
[20:22] their systems and make profit with their
[20:24] systems and hire hundreds or thousands
[20:27] of engineers to know their systems
[20:29] inside and out, and in order for an
[20:31] attacker to get to know their systems as
[20:34] well as they do, it's merely impossible
[20:37] or it's extremely expensive, and is
[20:39] anyone willing to bear that cost and try
[20:41] and keep up with them without the
[20:43] guarantee that they'd actually find an
[20:44] exploitable vulnerability?
[20:48] But now that's not the case. You could
[20:51] spend decades of time
[20:53] and thousands and thousands of engineers
[20:56] worth of hours and expertise and
[21:00] learning and knowledge base only for a
[21:02] frontier AI model to catch up a rogue
[21:05] attacker in minutes.
[21:09] So, AI now lets these attackers cheaply
[21:11] build really deep context about
[21:14] unfamiliar systems to them.
[21:16] You see this asymmetry here?
[21:19] So, it's it's very difficult in this
[21:21] modern day in with AI
[21:24] for a defender, because it's exponential
[21:26] they have to cover a lot more ground.
[21:29] For an attacker to be successful, it
[21:31] takes one rogue employee to leak a
[21:34] password. Or whatever. I don't know. I'm
[21:36] making [ __ ] up.
[21:37] A defender has to I mean
[21:40] they can't afford any of these
[21:43] dependency paths or code paths or edge
[21:47] cases or partner integrations to go
[21:49] wrong.
[21:52] So,
[21:53] the conclusion that I'm kind of leading
[21:55] you guys towards is if attackers can now
[21:57] continuously investigate you,
[22:00] the cost to continuously investigate you
[22:03] has dropped effectively to zero. The
[22:06] mar- So, the way I like to think about
[22:08] AI is the marginal cost of intelligence
[22:11] is effectively zero.
[22:13] Whereas the marginal cost of
[22:14] intelligence,
[22:16] let's say when it pertains to security
[22:18] engineering, was not zero five years
[22:21] ago. It was very expensive in both time,
[22:24] in money, in resources, in everything.
[22:28] I mean, the network you needed to know
[22:30] really good engineers. And then the
[22:32] money you needed to pay them and the
[22:33] expertise you guys needed to grow
[22:35] knowledge about a code base and about a
[22:37] vendor.
[22:39] That's all like that's all effectively
[22:42] zero.
[22:43] And so,
[22:45] defenders need to continually
[22:47] investigate themselves.
[22:49] That's kind of the point. Um
[22:51] the best way to defend against AI is to
[22:55] use AI yourself.
[22:57] Okay? And that's kind of the world we're
[22:59] living in. If you think about what the
[23:01] Bitcoin red team is, they're a team of
[23:05] attackers that have Bitcoin's best
[23:07] interest. They're doing the same thing.
[23:09] They're using frontier AI models to scan
[23:12] for vulnerabilities, except instead of
[23:14] exploiting them, they're patching them.
[23:17] And so, you can think of the game of
[23:19] offense and defense,
[23:21] just reimagine it.
[23:23] You're
[23:24] the the thing you can't afford to do is
[23:27] use the same tools as your attackers. If
[23:30] your attackers are using all these
[23:31] frontier AI models, then you must as
[23:33] well.
[23:34] So, you must continually investigate
[23:36] yourselves before the attackers do. And
[23:39] the only way you can do that in a
[23:40] cost-effective way is by using the AI
[23:42] yourself. So, that brings me to what I
[23:45] posted last week, and I know you guys
[23:46] had a lot of questions about it, and
[23:47] some people misinterpreted what I was
[23:49] saying, but
[23:50] let's talk about how Strike operates,
[23:52] and we've been doing this for many, many
[23:54] months now. This is not something we did
[23:56] in reaction to the Coldcard hack or the
[23:59] BTC Pay vulnerability, but it certainly
[24:02] has rein- reinforced and validated our
[24:04] strategy that we've adopted internally.
[24:06] Um we call it, you know, before there
[24:09] was a Bitcoin red team, there was
[24:11] actually a Strike red team. There's a
[24:12] red team of AI agents that run nonstop,
[24:16] 24/7, every day
[24:19] that try and attack Strike.
[24:21] Um obviously though, they're like the
[24:24] Bitcoin red team, where if they find
[24:26] anything that's worth us taking a look
[24:28] at, that they escalate it, and we go and
[24:31] we take a look. And it's this idea of
[24:34] secure systems now have to attack
[24:36] themselves continuously and be on the
[24:38] bleeding edge of AI first. And that is I
[24:42] mean, that is I'll get to you in a
[24:45] second. So, anyways, I posted this last
[24:46] week. I wrote, "At Strike, we built a
[24:48] red team of frontier AI agents that
[24:50] challenges our systems 24/7. AI has
[24:53] collapsed the cost of finding
[24:54] vulnerabilities. A single attacker can
[24:57] now investigate software like an expert
[24:58] team. Trust will be earned by
[25:00] challenging yourself before attackers
[25:03] do.
[25:03] And I think that this is the motto that
[25:06] we all as a Bitcoin industry need to
[25:09] adopt. Um
[25:11] So,
[25:12] what do I mean by this? Uh you can kind
[25:14] of picture it like this. So, maybe we
[25:17] built an agent at Strike that we
[25:20] consider to be an outsider, an
[25:22] unauthenticated outsider, or someone
[25:25] that's a malicious customer of ours
[25:27] that's unauthenticated. Unauthenticated
[25:29] meaning they don't have the right
[25:30] permissions to call certain parts of our
[25:33] system as if they were an admin, as if
[25:35] they were an employee. So, someone on
[25:37] the naked internet. And then we even are
[25:40] able to build these agents like, "Well,
[25:43] what if you are na- naked on the
[25:44] internet, but you're an outsider?"
[25:47] Meaning you're not a customer, you don't
[25:49] have an account, right? What if you're
[25:51] just a random internet request? Okay,
[25:53] what if you're a malicious customer?
[25:54] What if you sign up for Strike with the
[25:56] only intent of attacking us and trying
[25:58] to exploit us?
[26:00] And then we can build if someone is
[26:02] authenticated. What if you're a
[26:04] compromised employee? What if you're a
[26:06] rogue employee that joined Strike only
[26:09] to attack us or is getting bribed to
[26:12] turn against us and attack us? What if
[26:15] you're a bad partner? What if you're a
[26:16] bad vendor? Strike is not a
[26:19] self-contained system. We have banking
[26:21] partners, we have exchange partners, we
[26:23] have all sorts of partners. We're a
[26:25] global financial institution. What if
[26:28] one of our partners becomes compromised
[26:30] and tries to attack us? Now, we're able
[26:32] to actually permission every single one
[26:34] of these agents as if they were one of
[26:37] these attackers. So, what we've done is
[26:39] we've gone through and created agents
[26:42] that act like everyone that interfaces
[26:45] with our system. So, you can imagine us
[26:47] reading the logs that enter our server.
[26:50] And and we start to document who are the
[26:53] people requesting our servers. And you
[26:55] know, you can kind of pile them up into
[26:58] different groups. Okay. Out on
[27:01] unauthenticated outsiders, malicious or
[27:03] not malicious I guess, but customer
[27:05] requests, so people that are checking
[27:06] the Bitcoin price, placing DCA orders,
[27:08] taking out loans, you know, there's
[27:10] depositing Bitcoin.
[27:11] Um employees, so all of our servers, I
[27:14] mean, we have internal APIs that service
[27:16] employees and customer support and, you
[27:19] know, people that work here need to use
[27:20] our systems, too. Um and then our
[27:22] vendors, which one of our partners are
[27:24] you are using our code bases and and our
[27:26] APIs and our systems and our internal
[27:28] tools.
[27:29] And then we're able to build this
[27:31] internal red team. And so the way that
[27:33] we, and again, this is something we've
[27:35] been building for a year now, uh there's
[27:38] two blogs on our website that talk about
[27:40] this. So, I would encourage you guys to
[27:42] go check it out if you want to learn
[27:44] more, but
[27:45] we call it the Strike Software Factory,
[27:48] and it's really this ability that we've
[27:50] invested a lot in, which is making AI
[27:53] agents first-class citizens at the
[27:54] company. So that these things, and when
[27:57] I say first-class citizens, it means
[27:59] these agents can speak our language.
[28:01] They understand what we're talking about
[28:04] when we talk about features or when we
[28:06] talk about Bitcoin or when we talk about
[28:09] authentication and APIs. It has the
[28:12] correct context to just kind of
[28:13] understand what's going on.
[28:16] And [snorts] then our AI agents can
[28:18] actually trace attack paths across our
[28:20] source code and our application logic,
[28:22] our infrastructure, our cloud uh
[28:24] configurations, our partners, our
[28:26] third-party integrations, any identity
[28:29] permissions and authority. So again, uh
[28:31] a vulnerability doesn't have to
[28:33] necessarily be bad entropy by cold card,
[28:35] right? What if you accidentally are
[28:37] giving permissions to an outsider
[28:41] unauthenticated request that you would
[28:43] to an employee? You know, identifying
[28:45] that is a vulnerability. Um dependency
[28:49] on supply chain. So, just mapping out,
[28:51] okay, we use certain Bitcoin open source
[28:54] software. That Bitcoin open source
[28:55] software uses this open source software.
[28:57] That open source software uses this open
[28:59] source software. And there's a
[29:01] dependency on software supply chains of
[29:04] are all of these secure? Do any of these
[29:08] have vulnerabilities? So, actually our
[29:10] AI red team of agents of of of AI
[29:13] agents,
[29:15] we don't only scan Strike's code. We
[29:17] actually have been scanning lots of
[29:19] other code like Bitcoin Core,
[29:21] like some of the Lightning Network
[29:22] implementations. We've been doing this
[29:24] work for quite some time now.
[29:26] Because securing Strike is not just our
[29:29] own code base. You know, if a Lightning
[29:31] implementation has a vulnerability or if
[29:34] some other code base that we use has a
[29:35] vulnerability, that makes us vulnerable
[29:37] as well.
[29:39] And so, it's been a very fascinating and
[29:41] I I think it's worth sharing um because
[29:45] for a few reasons. One, you know, people
[29:47] I I feel like the mood is very
[29:48] defeatist. Like there's no way around
[29:51] this. Bitcoin's inherently insecure. I
[29:53] know people that are like, "Fuck this.
[29:54] I'm just going to sell all my Bitcoin."
[29:56] It's crazy. It's like
[29:59] the defenders have So, Strike's a
[30:01] defender, right? We have to care for all
[30:04] potentially critical paths, all source
[30:07] code and application logic. We need to
[30:08] defend against all of it. And we've
[30:10] built this software to do exactly that.
[30:13] And it's cheap. It's very scalable. It's
[30:15] worked tremendously well for us so far.
[30:17] Um and so, I don't I don't think people
[30:19] should their perception should be that
[30:22] AI is threatening Bitcoin as a whole.
[30:26] Okay? AI
[30:28] threatens vulnerable projects that
[30:31] aren't good at defending themselves or
[30:33] or need to defend themselves better.
[30:36] Um so, real quick and this was some of
[30:38] the kind of misunderstanding.
[30:40] Uh So, this is what AI doesn't do. AI
[30:43] for Strike.
[30:45] It doesn't control customer funds. It
[30:47] doesn't modify production systems. It
[30:49] doesn't replace any of our engineers.
[30:51] So, I think when I started to talk about
[30:52] this, people were like, "Oh, man. Like,
[30:54] I don't want to trust AI agents. So,
[30:57] like, I don't want to use Strike." Just
[30:58] to be clear, like
[31:00] the what the agents are doing is what
[31:02] the Bitcoin red team is doing when when
[31:05] when you say we're just going to scan
[31:07] all of these code bases for
[31:09] vulnerabilities, we're going to scan all
[31:10] the hardware wallet code bases for how
[31:12] they create entropy, for how they create
[31:13] these large random numbers. That's what
[31:15] Strike's AI agents are doing. So, I I
[31:17] just don't I don't want our customers
[31:19] thinking that, you know, their funds or
[31:23] their accounts are being managed by
[31:26] rogue AI agents. Um the
[31:30] you know,
[31:31] at the end of the day, the way I think
[31:32] the world is trending is everything has
[31:35] a human finish to it. So, all authority
[31:39] and access
[31:40] is human protected and human custodied.
[31:44] And everything that you end up
[31:47] interacting with has a human finish. AI
[31:50] is really bad at having taste. It has no
[31:52] artistic sense. It really struggles with
[31:54] deep empathy and human logic to that
[31:56] level. What it's really good at is what
[31:58] we've talked about on the show is white
[32:00] collar labor.
[32:02] It's very freeing in that way. Like, you
[32:04] don't have to read through thousands and
[32:06] thousands of hours of get commit history
[32:08] to understand how a code base went from
[32:10] zero lines of code to millions of lines
[32:12] of code. That's very like
[32:15] uh, that's a slog of white collar labor.
[32:19] And AI replaces that just really um,
[32:24] just
[32:25] exhausting white collar labor, but it
[32:28] doesn't replace
[32:30] you know,
[32:31] uh,
[32:32] what I call human finish.
[32:34] The the the end security, the keys, the
[32:38] custody, the the
[32:42] production, deployments, any of that.
[32:45] And so, you know, what these things have
[32:47] been able to do for us is widen the
[32:49] search
[32:50] and deepen the search and being able to
[32:53] automate reports to our engineers to go
[32:57] take a look. Because here's another
[32:59] thing I'll tell you guys from
[32:59] experience, AI slop, you know how you
[33:02] know people say, "Oh, the internet is
[33:03] riddled with AI slop." That's true. And
[33:06] there's AI slop in security as well.
[33:08] Like the AI is going to give you 10,000
[33:11] potential vulnerabilities and it has no
[33:13] [ __ ] idea which ones like you're
[33:17] going to care about because it it really
[33:19] struggles with valuing what your
[33:21] customer is. How do people value your
[33:23] brand? Like what are the major use cases
[33:26] of your application and your business?
[33:28] You know, which ones do you make most of
[33:30] your revenue from? These are the things
[33:32] it really struggles with. So again, you
[33:34] need this human finish. So there's no
[33:36] such thing as AI slop as well when it
[33:39] comes to these things. So, you know,
[33:41] there's a lot of human involvement, but
[33:43] it really widens and deepens our ability
[33:45] to secure our system at effectively no
[33:48] cost. So,
[33:50] what we've done at Strike is we've built
[33:52] automated attackers that basically work
[33:54] for us and are on Team Strike.
[33:57] Um and again,
[33:59] there's one more really interesting
[34:01] thing. Do I have it as the next slide?
[34:03] Um kind of. Okay. There's one more
[34:05] really interesting thing too as well,
[34:06] which one of the things I will say, you
[34:08] know, I think first of all, I think BTC
[34:10] Pay Server, I love that project. I love
[34:12] that team. I think they the situation
[34:15] that they found themselves in was very
[34:17] unfortunate. I think they handled it as
[34:18] well as they possibly could have. I'm
[34:20] really sorry for anyone that lost money
[34:23] and that was affected.
[34:24] Um sucks.
[34:25] Uh one of the things that's different
[34:27] about Strike is majority of Strike's
[34:29] code is closed-source. It's not
[34:31] open-source. And you know, that's
[34:32] because we're a business. Uh
[34:34] we are not a public utility. We are
[34:37] proprietary information that I and my
[34:40] colleagues have been working on for
[34:42] many, many years. And we have
[34:44] competitors, and we have regulated,
[34:46] licensed stuff. And so, it's not for
[34:49] public consumption. But, what's really
[34:50] interesting is that actually gives us an
[34:52] advantage in many ways in this AI world
[34:55] where you can think of someone like BTC
[34:57] Pay Server, because they're open source,
[35:00] the attacker has access to all of the
[35:03] same information as the defenders. And
[35:05] so, they're kind of dueling it out on
[35:08] even playing field.
[35:09] And also, BTC Pay Server is not a
[35:11] business. So, it doesn't have a war
[35:13] chest of a balance sheet, or it doesn't
[35:14] have cash flows to subsidize more and
[35:16] more tokens. And so, it's an it's an
[35:19] open source project that's funded
[35:21] charitably, you know, by 501c3s like
[35:24] OpenSats and the Human Rights
[35:25] Foundation. And because it's an open
[35:28] source project, it's, you know, the
[35:30] attacker and the defenders have access
[35:32] to the equal amounts of information. So,
[35:34] it's actually a much more difficult
[35:36] thing, which we'll get into in a second,
[35:38] to be an open source project operating
[35:41] in this AI world, because for Strike, we
[35:44] have a few advantages. One, we have
[35:46] money.
[35:47] We have money to say, "Hey, I don't
[35:49] like, you know, when uh some of these
[35:51] Bitcoin red team uh engineers were
[35:54] trying to investigate all the relevant
[35:56] Bitcoin code bases and make sure that
[35:59] everyone was secure or disclose
[36:01] potential vulnerabilities, they were
[36:02] tweeting out like Rob Ham- Hamilton,
[36:05] Calle, they're tweeting out like, "We're
[36:06] running out of money. Oh, [ __ ] We're
[36:08] running out of money, or, you know, we
[36:10] we could use some funding." Like, that's
[36:12] not a problem for Strike. We've got
[36:13] plenty of money. We've got plenty of
[36:14] Bitcoins. And like, we I tell the
[36:16] engineers like, "Whatever, go go run
[36:18] your agents. Like, you know, security is
[36:20] is the number one feature that a Bitcoin
[36:23] company can have." And so, that for one,
[36:25] we're a company. And so, we have money,
[36:27] we make money, and that's an advantage
[36:29] that we have.
[36:31] Another advantage that we have is not
[36:32] everything's open source. So, we
[36:34] actually know much more about our code
[36:36] base and our systems than an attacker
[36:39] does.
[36:41] And so, there's a little bit of
[36:42] asymmetry there. Now, again, the cost
[36:44] for an attacker to familiarize
[36:46] themselves is very low, and so, no one
[36:49] should take that for granted anymore.
[36:51] But, with that being said, I'll always
[36:54] know more about Strike than anybody
[36:56] else. And that's not necessarily the
[36:58] case about BTC Pay Server, because
[37:00] everything there is to know is public.
[37:02] You see?
[37:03] So, it's a very difficult situation. I
[37:05] have a lot of empathy and a lot of
[37:07] respect for all of these open source
[37:08] projects and the Bitcoin red team.
[37:10] Everyone that everything everything that
[37:12] everyone is doing is really admirable. I
[37:15] think the way that the Bitcoin community
[37:17] has locked arms and united in this
[37:19] moment and in this bear market will look
[37:22] back and be very fond of.
[37:24] Um and so, I I also just wanted to
[37:26] acknowledge that. Like, um I'm in no
[37:28] way, when I'm talking about Strike,
[37:30] bragging. We'll we'll talk about this in
[37:32] a second. Um you're only as secure as
[37:36] your greatest adversary. So, you know,
[37:39] saying you are secure definitively is
[37:41] famous last words. You're you may have
[37:43] been secure as of last second, but in
[37:46] the current second we're living in, who
[37:47] knows? That's kind of how security
[37:49] works, by the way. It's constantly
[37:52] iterating to defend your systems. Now,
[37:54] I'm very proud of how Strike has
[37:56] performed in this AI era. I feel like we
[37:59] have been prepared. We have been
[38:02] forward-thinking. We have not been
[38:03] scared in investing and investigating
[38:06] what is best and where the world's
[38:08] going. And so, I think sharing some of
[38:10] the work we're doing is very cool and
[38:12] very fun and very exciting. But, yeah,
[38:14] these open source projects, we'll we'll
[38:15] talk about them right now, actually. Um
[38:18] and just
[38:19] kind of the security economy that's
[38:21] being created and where I think the
[38:23] world of Bitcoin and open source
[38:26] software generally is going in the world
[38:27] of AI. So, uh let's talk about this new
[38:30] security economy, the Bitcoin red team
[38:31] and open source security budget. So,
[38:34] first of all, I've talked about this
[38:35] Bitcoin red team. Um I think technically
[38:37] it was started by Rob Hamilton. Shout
[38:39] out Rob. Um Calle, I think uh Craig is
[38:42] now. I actually don't really know
[38:45] everyone who's working on it, but I just
[38:46] want to shout them out, thank them for
[38:47] their work. This is basically a group of
[38:49] Bitcoiners
[38:50] that realized what happened with the
[38:51] Coldcard incident. It is I don't know if
[38:54] we're we'll ever be able to prove for
[38:56] certain, but it is very likely the case
[38:59] that the Coldcard incident was
[39:03] predominantly because of Kimmy K3, this
[39:05] Chinese frontier AI model that came out
[39:07] and was able to find the issue and then
[39:10] a human exploited it because it had
[39:13] access to this very cheap expert
[39:15] security expertise, which was this AI
[39:17] model.
[39:18] And so, this group of Bitcoiners said,
[39:20] "Well, [ __ ]
[39:21] Like I've been saying on this
[39:23] presentation, the only way to defend
[39:25] yourself against attackers like that is
[39:27] to effectively exploit yourself first,
[39:30] find vulnerabilities before they do.
[39:32] And so, let's get access to funding,
[39:35] let's get access to all these AI models,
[39:37] and let's just start scanning everything
[39:39] relevant to Bitcoin to protect ourselves
[39:41] because, you know,
[39:44] once you find a vulnerability, you have
[39:45] two options. You can either patch it or
[39:47] you can exploit it.
[39:48] And, you know, obviously the you call
[39:50] them white hat hackers or black hat
[39:52] hackers. The white hats want Bitcoin to
[39:54] succeed, see the value in patching these
[39:56] things, building confidence in the
[39:58] industry. Uh and then the black hats see
[40:00] an opportunity to exploit. And so, this
[40:02] Bitcoin red team stepped up to the
[40:04] table. They've been a beacon of
[40:05] leadership uh in this moment. Um not
[40:08] falling for FUD, not getting their their
[40:10] hopes down. Um and so, shout out to
[40:12] them. So, this is kind of
[40:16] what we're looking at is OpenSats is
[40:18] funding all of the
[40:20] AI-related expenses to allow them to
[40:24] continue to scan these code bases.
[40:27] Um the expenses are just AI compute. So,
[40:30] you have these token costs that are now
[40:32] part of everyone's security budget,
[40:34] Strike as well. So,
[40:36] we all are basically strapped with a new
[40:38] line item
[40:39] of cost to secure our systems.
[40:43] Uh and we've seen real results. So, BTC
[40:46] pay servers critical vulnerability patch
[40:48] actually came from the Bitcoin red team
[40:51] themselves. And so, we are literally
[40:54] watching the cost of expert security
[40:56] research collapse in real time. Like,
[40:59] the security budget of open source used
[41:02] to be almost entirely human time,
[41:04] and now it's almost entirely not human
[41:07] time. Um so, here's kind of what I was
[41:09] just talking about. Uh it used to be,
[41:13] you know, the open source security
[41:14] budget it used to be human expertise,
[41:16] time, and then funding.
[41:19] And now there's a new line item, which
[41:21] is AI compute. So, you need LLM token
[41:25] costs, agent infrastructure,
[41:27] and continuous tooling. I think Calle
[41:30] released a new tool today, which he has
[41:33] been using as part of the red team. He
[41:35] just open-sourced it. So, going to need
[41:37] more tooling, more token cost funding
[41:40] for tokens, agent infrastructure.
[41:43] And it's This is now what it takes to
[41:47] secure Bitcoin software and just open
[41:49] source software generally. Again, this
[41:50] is not a Bitcoin-specific problem.
[41:52] Um oh shoot, I made the screenshot too
[41:55] small. Let me zoom in here. This is Rob
[41:57] from the Bitcoin red team.
[42:00] He wrote, "Yesterday, I began fully
[42:02] invest fully integrating, excuse me, the
[42:05] OpenAI trust cyber program into my
[42:07] Bitcoin red team efforts. This morning,
[42:09] I woke up to see this. I'm now being
[42:11] blocked from doing additional analysis
[42:13] on a code base which I've already
[42:15] responsibly disclosed to you and have
[42:16] received confirmation had legitimate
[42:18] findings.
[42:20] To be clear, this is after having
[42:21] already KYC'd and completed the
[42:23] onboarding process months ago to use the
[42:25] cyber capabilities open AI has to offer.
[42:29] I am now prevented from being able to
[42:30] continue the investigation in a further
[42:32] effort to make sure their code changes
[42:35] are sufficient as well as understand if
[42:37] there are other issues that have yet to
[42:39] be discovered.
[42:40] It absolutely guts me as a patriotic
[42:42] American to have to do this, but I will
[42:44] be going back to using Chinese
[42:46] open-source models to conduct my
[42:48] research to protect Bitcoin
[42:49] infrastructure. Black hats will not hit
[42:52] these issues. The white hats will. We've
[42:54] hit a local minima in policy.
[42:57] Intelligence in is unrestricted for
[43:00] those who don't follow rules and those
[43:02] who engage in harm reduction are left on
[43:05] the sidelines. What are we doing in this
[43:07] country? How is this keeping people
[43:09] safe? Please do something. David Sacks,
[43:12] Sam Altman, Donald Trump. And
[43:16] I just find this incredibly ironic,
[43:19] disappointing, frustrating, but I mean
[43:22] comical as well because we've talked
[43:24] about this on the show. How many times
[43:26] on the show have I talked about with you
[43:27] guys the fact that
[43:30] I mean
[43:32] American
[43:34] policy
[43:36] I'll just be blunt.
[43:38] China is the one open-sourcing things
[43:40] and allowing free markets to drive the
[43:42] cost to near zero. America is the thing
[43:45] full of lobbyists, political games,
[43:49] um creating regulatory motes,
[43:52] preventing free market,
[43:54] uh just capitalism, competition,
[43:57] and close-source repositories.
[44:02] If someone was born yesterday and I were
[44:04] to say, "Okay, here's what
[44:07] Kimmy K3 is. Here's what
[44:11] whatever Anthropic Opus, all these
[44:13] models are, and here's what
[44:16] Open AI is.
[44:18] Which one is Chinese, which one is
[44:20] American? And they were born yesterday
[44:22] and they had no idea.
[44:23] They would think that Kimik 3 is
[44:25] American. It's cheaper, it's open
[44:27] source.
[44:29] It's going to continue to get driven
[44:30] down.
[44:33] It's crazy.
[44:34] And we've been talking about this on the
[44:36] show.
[44:37] And and this is bleeds a little bit into
[44:39] the macro, so I won't get into it too
[44:41] much, but the reason, in my opinion,
[44:43] that the American
[44:45] frontier labs are acting the way they
[44:47] are is because they've borrowed so much
[44:49] money to build this stuff out that
[44:51] having truly free market competition
[44:54] will render everyone insolvent, not just
[44:56] Open AI and Anthropic, but Oracle, all
[44:59] everyone that's lending all of this
[45:01] money.
[45:03] Because how is anyone going to get paid
[45:04] back if all this stuff is open source
[45:06] and almost free?
[45:09] And the reason it is so expensive to
[45:12] build this infrastructure in America
[45:14] versus China is because the dollar is
[45:16] the world reserve currency.
[45:18] There is a premium to the dollar because
[45:21] there is perpetually built-in demand to
[45:23] the currency that is world reserve. You
[45:25] need it to cross currency and trade
[45:27] globally. You need it to refinance and
[45:29] pay down debts. You need the currency,
[45:32] no matter what, so it trades at a
[45:33] premium. Another way of saying this is
[45:35] gold and Bitcoin should be multiples
[45:38] higher because the dollar should be
[45:40] worth less, but it's this world reserve
[45:41] thing.
[45:43] And so America is perpetually more
[45:45] expensive. Why is the iPhone not built
[45:48] in America? Why is it built in China?
[45:50] Well, because China has weaker currency,
[45:52] cheaper labor,
[45:54] more
[45:55] better infrastructure.
[45:58] They're they've become the world's
[45:59] factory.
[46:00] So here you have like
[46:03] someone who's who's
[46:05] run First of all, running a trade
[46:06] surplus. By the way, I'm no fan of the
[46:08] CCP, right? Everyone knows that. Abolish
[46:10] the CCP.
[46:12] But, let's call a spade a spade. China
[46:15] is running a trade surplus, recycling
[46:18] their trade surplus into gold. It They
[46:20] They are
[46:21] promoting and pushing the world towards
[46:23] using neutral reserve assets.
[46:27] And they are open-sourcing their
[46:29] frontier AI labs
[46:31] and models.
[46:32] And they're running at a fraction of the
[46:34] cost.
[46:36] Meanwhile,
[46:38] Anthropic is lobbying lobbying in DC
[46:41] against open-source software.
[46:43] It's [ __ ] crazy. Are you Have you
[46:45] lost your mind? What country am I living
[46:48] in?
[46:49] They're lobbying against open-source
[46:50] software. They're lobbying for
[46:52] regulatory modes. They're saying, "This
[46:54] is all so dangerous. The thing we've
[46:56] created is so dangerous, no one else
[46:57] should be allowed to create it. We will
[46:59] govern who has access
[47:03] to intelligence."
[47:05] What?
[47:07] You're the the god amongst us plebs?
[47:10] [ __ ] you.
[47:16] So,
[47:17] anyways, I have written on the slide.
[47:18] The problem is that these American AI
[47:20] companies are blocking legitimate
[47:22] security researchers. So, this is the
[47:24] problem when you create central
[47:26] planning, human interference, you
[47:27] over-regulate.
[47:29] The best regulator of society is the
[47:31] free market itself.
[47:34] The less is more. Let people do what
[47:37] they want.
[47:39] Let them put they want put what they
[47:40] want in their bodies.
[47:42] Let them do what they want with their
[47:44] lives.
[47:46] Guess what? If they do fucked-up
[47:47] unhealthy [ __ ] I bet they stop because
[47:50] they're going to feel bad and they're
[47:51] going to ruin their life. It's very
[47:52] simple. If they build a business it
[47:54] doesn't work, let them. It will fail.
[47:56] Everyone will learn from it, and they'll
[47:57] have to do something else.
[48:00] But, more government, more regulation,
[48:03] more politicians, more central
[48:05] interference. And people say, "Well,
[48:07] what's the worst that can happen?" This
[48:09] is the worst that can happen.
[48:11] Legitimate security researchers are now
[48:14] dispositioned against attackers because
[48:17] you have these American companies that
[48:19] aren't letting American researchers
[48:22] protect themselves.
[48:24] [ __ ] ridiculous.
[48:26] And here Here we are having an American
[48:28] Bitcoiner in Rob say, "Thank God for
[48:31] China."
[48:33] Crazy.
[48:35] I mean, if this isn't a wake-up call,
[48:36] like, get your head out of your ass, I
[48:39] don't know what is.
[48:43] Do we want really want to build a world
[48:45] where the people with good intentions
[48:47] that are trying to protect people's
[48:48] funds and build secure software and keep
[48:49] America on the bleeding edge of finance
[48:52] and technology, which is Bitcoin, by the
[48:54] way. That is what the bleeding edge of
[48:55] finance and technology is. It is Bitcoin
[48:57] and it is AI. And you have people like
[49:00] Strike and like Rob that are trying to
[49:02] make sure that this country remains on
[49:04] the bleeding edge and in first place. We
[49:07] are dispositioned. We are paying more.
[49:09] We are on waiting lists. And the black
[49:11] hat hackers that want to [ __ ] everybody
[49:15] that don't follow the rules, they have
[49:17] an advantage? Crazy. I mean, Strike's
[49:20] infrastructure, we we invested heavily
[49:23] in plugging in
[49:25] all all the Chinese models. It is
[49:28] drastically cheaper, and they don't cut
[49:29] me off. They don't They don't wave a
[49:31] political flag in my face and say,
[49:33] "Sorry, we're not going to help you
[49:35] investigate BTC Pay Server because we're
[49:37] Anthropic, and we don't trust your
[49:39] judgment as a human."
[49:40] [ __ ] you.
[49:46] So,
[49:48] we've been talking about this dynamic on
[49:50] on show for months, for a very long
[49:52] time, I've been saying time and time
[49:55] again, China knows the leverage they
[49:57] have in open-sourcing these models. They
[49:59] know
[50:00] that the US is screwed.
[50:02] Because I mean that it will pop this AI
[50:04] bubble. If OpenAI has to bring their
[50:07] costs to zero,
[50:09] they're not they can't pay back Oracle.
[50:11] They can't pay back Nvidia. They can't
[50:12] pay anybody back. These are trillions
[50:14] and trillions and trillions and
[50:15] trillions of dollars of infrastructure
[50:17] build-out and money lent.
[50:20] And I mean this is why these companies
[50:22] aren't going public. The the value of
[50:24] their equities will collapse. Cuz I
[50:26] don't think that these companies are
[50:27] actually worth a trillion dollars.
[50:30] You know, if you can get one one venture
[50:32] capitalist to agree that you're worth a
[50:34] trillion dollars, then you're worth a
[50:35] trillion dollars. But in the public
[50:37] markets, that's not how it works. You're
[50:38] worth whatever the last traded price
[50:39] was.
[50:43] I digress. We'll do macro stuff on a
[50:45] later episode.
[50:46] But anyway, I responded to Rob's tweet
[50:49] and I said, "Bitcoin, open-source
[50:50] software, and free markets embody
[50:52] American values. Whatever this is
[50:54] doesn't."
[50:56] This is the most un-American thing. You
[50:58] know, and that's kind of the hilarious
[51:01] reality of this whole situation. Do you
[51:02] know what's un-American? The dollar. Do
[51:05] you know what's American? Bitcoin. Do
[51:08] you know what's un-American? Anthropic.
[51:11] Do you know what seems to be pretty
[51:12] American? Kimmy K3. It's [ __ ] weird.
[51:15] And whatever. Like, we'll figure it out.
[51:17] As a country, we're going to figure this
[51:19] out. We're going to persevere. But like,
[51:22] you got to call a spade a spade. That's
[51:24] why this show exists. I don't care if,
[51:26] you know, you can imagine if someone was
[51:28] my sponsor, they'd be like, "Oh, you
[51:29] know, can't sponsor that guy. He's out
[51:32] there, you know, telling the US
[51:33] government they need to get their act
[51:35] together about AI." Well, guess what? I
[51:37] don't have any sponsors. You know, the
[51:39] people that fund me are you guys. The
[51:40] fact that you guys use Strike allowed me
[51:42] to do this show. So, I got to Someone's
[51:45] got to call a spade a spade. Someone's
[51:47] got to tell the truth.
[51:48] You know, us Americans have to defend
[51:50] American values and American ideals.
[51:54] We got to open source software, allow
[51:56] free markets, embody things like
[51:58] Bitcoin, protect Bitcoin in this
[52:00] country. That means enabling researchers
[52:02] in this country to protect
[52:04] the [ __ ] infrastructure of the space.
[52:09] So,
[52:10] I talked a bit about open source
[52:13] software
[52:14] versus source visibility. Ah, damn.
[52:16] Sorry, these rendered so small. Um so, I
[52:19] tweeted this as well last week. I just
[52:21] wanted to have it. I I think that this
[52:22] is a valuable conversation for the
[52:24] community to have.
[52:25] Um so, I tweeted out, "Relatedly, I
[52:28] think AI is forcing a harder
[52:30] conversation in open source software.
[52:32] The Coldcard incident is an example and
[52:34] forces an uncomfortable realization for
[52:36] Bitcoiners. Source visibility is not a
[52:39] security model." So, by the way,
[52:41] uh SparkNotes, source visibility means
[52:44] that your code is viewable on the
[52:46] internet. Okay. Open source does not
[52:49] guarantee security.
[52:51] The advantage of free and open source
[52:53] software is not only visibility, it's
[52:55] also the review economy it can create.
[52:58] People and companies can build on the
[52:59] code, fork the code, compete with it,
[53:02] depend on it, challenge it, and improve
[53:04] it. Coldcard's firmware was public and
[53:07] reproducibly buildable, but it was
[53:09] licensed under the Commons Clause. It
[53:11] was source available rather than truly
[53:14] open source.
[53:15] SparkNotes, that means that it was
[53:17] visible to the public, but you couldn't
[53:19] use it commercially. You weren't allowed
[53:21] to build your own services and products
[53:23] with it. So, that's very different than,
[53:25] "Hey, what's mine is yours. Use this."
[53:27] Because then you're very incentivized to
[53:29] take care of it if it's also supporting
[53:31] your business or it's also supporting
[53:32] your family or your customers. Where
[53:34] Coldcard didn't allow anyone else to
[53:37] truly use their software. Technically,
[53:38] it was viewable, but just because it's
[53:41] viewable doesn't mean people will care
[53:42] about it. You know what I mean?
[53:45] Okay, I go on. The license did not cause
[53:47] the bug and I can't prove a different
[53:49] license would have caught the bug, but
[53:51] my point is commercial freedom is one
[53:54] way open source creates more independent
[53:56] companies and developers with real skin
[53:58] in the game. The Coldcard bug survived
[54:00] for years even though the code was
[54:02] visible. It clearly was not challenged
[54:05] enough. Why?
[54:07] Take Bitcoin Core as the contrast. It's
[54:09] advantage isn't simply that it's
[54:11] repository is public. It is genuinely
[54:13] open and sits at the center of an
[54:16] ecosystem whose money, products, and
[54:18] businesses depend on continuously
[54:20] reviewing, testing, challenging, and
[54:22] improving it.
[54:23] AI makes this distinction urgent. Source
[54:26] visibility is symmetric. Defenders and
[54:29] attackers can inspect the same code. AI
[54:32] has collapsed the cost of expert
[54:34] scrutiny. A small team can no longer
[54:37] assume that publishing source means that
[54:39] the public is defending it more than an
[54:41] expert level scrutiny is attacking it.
[54:43] Without real review economy and
[54:46] continuous adversarial thinking and
[54:48] testing,
[54:49] the most motivated reviewer might just
[54:51] be the attacker. So, the question in
[54:53] Bitcoin can no longer be can I read the
[54:55] source code? It has to be who is
[54:58] continuously incentivized to prove it
[55:00] wrong and fix it before an attacker
[55:02] does. When I think about software
[55:05] being safe enough to trust with my life
[55:06] savings, especially in the age of AI, I
[55:09] think about Bitcoin Core. It is
[55:10] genuinely open and continuously
[55:12] challenged by an ecosystem with real
[55:14] skin in the game. This is something to
[55:16] think about. Okay, so what am I talking
[55:18] about?
[55:19] So, basically my point is this.
[55:21] I think that there was a notion in
[55:23] Bitcoin and in the world that as long as
[55:25] the code is publicly available,
[55:28] then it's secure because people can
[55:30] review it, people can test it and try
[55:32] it, and there's no such thing as just a
[55:34] dormant bug sitting in the open for
[55:37] years. I mean, if there was a bug,
[55:39] someone would have already found it.
[55:41] Now, clearly that's being proven wrong.
[55:43] The Coldcard issue existed for 5 years,
[55:45] 5 and 1/2 years, right? So,
[55:49] my point is to be truly open source, not
[55:53] only is it mean that
[55:56] your code is viewable, but your code
[55:58] also has to be able to be used by other
[56:02] people and is getting used by other
[56:05] people.
[56:06] Meaning, Coldcard, they were using the
[56:08] commons clause, so you couldn't actually
[56:10] use their firmware to build your own
[56:12] hardware wallet or to build your own
[56:14] stuff.
[56:15] And for that reason, no one else was
[56:17] using the firmware outside of Coldcard
[56:19] themselves. And because no one was using
[56:22] the firmware outside of Coldcard
[56:23] themselves, not that many people cared
[56:25] to investigate the firmware.
[56:28] At least technically, like businesses,
[56:30] engineers. Sure, lots of customers cared
[56:33] about the firmware, but customers don't
[56:34] have the technical chops to actually go
[56:37] in and and check it out.
[56:39] And so, you know, like Strike wasn't
[56:41] using Coldcard firmware, for example.
[56:44] Even if we wanted to, we weren't allowed
[56:45] to. And so, you guys have to understand,
[56:48] and I want the community to understand,
[56:50] that part of the security that comes
[56:52] with open source is being truly open
[56:54] source, and meaning that not only are
[56:56] you the only person using your software,
[56:59] but a community of other businesses and
[57:01] other developers and the entire industry
[57:03] is using your software. Because that
[57:05] greatly deepens the security, because
[57:07] now you have all sorts of people that
[57:10] are constantly reviewing, testing,
[57:11] investing in, building, fixing the code.
[57:15] So, I write here, "Open source does not
[57:17] guarantee bug-free software. The benefit
[57:19] of a truly open source project is in the
[57:21] review economy that it creates.
[57:23] Developers, companies, competitors,
[57:25] researchers, users, and downstream
[57:27] businesses can all have an economic and
[57:29] technical incentive to challenge and
[57:32] improve widely used code. A public
[57:34] GitHub repository does not automatically
[57:37] make a system secure.
[57:39] Okay? So,
[57:41] I contrast Coldcard and Bitcoin Core.
[57:43] Coldcard's firmware was publicly
[57:45] inspectable, reproducibly buildable,
[57:48] source available, and it was respected
[57:50] in the Bitcoin community. But, the
[57:52] vulnerable path that was exploited
[57:54] remained insufficiently challenged for
[57:57] years despite being technically visible.
[58:01] Bitcoin Core on the other hand, it's
[58:03] genuinely open source, so it holds an
[58:04] MIT license, not Commons Clause. It's
[58:07] widely depended on.
[58:09] So, everyone in Bitcoin depends on
[58:11] Bitcoin Core. Michael Saylor, Jack
[58:13] Dorsey, every single hodler, every
[58:16] single nation state. Now, the United
[58:17] States of America depends on Bitcoin
[58:19] Core.
[58:20] If Bitcoin Core fails,
[58:22] Bitcoin fails.
[58:23] That's at the protocol level. It's not
[58:25] an application layer, it's not a
[58:27] business layer, it's not hardware layer.
[58:29] That's the the that's the consensus
[58:31] rules.
[58:33] So, Bitcoin Core has the largest review
[58:36] economy. Devs, miners, exchanges,
[58:39] researchers, nation states, businesses,
[58:41] capital markets, BlackRock cares about
[58:43] Bitcoin Core.
[58:45] You see what I'm saying in that how the
[58:47] incentives matter because what these AI
[58:49] era is going to do is like, you know,
[58:52] Coldcard was a very small team.
[58:54] And you could say, "Yeah, but their
[58:55] software was open source." Yeah, but not
[58:58] really. Like, no one else was allowed to
[59:00] care about it.
[59:03] So, something like Bitcoin Core is
[59:04] continuously challenged, tested, fuzzed,
[59:06] improved. MIT professors and researchers
[59:10] are constantly battle testing Bitcoin
[59:11] Core. Saylor's funding engineers for
[59:14] Bitcoin Core. Dorsey, I am, BlackRock,
[59:17] the United States of America.
[59:21] Like, if the United States of America is
[59:22] really truly custodying their own
[59:24] Bitcoin, they and running a node, they
[59:27] use Bitcoin Core.
[59:31] So, when you when you start to think
[59:32] about like security and what to trust
[59:35] for your life savings and obviously, you
[59:38] know, in the industry what we need to
[59:41] check on and keep ourselves honest about
[59:43] is if you have fringe open-source
[59:46] repositories that don't have a lot of
[59:47] contributors and a lot of reviewers and
[59:49] a lot of other businesses using it, you
[59:51] have to ask yourself, is the most
[59:53] motivated
[59:54] reviewer an attacker?
[59:57] Right? Like
[60:01] And so, anyway, I I I think that this is
[60:03] a very important conversation that the
[60:06] Bitcoin community needs to have.
[60:08] You know, you can have
[60:10] fringe small projects that are
[60:11] open-source and that's fine,
[60:14] but
[60:15] it, you know,
[60:16] it doesn't cost a lot Previously,
[60:18] someone would have had to pay a lot of
[60:20] researchers a lot of money and a lot of
[60:22] really good engineers a lot of money to
[60:24] try and inspect the Coldcard. And who
[60:27] knows? What if there was no bug? Then
[60:28] you lose a bunch of money. So, there was
[60:30] the risk reward was really uncertain and
[60:32] nobody really cared enough to
[60:34] double-check seemingly and actually take
[60:36] a closer look. But AI drops the cost of
[60:39] that drastically. So, in order to be
[60:41] secure,
[60:43] you have to
[60:44] have a lot of defenders. Like you want a
[60:46] lot of defenders and you can either
[60:48] afford a lot of defenders by being a
[60:49] company and having the money to build
[60:51] your own team of red red uh a red team
[60:54] of agents like Strike does.
[60:56] You know, but if you're an open-source
[60:57] project, you have to be truly
[60:59] open-source and you have to allow other
[61:01] people to use the software, adopt the
[61:03] software, and care about the software.
[61:05] And again, I have keep bringing up
[61:08] People are like, "Oh man, is securing
[61:10] Bitcoin is cold storage dead?" No, cold
[61:12] storage isn't dead. Self-custody is not
[61:14] dead. But I will say that being truly
[61:17] secure in an open-source manner in the
[61:19] world of AI,
[61:20] it's going to be harder.
[61:22] You can't just be a rogue developer that
[61:25] open sources his project that no one
[61:27] else has heard of or used. How secure is
[61:29] that versus the Bitcoin repository
[61:31] that's responsible for consensus rules
[61:34] that everyone between BlackRock, the US
[61:37] government, plebs around the world,
[61:39] businesses, capital markets, everyone is
[61:42] relying on, using, testing, funding,
[61:45] you know?
[61:46] So, source visibility is symmetric. The
[61:48] defender can inspect and the attacker
[61:50] can inspect. So, AI lowers the cost of
[61:53] both.
[61:54] And it's just something to think about.
[61:56] So, anyways, is AI a threat to Bitcoin?
[61:59] Uh the answer is no.
[62:01] Um so, this diagram I have, you know,
[62:03] the protocol layer, consensus, proof of
[62:05] work, SHA-256,
[62:07] like the monetary policy of Bitcoin,
[62:09] that all lives in Bitcoin Core, that's
[62:11] all math, that that's all cryptography,
[62:14] no problem, okay?
[62:16] AI is going to battle test a lot of the
[62:19] business and application layer and
[62:21] infrastructure layer on top of that. So,
[62:23] lightning, uh BTC Pay Server, hardware
[62:26] wallets, APIs, exchanges, web services,
[62:30] these are all going to be challenged in
[62:32] and tested uh in a way to ensure
[62:34] security, okay? Um
[62:37] so, just to make the explicit point,
[62:39] like Bitcoin's math, 21 million supply,
[62:42] proof of work, uh elliptic curves, the
[62:45] key space of creating a large random
[62:48] number in Bitcoin 2 to 256, like that's
[62:51] not broken by AI, that's math, AI can't
[62:55] break that. Like uh don't worry.
[62:58] AI is rather very good at finding human
[63:01] mistakes.
[63:02] So, that is a that is a very different
[63:04] concept than breaking math.
[63:06] And so, you know, right now what we're
[63:09] living through is kind of
[63:12] can you can you find can can white hat
[63:15] hackers find human mistakes before black
[63:17] hat hackers.
[63:18] Uh
[63:19] and what does it mean to be secure in
[63:21] the world of AI? Like if you're an open
[63:22] source project, that doesn't guarantee
[63:24] security, especially not today.
[63:29] So, the new standard, what secure
[63:31] software means now.
[63:33] Um
[63:34] yesterday it was be open source, be
[63:36] audited, be pen tested, and be battle
[63:38] tested. And I believe it's all the same
[63:41] except now you need to be continuously
[63:43] red teamed.
[63:45] And whether that means we as an industry
[63:47] continuously fund a Bitcoin red team via
[63:50] something like OpenSats, or you build
[63:52] your own red team of agents like we have
[63:54] at Strike, we're going to try and open
[63:55] source as much of our AI work as we can.
[63:58] That's why we've started to blog it so
[64:00] that people can engage with what we're
[64:01] doing, ask questions, maybe we can learn
[64:03] a thing or two, or get feedback from
[64:05] other companies and corporations.
[64:07] Um but I think you need to add now this
[64:10] new line item, which is continuously red
[64:12] teaming yourself. Like what we're seeing
[64:14] with the red team funded by OpenSats and
[64:16] and run by Calle and and Rob, and what
[64:19] Strike is doing, um I I think that has
[64:21] to be part of the standard. Um
[64:24] because as I was alluding to before, uh
[64:27] you don't get to decide how secure you
[64:29] are. Your adversary does.
[64:32] You know, that that's this is kind of
[64:34] the humility that comes with building
[64:38] something secure. You can't have hubris
[64:42] and say say like, "Oh, I do everything
[64:43] perfectly and I'm smarter than everybody
[64:45] else." That's not how it works. Um
[64:48] you know, the people attacking you
[64:49] decide how secure you are. And so your
[64:52] job is to cover every access path, use
[64:54] all the best tooling, and to assume that
[64:57] you can make mistakes, or an employee
[64:59] can't turn against you, or a partner
[65:01] might not have your best interest. You
[65:02] have to prepare for that. That it's it's
[65:05] an ego-driven
[65:07] uh
[65:07] idea and and worldview to say, "No,
[65:10] everyone's going to love me. Every
[65:12] employee's going to respect me. Every
[65:14] everyone is going to take care of me. No
[65:16] one's going to try and attack me." That
[65:18] that's an inflated sense of self and ego
[65:20] and a very optimistic worldview, which
[65:22] may or may not happen.
[65:24] And so, you know, this is the energy
[65:27] that, you know, in order to build
[65:28] something secure. You don't get to
[65:30] decide that.
[65:31] You whoever's attacking you decides how
[65:33] secure you are. And so, AI made
[65:36] the cost of
[65:38] that like dramatically less. So, I
[65:41] believe in this new era trust is going
[65:44] to be earned by proving yourself
[65:46] secure before attackers do.
[65:49] And that's what we do on a daily basis
[65:51] at Strike with AI, and that's what the
[65:53] Bitcoin community is now doing on a
[65:55] daily basis. So, you know, in the near
[65:57] term, I think that latent bugs will get
[66:00] exposed. Um you know, project smaller
[66:03] projects, smaller open-source projects
[66:05] may have a difficult time. Some things
[66:06] may be exploited. Maintainers are going
[66:09] to be scrambling. The industry might
[66:10] scramble for a little bit. Weaker
[66:11] projects might have a tough time
[66:14] um surviving. Um so far so good,
[66:16] generally speaking. I mean, BTC Pay
[66:18] servers the only kind of post-cold-card
[66:21] exploit I've seen um exploited at at any
[66:25] scale.
[66:26] Uh but in the long term,
[66:28] I think that the industry is
[66:30] tremendously stronger for this. You
[66:32] know, bugs eliminated, the depth of the
[66:35] review and understand and security and
[66:38] open source increases dramatically.
[66:41] Security knowledge becomes reusable. I
[66:43] mean, think about how much we're
[66:45] learning as an industry from each other
[66:47] and banding together. And battle-tested
[66:49] software hardens. What survives
[66:51] continuous AI review becomes much much
[66:54] more robust. Every single day that goes
[66:56] by and we continue to harden our
[66:58] infrastructure, harden our exchanges,
[67:00] harden every bit of tooling that we use
[67:03] to support it. So, um
[67:06] yeah, I mean, I'll just recap. AI did
[67:09] not change Bitcoin's 21 million supply
[67:11] cap. It did not change proof of work. It
[67:13] did not change, you know, the key space
[67:16] for creating a private key. It did not
[67:18] change cryptography. It did not change
[67:20] math. What it changes is the cost of
[67:22] finding human mistakes. And so, in a
[67:25] way, you know, we must be grateful for
[67:27] this change. Um it's going to harden our
[67:29] work. It's going to make us better. It's
[67:31] going to make Bitcoin stronger. You
[67:33] know, I think that Bitcoin right now
[67:35] needs leadership. It needs clear-headed
[67:37] thinking.
[67:38] Uh it needs
[67:41] yeah, for proof of work, really. Um peo-
[67:44] people to kind of show the way, which I
[67:46] think many people are. Um very grateful
[67:48] for them. So,
[67:49] you know, the response is not to be
[67:51] scared and not to be fearful. The
[67:52] response is to use the tools ourselves.
[67:55] Um so, open source the code, fund the
[67:58] reviewers, run the agents, fix what
[68:00] breaks,
[68:01] um and Bitcoin will be better off for
[68:03] it. I I wrote here, Bitcoin has always
[68:05] gotten stronger just by surviving. And,
[68:08] you know, at the end of the day, what
[68:09] must break in order for Bitcoin to break
[68:11] is math.
[68:13] So, a- and and concepts like money
[68:17] itself. Like, obviously, if Elon Musk's
[68:19] version of the future pans out and
[68:21] money's no longer necessary or needed,
[68:23] then okay.
[68:25] But, you know, assuming scarcity is
[68:27] valuable, money there there there is a
[68:30] delta between wanting things and
[68:32] actually having things, and we need to,
[68:34] you know, allocate capital, and there's
[68:36] division of labor, and all of that
[68:38] stuff, then and mathematics
[68:41] uh works, then yeah, Bitcoin works as
[68:44] well, and all of this is just uh you
[68:47] know, some some pain along the way for
[68:49] long-term gain.
[68:51] So, hopefully that was useful and laid a
[68:53] a solid groundwork for what's going on
[68:55] in the space and uh for you guys to be
[68:57] able to ask some questions. We only are
[68:59] about an hour in, a little bit over. So,
[69:01] I should have uh time for a nice chunk
[69:05] of questions, but um
[69:07] Bitcoin's okay. Bitcoin's okay. I think
[69:10] AI is making the world a dramatically
[69:12] better place. It's very exciting. Uh
[69:15] reducing the marginal cost of
[69:16] intelligence to zero is really, really
[69:19] fun.
[69:20] Um and exciting.
[69:22] Uh but obviously it changes the world in
[69:25] a material way and we need to be active
[69:27] about it, open the dialogue, and learn
[69:29] from it.
[69:31] Okay. Let's see what questions you guys
[69:34] got.
[69:36] Okay, question one. Macro, are Chinese
[69:39] AI frontier models better than American
[69:41] ones? Is this strictly because the US
[69:43] companies have to keep a leash on their
[69:45] models for {quote} safety?
[69:47] Um
[69:48] I There are different uh ways that
[69:52] people measure these models.
[69:55] You know, there's speed, there's depth,
[69:57] there's mathematics, and I'm not
[69:59] necessarily an AI expert like some other
[70:02] people on the internet, so I'm not going
[70:03] to pretend that I am.
[70:05] Um what I'll say is this, they are
[70:07] cheaper
[70:08] I think because like I said, China is
[70:11] cheaper.
[70:12] Uh
[70:13] energy production, infrastructure
[70:17] um I mean, China owns the physical layer
[70:21] of all of this, like the hardware, the
[70:23] chips, the actual commodities, like the
[70:26] rare earths that go into building stuff.
[70:30] So, like, you know
[70:32] industrial infrastructure, like China's
[70:35] leaps and you know, the US needs to
[70:37] reshore.
[70:38] We've talked about this on the show a
[70:39] lot. The US needs to get away from just
[70:42] printing infinite money and running
[70:44] infinite deficits to actually doing real
[70:46] proof of work again and an ability to
[70:48] produce its own stuff. Now, what comes
[70:50] with that is a tremendously weaker
[70:52] dollar. You cannot reshore production
[70:55] and not tremendously weaken the
[70:58] currency.
[71:00] Labor has to be competitive. I mean, so
[71:03] anyways, we've talked about this a
[71:04] bunch.
[71:05] Um now, uh I I think you put in quotes
[71:08] safety. Like AI models are about keeping
[71:11] us safe. Again,
[71:13] I I think that the best thing for safety
[71:16] is free markets. Let people do what they
[71:18] want, and if they do something that
[71:19] harms them, they won't do it again
[71:21] unless they're an idiot. So, you know,
[71:23] it's almost like a form of Darwinism.
[71:25] The giraffe whose neck wasn't long
[71:27] enough to eat off the tree
[71:30] didn't survive to reproduce, and over
[71:33] time giraffes had long necks. So, you
[71:36] know, like I think free markets are the
[71:39] best way to like truly govern us. I
[71:41] think capitalism works.
[71:44] But uh yeah, I mean, these AI labs are
[71:46] lobbying in DC saying this stuff is
[71:48] dangerous, and there's only certain
[71:50] people, namely us, Anthropic, that
[71:53] should be allowed to govern who has
[71:55] access to artificial intelligence and
[71:58] who has access to this stuff. And that's
[72:00] ridiculous. And uh clearly, they're
[72:02] doing this for business incentive. And
[72:04] again, I think that the certain parts of
[72:08] the AI space
[72:09] can't afford open-source cheap
[72:11] competition.
[72:13] They can't afford Google and Meta to get
[72:16] into the game and compete with them.
[72:18] Because they're
[72:20] taking they've taken on all this debt.
[72:22] They have all they owe all this money.
[72:24] They need to go public and pay back
[72:25] their investors, and competition breeds
[72:29] innovation and lowers costs. And I I
[72:31] don't think that they can I don't think
[72:33] they want to compete with China or
[72:35] Google. I think that they want America
[72:38] politics to ban Chinese models from
[72:40] Americans and to create regulation which
[72:45] makes Anthropic like the de facto king
[72:48] of all of this. And then with that in
[72:50] place, they'll pay everyone back, and
[72:51] they'll be God amongst us all. I
[72:53] literally think that's And that's
[72:56] obviously asinine, ridiculous, the most
[72:58] anti-American thing I've ever heard, but
[73:00] that's seemingly what's happening. I
[73:01] mean, reading OpenAI researchers write
[73:03] blog posts about how open-source
[73:05] software is bad. I mean, this is This is
[73:08] ludicrous. It's crazy. And this is, I
[73:11] guess, what Elon has a lot of issues
[73:14] with. At least this is his kind of
[73:16] marketing claim is that
[73:19] these
[73:20] people are evil, and they have their own
[73:22] self-interests over the betterment of
[73:24] humanity. I mean, Elon I I've I've never
[73:25] met Elon. I don't know Elon, so I can't
[73:27] vouch for
[73:29] his credibility in these claims, if he's
[73:31] marketing himself or if he truly means
[73:33] it. He seems to truly mean it. I kind of
[73:35] believe him.
[73:36] Uh and he's claiming these, you know,
[73:38] there are evil interests evil evil big
[73:40] corporate interests at play here, and
[73:43] that AI is going to dramatically reshape
[73:46] society, and it is going to be a step
[73:48] function change for all of us to digest,
[73:51] and it can't afford to be closed-source.
[73:54] It can't afford to live in a world of DC
[73:58] lobbying and overregulation and
[74:00] regulatory moats. Um that's been his
[74:03] aggressive pitch, and you know, he's
[74:05] been in legal battles with OpenAI, and
[74:07] he's had very harsh words for Anthropic,
[74:09] and
[74:10] I mean,
[74:11] I again, I'm not I
[74:13] I spend my time working on Bitcoin,
[74:16] but
[74:17] it's my two cents.
[74:19] Okay, Bitcoin and market questions. Uh
[74:21] it feels like Bitcoin Core is the most
[74:23] decentralized, verified, and secure
[74:24] software, and therefore the best to
[74:26] create a wallet and keep our funds safe.
[74:28] Is there anything else that can compare?
[74:32] Um I don't I personally don't think it
[74:35] gets better than Bitcoin Core. You know,
[74:38] now
[74:39] I talked about uh in the last episode,
[74:42] it depends on what you want to do. You
[74:43] know, hardware wallets can be valuable
[74:46] certain use cases, you know, uh like
[74:49] BitKey makes multi-sig very easy. So
[74:52] does Casa Unchained, although there's
[74:55] very different trade-offs for each of
[74:56] those services.
[74:58] So, would I
[75:01] for someone who's a novice, who's
[75:03] getting a Bitcoin hardware wallet for
[75:04] Christmas,
[75:06] would I gift them a offline laptop and
[75:09] tell and with instructions on how to set
[75:11] up Bitcoin Core?
[75:13] Probably not, but like
[75:15] at the end of the day, the most like
[75:17] truly open source, battle-tested,
[75:20] reviewed, and incentivized across a
[75:23] broad range of Bitcoin participants,
[75:26] like Bitcoin Core, there's no there's no
[75:29] one close to Bitcoin Core.
[75:32] And at the end of the day, if you
[75:33] if you want to generate a really large
[75:36] random number,
[75:37] Bitcoin Core can do that. Um
[75:40] and and it's got the most eyeballs on
[75:43] it, the most investment. So, yeah, I if
[75:47] that's the the answer you're looking
[75:48] for. I don't want to
[75:51] imply that there's no other project that
[75:54] should be part of self-custody. I think
[75:56] custody will continue to be
[75:58] a sub-industry within the space that
[76:00] develops and evolves, and there's going
[76:02] to be all sorts of products and
[76:03] services. I mean, I talked about how
[76:04] Strike is very interested and excited
[76:06] about things that we could do in the
[76:08] space, but yeah.
[76:10] Bitcoin Core is definitely unique in
[76:13] certain respects.
[76:15] >> [sighs]
[76:15] >> Hey Jack, can you spend 5 to 10 minutes
[76:17] talking about multi-sig and if you set
[76:19] up, let's say, a two of three with three
[76:21] completely different devices, if it
[76:22] protects you better. How do you feel
[76:23] about the Sparrow wallet? I love the
[76:25] Sparrow wallet. I'll let everyone
[76:28] research that and take a look on their
[76:30] own. But
[76:32] yeah, so multi-sig is very cool. Bitcoin
[76:36] actually has a language called script.
[76:38] And Bitcoin script allows us to
[76:42] add logic to Bitcoin transactions. So,
[76:45] you can say something like
[76:47] this Bitcoin these Bitcoins this unspent
[76:51] Bitcoin can't be spent until block
[76:55] X. So, you know, I I said at the
[76:58] beginning of the show the Bitcoin block
[76:59] height right now, let's refresh. I'm
[77:01] looking at uh latest Bitcoin block
[77:03] height of 961,932.
[77:07] So,
[77:08] I could conditionally say to some of my
[77:11] Bitcoins, these Bitcoins can't be spent
[77:14] until block 2 million, which is way out
[77:17] into the future. Those Bitcoins are then
[77:18] stuck until that block height. So, you
[77:20] can add scripting language to your
[77:22] Bitcoin transactions that says this
[77:25] Bitcoin can't be spent by, you know,
[77:28] can't be spent to any uh by by before
[77:31] this block height. Now, one of the other
[77:33] things that is multi-sig is this uh
[77:36] bit these Bitcoins cannot be spent
[77:39] without two signatures from one of from
[77:42] these three
[77:45] key pairs wallets.
[77:47] Does that make sense? So, you say,
[77:48] here's Jack,
[77:50] Dylan,
[77:51] and
[77:53] Bill.
[77:56] Now, these Bitcoins can't be spent
[77:58] without two signatures from any of the
[78:00] three. So, either Jack and Dylan, Jack
[78:03] and Bill, Dylan and Jack, Dylan and
[78:05] Bill, Bill and Jack, Bill and Dylan. One
[78:08] of those variants
[78:10] if only one if only Jack wants to move
[78:12] the coins, not possible. If only Dylan,
[78:13] only Bill wants to move the coins, not
[78:15] possible. So, that adds some security.
[78:18] Because if Jack gets compromised, if
[78:21] Dylan gets compromised, if Bill gets
[78:22] compromised, the coins are fine and
[78:24] they're still spendable because you
[78:25] still have two left over. Now, you could
[78:27] do two of four, two of five, two of six,
[78:30] two of seven.
[78:32] Okay? Now, if two people get
[78:34] compromised, the coins can move. So, you
[78:35] can do three of five. You can do five of
[78:37] seven. You can do
[78:40] whatever. Five of nine, six of 11.
[78:43] You can do whatever you want. Add that
[78:44] logic. Now, let's take out the names
[78:47] and let's do hardware wallets. You
[78:50] create one key with a Coldcard, one key
[78:52] with a Ledger, one key with a Trezor.
[78:55] Coldcard incident happens, but the
[78:56] Coldcard is not enough to move the funds
[79:00] cuz you created a two of three
[79:01] multi-sig.
[79:03] So, the Coldcard is compromised, but the
[79:05] attacker can't move out of a two of
[79:07] three multi-sig because they only have
[79:08] one.
[79:09] And so, you are protected because you
[79:11] still have the Ledger and you still have
[79:12] the Trezor, and then you move the funds
[79:14] and you recreate one, you remove the
[79:16] Coldcard out of there.
[79:18] Does that make sense? So, yes,
[79:19] multi-sig is great. Now, multi-sig adds
[79:23] complexity. The scary part about
[79:25] multi-sig is if you set it up wrong,
[79:27] maybe the funds are never spendable.
[79:29] Like, what if you
[79:31] program it that I'm just trying to
[79:33] oversimplify this a little bit, but you
[79:35] program it to say, you know, only two of
[79:39] three of Jack, Dylan, and Bill can sign.
[79:42] But what you actually sent up is, you
[79:44] know, Jack, Joe, and John. You're like,
[79:47] "Oh, [ __ ] I don't know Jack and John. I
[79:50] accidentally hit the wrong number. Now
[79:52] these Bitcoins can never move because
[79:54] you can't file a customer support ticket
[79:57] to the Bitcoin protocol. It's all
[79:59] cryptography. So, once you set it, you
[80:01] set it. So, the only reason I say that
[80:04] is there's no silver bullet. You know,
[80:05] multi-sig adds complexity. And so, which
[80:08] is fine. It can add redundancy and
[80:10] security. There's also a thing called
[80:12] key sharding where to make up one key
[80:14] that can sign, you can shard it and
[80:16] split it up. So, you can have, you know,
[80:18] 12 people make up one key of
[80:23] a multi-sig of five,
[80:26] right? So, you could have 12 people make
[80:27] up one key and three of those keys of
[80:30] the five total, and that's like real,
[80:32] real, real, real redundancy. So, even
[80:34] just to make up one signature, you need
[80:36] a bunch of people to go meet up in a
[80:38] city together with their respective
[80:40] pieces of the key to get the key
[80:41] together to actually sign and broadcast
[80:44] it. There's all sorts of complexities
[80:46] you can add that make the security of
[80:48] the Bitcoin extremely redundant, but the
[80:50] more complexity you're adding, the more
[80:52] expertise is required because you must
[80:54] get it right. Any mistake could
[80:57] potentially lose the coins forever. So,
[80:59] that's why I'm just always very careful
[81:00] at just acknowledging that because if
[81:02] you send novice folks out rogue and say,
[81:05] "Yeah, go Google multi-sig and give it a
[81:07] try." You might end up losing Bitcoins.
[81:11] So, that's why there are vendors out
[81:12] there that help people do multi-sig. So,
[81:15] what is BitKey? BitKey is two of three
[81:17] multi-sig where one of the keys is on
[81:19] the device that you buy. Another key is
[81:22] on your phone with the app that you
[81:24] download, and then the third key is with
[81:26] the company, with Block itself, and
[81:29] there's two of three. So, you know, if
[81:30] you have the device and you have the
[81:34] uh app on your phone, you can move it,
[81:36] you know. Now, there's a little there's
[81:38] some a little bit of tradeoffs. BitKey
[81:40] is optimized to be more of a mainstream
[81:42] product, but that's kind of the idea.
[81:44] You guys get the idea. And there's all
[81:47] sorts of really cool stuff you can do.
[81:48] Now, Bitcoin, again, the fact that a
[81:50] money has a programming language, how
[81:53] cool is that? I cannot program gold to
[81:56] do [ __ ] It sits there.
[81:58] It's just mother nature. It's just
[82:00] sitting there. So, it's unbelievably
[82:02] cool. I think we've only scratched the
[82:04] surface of what's possible with all of
[82:07] the tools and the services that Bitcoin
[82:09] companies and and all of us can build. I
[82:11] mean, I'm you you'd have to
[82:13] daydream a bit to think what are our
[82:15] grandchildren going to be using.
[82:17] Who knows? How exciting is that to think
[82:19] about? But,
[82:21] um you know, it adds complexity and and
[82:24] needs to be done with care.
[82:27] Um what do I think about Bitkey? Kind of
[82:29] answered that. I think Bitkey for a
[82:31] beginner is great. Um I think Block is
[82:34] great. Um I think they're a great
[82:35] company. They do a lot for Bitcoin.
[82:37] Uh
[82:38] would you say a hardware wallet should
[82:40] be open or closed source? Open source,
[82:43] for sure. Like what Trezor, for example.
[82:46] So, um
[82:48] from my understanding, Trezor open
[82:49] source their firmware, and by open
[82:51] source, truly open source, like anybody
[82:54] can use it. Guess who used it? Coldcard.
[82:57] So, Coldcard took the code, started
[82:59] using it. And again, this is really
[83:01] important because now there's multiple
[83:03] people incentivized in the success of
[83:05] the code. So, you're getting multiple
[83:07] businesses, multiple developers, lots of
[83:09] researchers all
[83:11] vested in and incentivized for this
[83:12] thing to work, not just like a small
[83:14] team.
[83:15] Right?
[83:16] Then what happened is someone
[83:19] took Coldcard's open source code and
[83:21] started using it. And Coldcard didn't
[83:22] like that. So, they changed the license
[83:25] on their code, and they changed it from
[83:26] like truly open source, MIT license, to
[83:29] Commons Clause license, which it's open
[83:31] to the public, but you can't actually
[83:32] use it, or else you get in trouble.
[83:35] And that is where the bug was actually
[83:37] introduced, but no one caught it because
[83:39] no one was really allowed to care. So,
[83:42] Trezor
[83:43] has been doing it, in my opinion, like
[83:44] the right way.
[83:46] Truly open source, lots of people use
[83:47] the firmware, lots of eyeballs on it.
[83:49] It's been battle-tested, and um a lot of
[83:51] people are incentivized to ensure that
[83:53] it's successful. So,
[83:55] um yeah, I would say open source.
[83:58] Uh to be honest, I d-
[84:00] I wouldn't really trust
[84:02] hardware wallet that is closed source.
[84:05] Because think about it, you don't get to
[84:07] see and validate, and nor does anyone
[84:09] else, how your large random number is
[84:11] being generated.
[84:13] [ __ ] that.
[84:14] Got to be crazy.
[84:17] Uh Jack, what do you think about the
[84:18] tradeoffs of single sig, multi sig,
[84:20] multi vendor?
[84:22] um
[84:24] Yeah, so
[84:25] I kind of have talked about this. I
[84:26] don't want to be too repetitive. You
[84:28] know, single sig I think is great
[84:30] because it's simple.
[84:32] Can you generate a really large, really
[84:34] random number? And then can you make
[84:35] sure that nobody else but you ever knows
[84:37] what it is?
[84:39] Really simple. You generate it once, and
[84:41] then I don't know, you laminate it, you
[84:43] put it in a safety deposit box, and you
[84:44] move on with your life.
[84:46] Whatever.
[84:47] Now, there's not a lot of redundancy if
[84:50] something goes wrong.
[84:52] If it gets compromised, if your number
[84:53] wasn't large or random enough, then
[84:55] yeah, there's no two of three
[84:56] protection, there's no key sharding,
[84:58] there's no vendor that you There's no
[84:59] customer support you can call, like
[85:01] Strike, to say, "Hey guys, um can you
[85:04] help me out real quick? I accidentally
[85:05] screwed this up." So, you're not a
[85:07] customer of anyone else. You're a user
[85:09] of the Bitcoin protocol, and there's not
[85:10] a lot of fail-safes there.
[85:12] Now, you can do multi-sig. You can add a
[85:14] lot of uh logic and complexity and new
[85:17] cooler features, but it's more
[85:18] complicated.
[85:20] And, you know, you can be a customer of
[85:22] another business to do that, and you can
[85:24] pay for it, and sacrifice maybe a little
[85:26] bit of privacy. Um or you can try and do
[85:28] it yourself, but that raises the bar of
[85:31] the level of expertise and time
[85:33] investment from you. So, I It's It's all
[85:35] trade-offs, guys, and I think that the
[85:37] market will continue to grow and fill
[85:40] fill a void of allowing people to sleep
[85:43] well at night. There's going to be
[85:44] people that don't want to trust
[85:45] themselves, don't want to be experts.
[85:46] There's going to be people that are more
[85:48] than comfortable saying, "I generated my
[85:51] large random number. I know I did a good
[85:53] job. I used Bitcoin Core offline, and
[85:56] then I made a bunch of backups of that.
[85:58] I laminated it. It's in a vault. It's in
[86:00] a safety deposit box. It's buried in my
[86:02] backyard, and I'm comfortable with
[86:04] that." You know, another thing, guys,
[86:05] you can take So,
[86:07] think of it this way. You can generate
[86:10] 10 single sigs using different vendors.
[86:13] You know, one dice roll, one Bitcoin
[86:15] Core, one Trezor, one Ledger, and have
[86:19] 10 different large random numbers
[86:21] generated by in 10 different ways that
[86:24] use true randomness, true entropy,
[86:26] and that way if one of the single sigs
[86:28] fail, it's 10% of your stack, and you're
[86:31] you're hedged that way. Another way to
[86:33] hedge is to use multi-sig, right? And
[86:35] say, "Well, if one's compromised, they
[86:37] still can't spend." So, there's a
[86:38] million different ways. You know, I
[86:40] almost want to maybe I should create
[86:42] like a visual diagram of the tradeoffs.
[86:46] Uh and it just depends on what you're
[86:48] optimizing for, what you're scared of,
[86:49] what you want to protect against, where
[86:51] you think you're a weakest, what level
[86:53] of expertise you are, if you're willing
[86:54] to be a customer of someone in KYC onto
[86:57] a platform, right?
[87:01] Uh okay.
[87:03] Okay, Strike questions. Hey Jack, I love
[87:04] this show. What are your thoughts on the
[87:06] BTC Pay server situation, and how is
[87:07] Strike ensuring the security of users'
[87:09] Bitcoins with all these AI-enabled
[87:11] hacks?
[87:13] I Yeah, I talked about this a little
[87:14] bit. I think the BTC Pay server
[87:15] situations unfortunate, obviously. It's
[87:18] clearly
[87:20] a function of this AI world we're living
[87:22] in, where access to frontier AI models
[87:24] is bringing the cost of finding these
[87:26] vulnerabilities to near zero, and
[87:29] open-source projects are very vulnerable
[87:31] because the attacker has access to as
[87:33] much information as the defender. And if
[87:35] the defender does not have the resources
[87:38] and the funds available to basically do
[87:41] what the attacker's doing, but in an
[87:42] effort to defend themselves, then
[87:44] there's an opportunity where the
[87:46] attacker's actually better positioned to
[87:48] find a vulnerability before the
[87:49] defender. So, and that wasn't always the
[87:51] case, at least at this scale. So, that's
[87:54] basically what happened uh from my
[87:56] understanding. Um obviously, a lot of
[87:59] things to be thankful for and proud of.
[88:00] I think BTC Pay server handled it the
[88:02] best way they can. I think the Bitcoin
[88:03] red team continues to be
[88:06] a positive for the space.
[88:08] And how is Strike ensuring the the
[88:10] of our systems?
[88:12] Uh we have a automated red team of
[88:15] agents that work 24/7 to do exactly what
[88:18] this Bitcoin red team is doing, and
[88:19] they've been doing it for a long time
[88:21] now, which is constantly battle testing
[88:24] our systems. Um agents are first-class
[88:26] citizen at Strike. So, we have all sorts
[88:30] of agents that are testing all sorts of
[88:32] code paths and dependencies.
[88:34] Um because security, the name of the
[88:36] game is really
[88:38] using [snorts] the tooling to find the
[88:40] issues before an attacker does. And
[88:42] again, there's there's really
[88:43] interesting open-source projects carry a
[88:45] totally different profile than closed
[88:47] source. So, Strike is a business, so we
[88:49] have money and capital to fund these AI
[88:52] token developments, whereas open-source
[88:55] projects don't have a native business
[88:56] model. They rely on donations um and
[89:00] donors.
[89:01] And uh
[89:03] and our source code is closed source,
[89:05] and so it's actually not true that
[89:07] attacker knows more about our systems or
[89:10] as much about our systems as we do. Um
[89:12] it's the opposite. So, um in many ways,
[89:15] businesses in closed source actually
[89:17] have an advantage a little bit.
[89:19] Um
[89:20] Now, open-source, something like Bitcoin
[89:22] Core has an advantage over everyone
[89:24] because there's so there's a trillion
[89:26] dollars that relies on Bitcoin Core. So,
[89:28] everyone has a vested interest in it.
[89:30] You know, I I don't think a trillion
[89:31] dollars has a vested interest in
[89:34] you know, any Bitcoin exchange.
[89:36] Uh but I digress. Um
[89:39] That makes sense? But, you know, Strike,
[89:41] we we use automated red teaming of AI
[89:44] agents to secure our systems.
[89:46] So far, it's it's worked very well for
[89:48] us.
[89:50] Could Strike create a way to send
[89:52] Bitcoin to someone who doesn't yet have
[89:55] a Strike account? Imagine sending them a
[89:56] Strike link. Yeah, definitely. All of
[89:59] this kind of comes down to uh priority
[90:01] and what customers would value most from
[90:04] us, especially in the wake of this cold
[90:06] card stuff. You know, we've gotten a lot
[90:08] of demand from institutions and even
[90:12] just plebs of securing Bitcoin,
[90:14] multi-sig collaborative stuff,
[90:15] insurance. So, we are um definitely when
[90:20] it comes to we're about to release, you
[90:22] know, things like interest on cash. Um
[90:24] we just released beneficiaries. We're
[90:26] doing uh a lot for EU UK. There's some
[90:29] uh road map items coming up. We're
[90:31] translating our app, I think, Spanish,
[90:33] French, German. So,
[90:36] uh there's a lot of stuff coming in the
[90:39] immediate term and then over the coming
[90:41] months, we're starting to take a look at
[90:42] the road map again and say, "Hey, have
[90:44] things changed? Is this cold card
[90:46] incident the big wake-up call for the
[90:48] space? Is there a way that we can step
[90:50] in and be be more helpful than we
[90:51] already are?"
[90:52] Um and so, you know, maybe something
[90:54] like uh
[90:56] Strike links
[90:57] makes the cut. Um maybe it's something
[91:00] for a bit later.
[91:02] Uh there's a lot of exciting stuff
[91:04] we could do. But, as always, you guys
[91:05] let us know what you want and we work
[91:08] for you guys and really our job is to
[91:10] see of all the things everyone's asking
[91:12] for,
[91:13] what what do we hear the most about and
[91:16] what are people really saying, "Hey, you
[91:18] know, I can wait on a Strike link, but
[91:19] what I really need is a variety of
[91:21] Strike custody products. Like that would
[91:23] really make me sleep better at night and
[91:24] make me feel better." So, we'll see.
[91:26] We're hearing a lot about custody and
[91:29] services for institutions, but um and
[91:32] plebs, but um
[91:34] in that space. We'll see.
[91:36] Uh
[91:37] Okay.
[91:40] Oh, wow. Only three questions left. Is
[91:42] it possible for Strike to ever accept
[91:43] Zelle? Yeah, I'll take a look. I
[91:46] remember years ago we tried to and I
[91:47] think we were close. So, I would assume
[91:49] it's only gotten easier, but who knows?
[91:50] Zelle is like a consortium of banks.
[91:54] So, it's really up to the banks. It's
[91:55] not like an open payment standard by any
[91:57] means. So, I can I can take a look.
[92:00] Uh okay. Two questions labeled other,
[92:03] which are usually
[92:05] random questions. I'm a little nervous
[92:07] to read these.
[92:09] Jack, what are your thoughts on God
[92:11] {slash} the existence of a creator?
[92:14] Someone superior to Satoshi.
[92:18] Wow.
[92:20] Why Dylan include that? I have no idea
[92:22] why Dylan did that. Um,
[92:26] I
[92:28] I don't I honestly don't know how much I
[92:30] want to share uh,
[92:32] here. I I can tell you guys this. I I
[92:34] was not raised a very religious.
[92:37] So,
[92:38] um, but you know, I do believe
[92:42] uh,
[92:42] in
[92:44] a greater existence.
[92:46] So, I'll just leave it at that. Not
[92:48] really
[92:50] part of my life that I want to share on
[92:51] the internet, at least not right now.
[92:54] So, that'll be my answer.
[92:57] Uh, Dylan question for Jack. Can you
[92:59] share more about your AI setup for
[93:00] personal use and whether you've made any
[93:02] changes {slash} upgrades recently?
[93:04] Yeah, I feel very blessed to work with
[93:06] the technical team at Strike. Um, I
[93:08] always have some of the latest and
[93:09] greatest AI goodies. Um, I use both
[93:13] Anthropic and Open AI. Now, obviously we
[93:15] use Kimi Kimi K3 and uh,
[93:18] what's the other one? Queen? Something
[93:20] like that. Um, starts with a Q.
[93:23] Uh, it's newer newer Chinese one.
[93:26] Um,
[93:27] I I use Mac Whisper for my text to
[93:33] speech. Or excuse me, speech to text.
[93:36] Although, Calai just came out with uh,
[93:38] something new, which looks kind of cool.
[93:41] So, I might be upgrading to that.
[93:45] Um,
[93:46] hmm, I'm trying to think. I mean, I use
[93:49] uh, VS Code as my dev environment. That
[93:52] kind of hooks into all my agents. So, in
[93:54] my VS Code, I've got access to all the
[93:56] Open AI agents, all the Anthropic
[93:58] agents, all all the agents that I need
[94:01] and I can select depending on the task
[94:03] I'm doing. So, I literally hold a key on
[94:05] my keyboard and I talk to my computer
[94:08] and then it transcribes it into text and
[94:11] then I can select which agent should
[94:13] perform the task and each agent is
[94:15] better at certain things than others or
[94:18] if I don't really need a lot of
[94:20] expertise, then I might as well use one
[94:22] of these open-source Chinese ones
[94:23] because it's so much cheaper. You know,
[94:25] if I'm like talking to it about making a
[94:28] slide or like changing the color of
[94:30] something, I don't need to be paying
[94:32] American prices.
[94:34] >> [laughter]
[94:34] >> But if I need to do like a like really
[94:36] difficult research, maybe I want to pay
[94:39] for higher premium. But
[94:42] that's my developer environment.
[94:45] I think oh, I mean I I do really like
[94:49] uh Anthropic's design beta thing. I use
[94:52] that a lot. Maybe I'll do a bit deeper
[94:54] dive on AI. But if you guys have any
[94:56] specific questions, let me know. I would
[94:58] say my environment has gotten fairly
[95:00] complex and I don't remember the last
[95:01] time I gave you guys an update. So,
[95:03] uh I don't want to spend 20 minutes
[95:06] cuz it also might be a little bit
[95:08] complicated. But give me some specific
[95:10] questions for next episode and if you
[95:13] guys would be interested in like uh
[95:15] you know, me walking through my AI
[95:17] setup. Uh I could certainly do that.
[95:24] Okay. That's all I got.
[95:26] Um appreciate you guys. Let me know.
[95:28] Hey, give me feedback. Uh the last two
[95:30] episodes been very um current in the
[95:33] moment uh Bitcoin specific. Hopefully
[95:36] this was helpful and useful. Hopefully
[95:39] also gives you a little bit of
[95:40] confidence. Bitcoin's going to be okay.
[95:41] Um we're going to survive this. Uh as an
[95:44] industry, we're becoming more secure. I
[95:46] think Bitcoin is a leading indicator of
[95:47] where the world is going always. So, I
[95:49] would expect more vulnerabilities to be
[95:52] found outside of Bitcoin sometime soon.
[95:56] Um
[95:57] but yeah, we can get back to macro. I
[95:59] can keep doing this. I appreciate all
[96:00] the support. Hopefully my mic sounds
[96:02] better.
[96:03] And uh I appreciate you guys.
[96:06] Uh
[96:07] keep building, stay humble, stack sats.
[96:09] Uh don't let this market scare you out
[96:11] or wear you out. Better days are ahead.
[96:12] Much love. Take care. Peace.