How Bitcoin Custody Works & Breaking Down The Coldcard Incident

[0:03] Yo,
[0:04] uh, welcome back to another episode of
[0:07] the Jack Malor Show. My name is Jack.
[0:10] You are listening to yet another edition
[0:11] of Mailbag Monday. Um, a bit of a more
[0:16] somber and emotional show today. Uh,
[0:20] just a devastating time in Bitcoiners,
[0:23] especially for Bitcoiners. Um, in
[0:26] Bitcoin, especially for Bitcoiners,
[0:28] excuse me. So, uh, excuse my tone. Um, I
[0:31] think it's just it's organic, it's
[0:34] natural, it's reflective of real
[0:37] emotions, and that's what we're going to
[0:39] be talking about today. So, really
[0:41] quick, um, before I go any further,
[0:45] if you are not aware,
[0:47] the cold card hardware wallet suffered a
[0:52] catastrophic bug that leaves Bitcoin
[0:56] stored by a seed that they have
[0:59] generated post March of 2021 vulnerable
[1:03] to theft. If your seed may be affected,
[1:07] move your bitcoins immediately off of
[1:10] your cold card wallet. Move it to a new
[1:13] wallet. Move it to multi-ig. You can
[1:15] even move it to an exchange like strike.
[1:17] I obviously know not your keys, not your
[1:20] coins. Um, but Strike is plenty
[1:24] trustworthy.
[1:26] Uh, geographically distributed multi-IG.
[1:29] Uh, cold storage is what we use. get
[1:31] your coins off of a cold card generated
[1:34] seed immediately. Uh there are still
[1:37] people that had enough entropy or enough
[1:39] protection to survive the first swive
[1:42] attack and there are still ongoing
[1:45] attacks. It is not too late. If your
[1:48] Bitcoin is stored on a seed phrase that
[1:52] was generated by a cold card hardware
[1:55] wallet specifically using the firmware
[1:58] after March of 2021,
[2:01] your bitcoins are seriously at risk.
[2:03] This is not a drill. This is urgent.
[2:06] Move your bitcoin to a new wallet or
[2:09] onto an exchange like Strike.
[2:13] Um
[2:16] okay. Uh so with that context for those
[2:19] that don't know again um cold card one
[2:22] of the more popular hardware wallets in
[2:24] the industry uh suffered a catastrophic
[2:29] bug which left Bitcoin vulnerable.
[2:34] The attacker doesn't need to know who
[2:36] you are. The attacker doesn't need to
[2:37] have access to your hardware wallet. The
[2:39] attacker doesn't need to know anything.
[2:42] And that is the problem. um just the
[2:47] information that this bug exists
[2:50] and how much entropy these seed phrases
[2:55] used to uh encrypt and create uh was
[2:59] enough. So
[3:04] a few things. So that's what today's
[3:06] episode's going to be about guys. No
[3:07] straight horn moves today. No macro
[3:09] stuff. Uh no market stuff. Uh we're
[3:13] going to talk specifically about this
[3:14] incident um and even broader about
[3:17] Bitcoin, about custody. Uh I I think
[3:20] self-custody is far from dead. Uh in
[3:23] fact, probably the opposite. Um but I'm
[3:26] going to walk us all there uh very
[3:29] logically and hopefully in an
[3:31] informative educational way. Before I
[3:34] get started, I just want to acknowledge
[3:36] something. Um I've recommended Cold Card
[3:39] before. Um, cold. I listen, I uh was not
[3:45] as uh religious about hardware wallet
[3:50] recommendations as others in the space.
[3:53] Uh, which I will explain later on in the
[3:55] episode. Um, I I still think BitKey is
[3:59] the hardware wallet to recommend for
[4:02] true beginners that want to dip their
[4:04] toe into self-custody and multi-IG. I
[4:06] stand by that. Um, but nonetheless, you
[4:10] know, there's Unchained, there's Casa,
[4:12] there's Bitkey, there's Treasure Ledger,
[4:14] there's Cold Card. The point is I I
[4:16] recommended Cold Card along on this show
[4:19] along with other hardware wallets, and
[4:23] I'm sorry. Uh, I own that. I mean, the
[4:27] level of negligence displayed by the
[4:29] Coin Kite team, the developers of Cold
[4:31] Card, as I I'll explain later in the
[4:33] show exactly what the technical issue
[4:35] was and the mistake they made. The level
[4:37] of negligence for a team of developers
[4:41] and a company producing a product to
[4:43] secure your bitcoins is astounding. Is
[4:45] astounding. And um I'm sorry. I'm sorry
[4:49] that it was even within the lexicon uh
[4:53] of this show and within the lexicon of
[4:56] how I think people should have stored
[4:58] their bitcoins. I mean, listen, uh
[5:00] again, I I'm not very loyal or religious
[5:03] to a particular custody solution, and
[5:05] I'll explain why in this episode. Um
[5:08] storing Bitcoin solves for a very
[5:11] particular problem. I do think that not
[5:13] enough people truly understand even the
[5:16] basics to give themselves a good reading
[5:19] on what would be best for them. Um but
[5:23] uh nonetheless I take ownership where it
[5:26] needs to be owned. The other thing that
[5:28] breaks my heart is uh the
[5:32] Bitcoin stolen is in small tiny amounts.
[5:36] Um there's not a lot of large uh uh
[5:41] sweeps of Bitcoin. Uh you know, I think
[5:44] I I actually hadn't checked today. I
[5:46] should have before the show, but I I
[5:48] don't think that there was a sweep of
[5:51] coins from this attack
[5:54] more than like a 100 Bitcoin at once.
[5:57] This is all a couple Bitcoin.
[6:00] Majority of the coins, I believe, are
[6:02] less than one Bitcoin.
[6:04] And that's what just breaks my heart the
[6:06] most is um
[6:08] these were are good hardworking
[6:14] family Bitcoiners
[6:16] did everything the right way
[6:19] followed the not your keys not your
[6:21] coins cold storage self custody spent
[6:25] the 10,000 hours really understanding
[6:27] the asset class many of you maybe listen
[6:30] to this show um this is not a giant
[6:33] whale this was not a hedge fund that go
[6:36] got blown out for leverage. This is not
[6:39] risky shitcoin speculation. This was
[6:41] stay humble stack sats,
[6:44] you know, life savings hopefully passing
[6:47] down inheritance to your kids. I mean,
[6:48] we're talking about 2 Bitcoin, 7
[6:51] Bitcoin, couple Bitcoin, 7 Bitcoin. And,
[6:55] you know, not to make a judgment on what
[6:57] is and isn't a lot of money, but in the
[6:59] in the prior hacks, we've seen one or
[7:01] two whales go down for tens of thousands
[7:04] of Bitcoin or single exchanges and
[7:06] central parties go down for hundreds of
[7:09] thousands of bitcoins. Um, this one is
[7:12] so um horrifying just because the
[7:16] negligence displayed by a Bitcoin only
[7:21] business that uh claimed and touted
[7:23] otherwise, the lack of verifying that
[7:26] the community uh did on their product
[7:28] and their business and just who the
[7:31] victims are. Um the victims don't
[7:33] deserve to be victims. That's the most
[7:35] painful part. And the victims are people
[7:38] um that even if I don't know them
[7:40] personally, I respect, I admire. These
[7:43] are the people that support me, that
[7:45] support this industry, and it's just
[7:47] awful. So, I posted as many alerts as I
[7:50] could this last weekend. Um I was
[7:53] actually at a wedding. I was at a I was
[7:54] at my buddy's wedding, and uh I was
[7:58] every hour of just taking some time away
[8:01] from the ceremony and going through my
[8:03] DMs. I had the strike support team and
[8:05] the security team on call this whole
[8:07] weekend trying to support as many
[8:08] Bitcoiners whether you guys are
[8:09] customers or not. I mean, these are my
[8:12] people. Um, these are the people that I
[8:13] want to have wealth when my kids are my
[8:16] age. These are the people that I want to
[8:18] be on the other side of the greatest
[8:20] wealth transfer of all time. Um, and
[8:22] it's just uh it's just true horror to
[8:26] watch this unfold and um the victims be
[8:28] who the victims are cuz uh the victims
[8:31] just don't deserve it. And that's what
[8:33] this none of this, you know,
[8:35] philosophically makes sense for that
[8:37] reason. So, um, yeah, to the victims,
[8:41] I'm truly sorry. Uh, obviously, I will
[8:45] do everything I can, whether you're a
[8:47] customer strike or not, to help. Um,
[8:50] it's kind of been my life's motto, my
[8:53] life's mission to just be the best
[8:54] Bitcoiner I can be. trying to get in
[8:56] contact with law enforcement, introduce
[8:58] everybody to other companies or the red
[9:02] the red team, the uh Rob and and Kle and
[9:05] everybody that's trying to do the best
[9:08] they can. Just hopefully we can catch
[9:10] the block team. Shout out to the block
[9:12] team, the big key team. Hopefully we can
[9:13] catch the attackers. I think that there
[9:15] are multiple um hopefully that we can
[9:17] recover any stolen funds and even if we
[9:20] can raise some money um and just try
[9:22] again. These are hardworking, real
[9:26] Bitcoiners. Um, they didn't take any on
[9:29] any leverage. They didn't do anything
[9:30] ill advise. They didn't break any law.
[9:32] In fact, they did the opposite. These
[9:33] are honorable people and uh this is the
[9:37] um just a very devastating
[9:41] moment for Bitcoin. So, with all that
[9:43] being said, here's how I'm thinking
[9:46] about the show today and what I did. Um,
[9:49] I could have spent I could spend a whole
[9:51] year of shows breaking down how Bitcoin
[9:54] works, talking about what cryptography
[9:56] is, talking about some of the technical
[9:58] details of entropy of 256 bits. Here's
[10:02] what I did. Uh, the title of this is how
[10:04] Bitcoin custody works and breaking down
[10:05] the cold card incident. Um, I picked and
[10:08] chose exactly where I think highlevel
[10:12] knowledge is relevant given the moment
[10:14] we're in today. I'm not so sure how
[10:17] valuable this episode will be in 5 years
[10:19] from now. Sometimes I try and create
[10:21] content, whether it's a keynote or an
[10:23] essay, that's going to be timeless and
[10:26] everlasting. And whether you look at it
[10:28] in a year or in 5 years or in 10 years,
[10:31] hopefully it's still valuable. I'm not
[10:32] so sure about this one, but I just want
[10:34] you guys to know that I kind of aired on
[10:36] the side of the now because I think
[10:39] right now Bitcoin needs leadership.
[10:42] Bitcoin needs competency. Bitcoin needs
[10:44] education and I'm not really worried
[10:46] about whether people watch this episode
[10:48] in a year. I just know a lot of people
[10:50] want something to go to and at least
[10:54] learn a thing or two right now. So, I'm
[10:56] going to talk about how Bitcoin works
[10:58] from a very high level, especially in
[11:01] regards to securing it, spending it.
[11:04] What does it mean to have a wallet? What
[11:06] does it mean to secure a key? And then
[11:10] we can obviously progress towards the
[11:12] different options that you can use to
[11:14] secure Bitcoin and why I think
[11:17] self-custody and securing Bitcoin is far
[11:20] from dead because of this incident. This
[11:22] incident was extreme negligence and one
[11:24] of the worst errors from a Bitcoin
[11:26] company I've ever seen. But once you
[11:29] guys truly understand what's going on
[11:31] under the hood, it's actually not only
[11:34] far from dead, but it's arguably never
[11:36] been stronger. And I think as a
[11:37] community we can learn a lot from this
[11:39] and and put our foot forward and keep
[11:41] building. Uh and then also once we
[11:43] understand these very basic concepts,
[11:46] I'll walk you guys through what exactly
[11:48] happened to the cold card firmware,
[11:51] where the bug went wrong, and where the
[11:53] exact negligence was. Like a security
[11:57] engineer should have never ever written
[11:59] the code that was deployed to so many
[12:02] Bitcoiners. Um, one last reminder, this
[12:05] is a show for what I call Main Street.
[12:07] It's a show by the common man for the
[12:09] common man. This is not, you don't need
[12:12] a a computer science degree to listen to
[12:14] this show, okay? Um, this is very basic,
[12:17] bare bones, high level. My goal is to
[12:20] get enough people semiiterate just so
[12:25] you can understand the conversation. Um,
[12:27] both to so that you can contribute to
[12:29] the conversation and also so that you
[12:30] can make better decisions for yourself.
[12:32] Okay, so with that being said, I will
[12:34] now officially time stamp this episode.
[12:37] I'm talking to you guys at a Bitcoin
[12:39] price of $63,480.
[12:42] Bitcoin's market cap sits at 1.27
[12:44] trillion. Alltime high remains the same,
[12:47] 126,160.
[12:48] We're 49.7% off that high. So still
[12:51] about 50% down from alltime highs.
[12:53] Alltime high was October 6, 2025.
[12:56] Just a milestone. We've crossed 300 days
[12:59] now since alltime high. It's officially
[13:01] 301 days. Uh, and the last Bitcoin block
[13:05] mined was Bitcoin block height 960,928.
[13:10] All right. Uh, so let's get into this.
[13:12] Uh, as always guys, please ask
[13:13] questions. I even tweeted and got about
[13:16] 50 questions from you guys earlier. This
[13:18] episode will go as long as it needs to
[13:19] go. I'm going to try and answer as many
[13:21] as I can. Uh, and obviously this is not
[13:24] the last show I'll I'll do. So, I can
[13:26] always try and dedicate more time now
[13:28] that I'm not at 21 and I have some more
[13:31] time. I've told you guys I'm really
[13:33] committed to doing more content, more
[13:35] education. I don't really know how much
[13:37] money that will make me or how famous
[13:40] that'll make me, but I kind of made the
[13:41] points. I don't care. Uh, it's what it's
[13:44] what I love to do. It's what I care
[13:46] about. It's the work that I think that
[13:47] needs to be done. And so any more
[13:49] educational content, any questions that
[13:51] you guys think I can help uniquely
[13:53] solve, um just let me and my team know
[13:56] and uh and hopefully we can do that. Uh
[13:59] okay, so the first section of this is
[14:01] called Bitcoin and the ledger. And you
[14:03] know the core questions that I want to
[14:05] answer for you guys for from the high
[14:07] level that anyone can understand is
[14:09] where is the Bitcoin and what does
[14:11] ownership mean in Bitcoin.
[14:14] The first thing I want you guys to know,
[14:16] and I debated the headline of this slide
[14:18] because it's a little jarring, but the
[14:21] slide reads, "Your wallet does not
[14:23] contain Bitcoin." And hopefully that is
[14:26] a jarring enough headline to get you to
[14:28] pay attention. The point is that
[14:33] there are no like literal coins in a
[14:36] Bitcoin wallet, okay? And when you
[14:38] transfer coins, the coins don't
[14:40] necessarily leave like literal coins
[14:43] don't leave your phone and enter someone
[14:45] else's phone. Okay. Um, the point I'm
[14:49] trying to make is the way that Bitcoin
[14:51] works from the very highest level
[14:53] possible
[14:55] is the ledger, the blockchain
[14:58] only shows us
[15:01] what public keys, what addresses, what
[15:05] people have the right to spend what
[15:09] bitcoins. Okay, I'm going to say that
[15:11] again and I'm trying going to try to I I
[15:14] apologize for the highly technical
[15:16] because I'm going to try to abstract a
[15:18] lot of the technical language like
[15:19] public keys, like addresses so that I
[15:22] could hand this episode to a grandparent
[15:25] and they would vaguely understand
[15:28] what the Bitcoin blockchain, the ledger
[15:31] tells all of us. It's an open ledger
[15:33] that anybody can download, access, and
[15:36] read. It tells you who has the right to
[15:40] spend what amount of Bitcoin. Okay. Now,
[15:46] the ability to spend it is to sign a
[15:50] message
[15:53] with a private secret that corresponds
[15:57] to that public information.
[16:00] So, as you see in my slide, it says 0.5
[16:03] BTC. And what the ledger is telling you
[16:05] is that's spendable by a valid signature
[16:09] from X.18
[16:12] BTC. That's spendable by a valid sig
[16:15] signature from Y. So you can see 0.5
[16:19] bitcoin is spendable as long as you have
[16:21] this secret.8
[16:23] spendable as long as you have this
[16:24] secret. Okay? And all a bitcoin wallet
[16:27] is and it depends on what type of wallet
[16:31] and what the wallet does for you. But
[16:33] broadly speaking, it is your ability to
[16:36] generate that secret and then sign these
[16:41] messages to spend that bitcoin. But when
[16:44] you spend a bitcoin transaction, when
[16:47] you broadcast that to the network, all
[16:50] you're doing is reassigning
[16:54] who gets to sign a new message spending
[17:00] those same bitcoins. So I write here
[17:02] spending destroys one entry in the
[17:04] ledger and creates another entry in the
[17:07] ledger. The signer holds nothing but
[17:10] authority to spend said bitcoins. Okay.
[17:15] So the point is that bitcoin does not
[17:18] know who you are. It is not like a Chase
[17:21] bank account where I go to Chase and I
[17:23] say I'm Jack Malers. Here's my passport.
[17:26] Here's um my birth certificate. Here's
[17:30] where I went to school. Here's who my
[17:33] brother is. How much money do I have?
[17:36] That is not how Bitcoin works. In fact,
[17:38] Bitcoin has no idea who you are. The
[17:42] only thing that Bitcoin knows is math
[17:48] and cryptography. All it can do is
[17:50] compute. Okay? And so all a transaction
[17:53] is is are you able to provide the secret
[17:58] that corresponds with the bitcoin you're
[18:00] trying to send. That's it. There is no
[18:03] like oh the bitcoins are stuck on my
[18:07] phone or in this wallet or in my house.
[18:10] No, the bitcoins
[18:12] cannot be spent without the valid
[18:15] secret. Now that secret might be in your
[18:19] house. It might be on your phone. It
[18:21] might be in that wallet, but you have to
[18:24] understand if anybody could obtain that
[18:26] secret, whether it's picking it up at
[18:29] your house, whether it's guessing it,
[18:31] whether it's running through a computing
[18:33] farm to churn through and eventually
[18:35] find it. The point is, as long as you
[18:39] have the secret, the bit, like you guys
[18:41] understand what I'm trying to articulate
[18:43] here. I can't tell if I'm doing a good
[18:44] enough job. If the it's not that the
[18:46] bitcoins are stuck in Illinois or stuck
[18:49] in China. It's they are only a ledger
[18:53] entry and the ledger entry cannot be
[18:56] moved and reassigned without the secret.
[18:59] So the only thing Bitcoin cares about is
[19:02] the secret itself that could spend the
[19:04] Bitcoin. Okay? This is why, by the way,
[19:08] this is why a recreated key like in the
[19:11] cold card incident works exactly as good
[19:14] as the original because Bitcoin, the
[19:16] network, it doesn't actually know
[19:19] whether you're the true owner and some
[19:21] other person is a thief. It has no idea.
[19:25] All it's doing is does 2 + 2 equal four?
[19:29] And so if the thief is able to recreate
[19:32] the secret that you created on the cold
[19:35] card, Bitcoin has doesn't it doesn't
[19:37] know the difference. It's not like as if
[19:40] your bitcoins are on the cold card
[19:42] itself. That's why people are saying,
[19:43] "Well, I have my cold card here and I
[19:45] know no one else has touched it. How can
[19:47] anyone get my bitcoins?" Bitcoin doesn't
[19:50] care about that. Bitcoin only cares if
[19:54] you have the secret. That's it. It's not
[19:57] actually on the cold card. The cold card
[20:00] generated a secret. And if anyone else
[20:02] is able to recreate that secret, then
[20:05] the bitcoins are as good as theirs as
[20:08] they are yours. Okay.
[20:10] Now, what is the secret? How does the
[20:14] secret work? This sounds really
[20:16] terrifying. Can't people just guess
[20:18] other people's secrets? Let's get into
[20:20] that. The secrets are known as public
[20:24] keys and private keys. Now, we're
[20:26] getting into a little bit of
[20:27] cryptography, but hang with me. The only
[20:30] thing that you need to understand about
[20:32] this whole key thing is
[20:35] it's very, very, very, very easy to
[20:39] prove that you have the private secret
[20:42] that corresponds with a public address.
[20:45] Okay? So, think of the public address
[20:48] like an email, like a housing address
[20:51] that you could send mail to, like a
[20:53] safety, like a like a deposit. uh
[20:55] mailing address or something. Okay, it
[20:58] is very easy for me to prove that I have
[21:02] the secret that corresponds to that
[21:04] public identifier without disclosing the
[21:07] secret itself. I could create a little
[21:09] message with my secret and I can share
[21:11] the message and the whole world can be
[21:13] like, "Wow, Jack has the secret." He has
[21:17] it. Now, I don't know what the secret
[21:18] is, but I know that he has it and I can
[21:21] mathematically
[21:22] prove that. Now the opposite is not only
[21:28] more difficult, it is infeasible to do.
[21:31] Meaning you cannot take the public
[21:35] information and reverse engineer the
[21:37] private secret. It is infeasible. Okay?
[21:42] So you can publish the public part and
[21:44] you can say, "Hey guys, send your
[21:46] bitcoins here
[21:48] without revealing the private part." You
[21:50] can keep the private part private. You
[21:52] can prove that you are the signer. You
[21:55] are the authoritative owner of whatever
[21:58] is assoc whatever bitcoins have been
[22:00] sent to and associated to the public
[22:02] part. But the reverse is not true. The
[22:05] public part cannot be reverse engineered
[22:08] to the private part. And so a Bitcoin
[22:11] transaction is only about sharing proof
[22:15] that you have the private part
[22:17] associated with the public key. That's
[22:20] it. Okay. So the private key is this one
[22:23] secret. Okay, this one secret that only
[22:26] the owner of the bitcoin has. The public
[22:29] key is the address where everyone can
[22:31] send bitcoins to. So let's say you buy
[22:33] bitcoin on strike. You're withdrawing
[22:35] that bitcoin from strike to an address.
[22:37] That's the public part. Strike knows the
[22:39] address cuz my infrastructure had to
[22:41] send to it. That address is on the
[22:43] public blockchain which is verifiable
[22:46] and public for anybody to download, for
[22:49] anybody to scan, for anybody to review.
[22:51] All of that's public. The one part
[22:53] that's not public that's a secret is
[22:55] that private key that you have. What a
[22:58] Bitcoin transaction is is you use that
[23:00] private key to create a signature. It's
[23:04] like signing a check. Now, you attach
[23:06] that signature to a transaction and you
[23:09] send it to the network. And what the
[23:10] network is doing is it's it's actually
[23:13] taking
[23:16] the ledger entry that previously
[23:20] said this bitcoin can be sent by this
[23:22] public address and it's invalidating it
[23:25] and it's creating a new ledger entry in
[23:27] the blockchain that's reassigning those
[23:29] same bitcoins to a new public key
[23:31] basically stating whoever has a secret
[23:33] associated with this public address can
[23:36] now spend these bitcoins. So you're just
[23:39] constantly publishing these signatures.
[23:41] But the key point is the private secret
[23:44] is never ever ever ever shared with
[23:48] anybody. And this is the beauty of
[23:51] Bitcoin is that everybody can have
[23:54] access to every piece of information. We
[23:57] all know each other's addresses. Well,
[23:59] you know, you guys know what I mean. Not
[24:01] not OBSC wise, but every single Bitcoin
[24:04] address is public. All of the public
[24:06] keys can be public. We can share, hey,
[24:09] pay me here or hey, I'm going to auto
[24:11] withdraw via strike to here. All of
[24:14] that. There's so much information that
[24:17] is known to the world forever in Bitcoin
[24:20] except for one piece, one critical
[24:23] piece, which is this private secret. You
[24:26] broadcast proof and signatures that you
[24:29] own the private piece, but you never
[24:31] publish the private piece itself. Okay?
[24:34] Now
[24:36] the the private key
[24:39] again never has to leave your control.
[24:43] And this is where we get into well how
[24:46] should I store my Bitcoin? What does it
[24:47] mean to store Bitcoin? What does it mean
[24:49] to send a Bitcoin transaction? To store
[24:52] and send a Bitcoin transaction, it's all
[24:55] about management of this secret, guys.
[24:58] That's it. That's it. To say that
[25:01] Bitcoin self-custody is dead would be to
[25:04] say that being able to store a secret is
[25:09] dead. And obviously for me that's a
[25:11] violation of just human coordination and
[25:14] collaboration. If we can't safely and
[25:18] securely store secrets, then society as
[25:22] we know it will deconstruct and fail.
[25:26] We're, trust me, we are more than
[25:27] capable of being able to safely and
[25:30] securely store information. We got this.
[25:34] We can do it. But I needed to dumb it
[25:37] down to that very simple basic
[25:39] understanding. That's all Bitcoin is. Is
[25:42] when you create a wallet, you're
[25:44] creating one really large and one really
[25:47] random secret. And I'll get into why
[25:49] that's so secure in a second. Don't bail
[25:51] on me yet. But when you talk about
[25:53] what's a hardware wallet, what's the
[25:55] difference between that and this one and
[25:56] that and this one. We'll get into all of
[25:57] this, but it's really about managing
[25:59] these secrets and when you need to move
[26:01] your Bitcoin, it's using the secrets to
[26:04] sign a message that proves that you in
[26:08] fact have the secret. You never give
[26:10] away the secret. You never reveal the
[26:13] secret. Nobody can ever be able to guess
[26:15] your secret, but it's all about managing
[26:18] the privacy of the secret and being able
[26:20] to sign these transactions, proving that
[26:23] you still have the secret. Make sense?
[26:28] So, like I said, imagine.
[26:33] So, I I put the slide here. The
[26:35] consensus rules are public. Addresses
[26:38] are public. Source code, wallet code,
[26:40] Bitcoin core is public. SECP256K1
[26:44] is public. Every address balance is
[26:47] public. Every transaction that's ever
[26:49] been made is public. The BIP 39 word
[26:52] list, like what your the words that make
[26:53] up your seed phrases are public. The
[26:56] signature on your last spend is public.
[26:58] The block your coins arrived into your
[27:00] wallet is public. The signature
[27:02] algorithm is public. Shaw 256 is public.
[27:05] The transaction graph is public. The
[27:07] memp pool is public. Everything is
[27:09] public except one thing, your root
[27:13] secret. That's it guys. That's all
[27:16] storing Bitcoin is. Now I don't, you
[27:18] know, for the technical, I don't want to
[27:19] over oversimplify it, but just for
[27:21] everyone to understand, that's all
[27:23] storing Bitcoin is. When you generate a
[27:25] wallet, you're generating one root
[27:27] secret. And that one root secret defines
[27:30] whether you can sign and move bitcoins
[27:32] or not. Because that's what ownership of
[27:34] money really is, not to stare at it on a
[27:37] wall. If you had to, could you spend it?
[27:41] And that's it. It all comes down to this
[27:44] one root secret. So, let's get into the
[27:48] secret, okay? Why one random number can
[27:51] secure
[27:52] a public system. How the hell is that
[27:56] even possible? Okay,
[28:00] again, bear with me on the technical
[28:02] stuff here. If it gets too technical,
[28:04] you guys will leave comments in the
[28:06] YouTube section. You'll ask questions.
[28:07] Dylan's in the live chat and I'll answer
[28:09] them. Maybe this episode, maybe next
[28:10] episode, but we will get there. I
[28:12] promise you, okay, but bear with me.
[28:15] When people talk about bits, okay, like
[28:19] a Bitcoin private key or or or a cold
[28:22] cards bug. How how many bits of entropy?
[28:26] This is going to be really fun to break
[28:27] down because it's actually more simple
[28:30] than you think. One bit is one binary
[28:34] choice. Okay, so one bit zero or one.
[28:38] Okay, that's two possible outcomes.
[28:40] Okay, how secure is one bit? It's not
[28:44] very secure because it takes a human to
[28:47] be able to to to chew through the amount
[28:49] of potential outcomes. There's only two.
[28:52] The outcomes are either zero or one.
[28:55] It's very binary. So let's say we
[28:58] increase from one bit to two bits. Well,
[29:02] now there's four possible outcomes
[29:05] because the possible outcomes are now
[29:07] either 0 0
[29:09] 1 1 0 or 1 1.
[29:14] Very critical insight that just happened
[29:16] right there. By going from one bit to
[29:19] two bits, we doubled the amount of
[29:22] outcomes. Doubled.
[29:25] Now, what if we went to three bits?
[29:28] We now have eight possible outcomes. And
[29:31] I didn't write them on the slide, but
[29:33] it's 00 0 or 0 0 1, right? And and so on
[29:37] and so forth. Now, the point is each new
[29:40] bit does not just add a possibility. It
[29:44] doubles the entire space of
[29:46] possibilities.
[29:48] Do you guys understand that? So, you go
[29:50] one bit. A bit, it's very binary, guys.
[29:53] A bit's either zero or one.
[29:56] So if you have one bit of entropy of
[29:59] security, well that's not secure at all
[30:01] because I can guess it. Is it zero? No.
[30:03] Okay, then it's one. Boom. I have your
[30:05] bitcoins. Okay, let's increase the
[30:08] entropy. Two bits.
[30:10] Well, two bits now is four. So we're
[30:14] doubling the amount of potential
[30:16] possible outcomes. Three bits, eight. So
[30:19] on and so forth, so on and so forth. So
[30:22] every random bit doubles the search
[30:25] space. Okay. So think of it like
[30:28] flipping a coins. That's what I have
[30:29] here on the right. It's either heads or
[30:30] tails. So how secure is flipping once?
[30:33] Well, not very secure. Flipping twice
[30:35] doubles the amount of outcomes cuz it
[30:37] could either be heads heads tails tails
[30:40] heads tails or tails heads. Now if you
[30:42] flip it three times, there's eight
[30:44] potential outcomes. Four times 16 5 32
[30:47] 64 so on and so forth. So on so forth,
[30:50] so on and so forth. And so when someone
[30:52] says 26 256, excuse me, 256 bits, do you
[30:57] understand what that now means?
[31:00] There's 256 either zero or ones. And
[31:04] what I have here in the slide is every
[31:06] random bit doubles the search space.
[31:10] Keyword random. Obviously, if I create,
[31:14] you know, 256
[31:17] zero or ones, but I say, you know, I'm
[31:20] going to make the first half zero and
[31:21] the second half ones, that's very easy
[31:23] to guess cuz it's not random. It has to
[31:25] be truly random. And the goal here is to
[31:29] create the largest amount of possible
[31:33] space.
[31:37] Make sense?
[31:38] Because what we need to do is create
[31:41] something with a surface area so large
[31:45] that all of the possible outcomes would
[31:47] be impossible
[31:49] to chew through in this universe to
[31:52] actually arrive and find our secret.
[31:58] Okay. So, if I keep going, I want to
[32:02] take a second now because the number 256
[32:05] doesn't sound big to the human mind.
[32:09] The human mind's like, well, 256.
[32:12] I mean, that's not that big. And I know
[32:14] the number that comes after that. That's
[32:15] 257.
[32:17] The human brain cannot actually
[32:20] comprehend the size of these numbers.
[32:24] So,
[32:26] I want to see, do you see the 256 down
[32:28] there? 10 the 77 down there. Okay. So
[32:33] what I did on this slide that's so
[32:35] that's 256 bits. Okay. What I did on
[32:37] this slide is I say okay well let's take
[32:39] 10^ the 6 10 the 9 10 the 12th. Okay.
[32:42] Which is a million a billion a trillion.
[32:44] Right.
[32:46] Just to comprehend how big these numbers
[32:49] are. Do you guys know how long ago a
[32:52] million seconds ago was? I'm just trying
[32:55] to humanize, you know, the size of going
[32:57] from 10 6 to 10 the 9 to 10 12. Do you
[33:01] guys have any idea?
[33:03] A million seconds ago was about a week
[33:05] and a half ago. Okay. How about a
[33:09] billion seconds ago? How long ago was
[33:11] that?
[33:13] Was that like a month ago or a quarter
[33:17] ago? No, that was 32 years ago. Okay. So
[33:22] the difference between a million and a
[33:23] billion is massive. Okay, it goes from a
[33:26] week and a half to 32 years. That, by
[33:28] the way, I'm 32 years old. So I wasn't
[33:31] alive a billion seconds ago. Now, what
[33:34] about a trillion seconds ago? If you
[33:36] just add those three more zeros,
[33:40] a trillion seconds ago, Manhattan, New
[33:43] York City was covered under a thick
[33:45] layer of ice.
[33:50] I'm going to say that again. A million
[33:52] seconds ago was a week and a half ago. A
[33:55] million seconds ago, this cold card
[33:57] vulnerability had not been discovered. A
[34:00] billion seconds ago, I wasn't alive. A
[34:03] trillion seconds ago, New York City was
[34:06] under ice.
[34:09] Now, are you guys understanding
[34:12] just the like the ungodly size of these
[34:16] numbers? It's it's actually impossible
[34:19] for our brains to like truly rack and
[34:23] comprehend. So, let's spell out the two
[34:26] to the 256
[34:29] like the the the size of the numbers
[34:32] that Bitcoin uses. I wrote it out in
[34:34] this slide. I don't even know how to
[34:36] pronounce it. 115
[34:40] quattro vig veget vigilian 792
[34:43] trevvententilian 89 dwagentilians
[34:47] it's it's a number that the human brain
[34:50] can't even comprehend
[34:54] okay now I usually
[34:58] don't want to play too much like
[35:01] >> video on cryptocurrencies I made two ref
[35:05] >> uh I I usually don't want to play too
[35:08] much long- form content on a podcast or
[35:10] a video that I do because people get
[35:12] bored, they exit out. Um, this YouTube
[35:15] video and the audio is going to work
[35:17] fine if you're listening on podcasts is
[35:19] does a phenomenal job at just
[35:22] conceptualizing how large the numbers
[35:25] are that Bitcoin uses. And and again
[35:28] guys, keep in mind the whole point of
[35:31] things being truly random in Bitcoin is
[35:34] you need to be creating the number in a
[35:37] space where there's so many outcomes.
[35:39] Like there's so many potential numbers.
[35:42] Okay? Like if it's not truly random,
[35:46] then the potential outcomes aren't that
[35:48] big. And that's what gives people an
[35:50] opportunity to guess your secret.
[35:53] So, it's all about when you're
[35:54] generating a secure Bitcoin wallet, it's
[35:57] all about this randomness idea. Am I
[36:01] being truly random so that the amount of
[36:05] numbers in the space of potential
[36:08] outcomes is so big that there's nothing
[36:11] known in the universe that has enough
[36:14] time and enough energy to actually chew
[36:16] through all the potential outcomes and
[36:18] guess it? Now, this YouTube video does
[36:20] an unbelievable job at just humanizing
[36:23] this. It's about four minutes. And
[36:26] again, I would never in another
[36:28] circumstance want to play a 4-minute
[36:30] YouTube video, but please trust me on
[36:33] this and just be patient. It does such a
[36:36] good job at giving human comprehension
[36:39] to the size and true scale of these
[36:42] numbers which then we will come back to
[36:44] and understand exactly what Bitcoin
[36:46] custody is and why these numbers are so
[36:49] big and how this is so secure. Okay, so
[36:51] just bear with me. I'm going to mute my
[36:52] mic and and play this four minutes. You
[36:54] we got it. We got it.
[37:02] In the main video on cryptocurrencies, I
[37:05] made two references to situations where
[37:07] in order to break a given piece of
[37:08] security, you would have to guess a
[37:10] specific string of 256 bits. One of
[37:14] these was in the context of digital
[37:15] signatures and the other in the context
[37:17] of a cryptographic hash function. For
[37:19] example, if you want to find a message
[37:21] whose SHA 256 hash is some specific
[37:25] string of 256 bits, you have no better
[37:28] method than to just guess and check
[37:30] random messages. And this would require
[37:33] on average 2 to the 256 guesses. Now,
[37:37] this is a number so far removed from
[37:39] anything that we ever deal with that it
[37:41] can be hard to appreciate its size. But
[37:44] let's give it a try. 26 is the same as 2
[37:48] 32 multiplied by itself 8 times. Now,
[37:51] what's nice about that split is that 2
[37:53] 32 is 4 billion, which is at least a
[37:56] number we can think about, right? It's
[37:57] the kind of thing you might see in a
[37:58] headline. So all we need [music] to do
[38:01] is appreciate what multiplying 4 billion
[38:03] times itself eight successive times
[38:06] really feels like. As many of you know,
[38:09] the GPU on your computer can let you run
[38:11] a whole bunch of computations in
[38:12] parallel [music] incredibly quickly. So
[38:15] if you were to specially program a GPU
[38:17] to run a cryptographic hash function
[38:19] over and over, a really good one might
[38:22] be able to do a little less than a
[38:23] billion hashes per second. And let's say
[38:26] that you just take a bunch of those and
[38:27] cram your computer full of extra GPUs so
[38:30] that your computer can run 4 billion
[38:32] hashes per second. So the first 4
[38:34] billion here is going to represent the
[38:36] number of hashes per second per
[38:38] computer.
[38:40] Now picture 4 billion of these GPUacked
[38:43] computers. For comparison, even though
[38:46] Google does not at all make their number
[38:47] of servers public, estimates have it
[38:50] somewhere in the singledigit millions.
[38:53] In reality, most of those servers are
[38:55] going to be much less powerful than our
[38:57] imagined GPUacked [music]
[38:58] machine. But let's say that Google
[39:00] replaced all of its millions of servers
[39:02] with a machine like this. Then 4 billion
[39:05] machines would mean about a,000 copies
[39:07] of this souped-up Google. Let's call
[39:09] that 1 kilog worth of computing power.
[39:13] There's about 7.3 billion people on
[39:16] Earth. So next, imagine giving a little
[39:18] over half of every individual on Earth
[39:20] their own personal [music] kill.
[39:24] Now imagine 4 billion copies of this
[39:27] Earth.
[39:28] For comparison, the Milky Way has
[39:30] somewhere between 100 and 400 billion
[39:33] stars. We don't really know, but the
[39:34] estimates tend to be in that range. So
[39:37] this would be akin to a full 1% of every
[39:40] star in the galaxy having a copy of
[39:42] Earth where half the people on that
[39:44] Earth have their own personal kill.
[39:47] Next, try to imagine 4 billion copies of
[39:51] the Milky Way. And we're going to call
[39:53] this your giggalactic supercomput
[39:56] running about 2 to the 160 guesses every
[39:59] second.
[40:01] Now 4 billion seconds, that's about
[40:04] 126.8 years. 4 billion of those. Well,
[40:07] that's 507 billion years, which is about
[40:10] 37 times the age of the universe. So,
[40:14] even if you were to have your GPU kilog
[40:17] per person multilanetary giggalactic
[40:19] computer guessing numbers for 37 times
[40:21] the age of the universe, it would still
[40:24] only have a 1 in4 billion chance of
[40:27] finding the correct guess.
[40:31] By the way, the state of Bitcoin hashing
[40:33] these days is that all of the miners put
[40:35] together guessing.
[40:39] How valuable was that, guys?
[40:42] That goes to show the mere size of these
[40:46] numbers. So, when people say, "Well,
[40:48] Jack, are we sure no one can guess my
[40:51] secret?"
[40:53] Yeah, I'm sure.
[40:56] Like like again like that guy just
[40:59] walked through. You would have to have
[41:01] the most powerful computer and then a
[41:05] giga amazing Google like Google times
[41:10] thousands and each human gets their
[41:12] Google times thousands and then their
[41:15] own copy of Earth and then 1% of the
[41:17] stars in the galaxy and then you still
[41:20] would need 37 times the amount of time
[41:23] that the known universe has existed. And
[41:26] even then every single guess is a 1 in4
[41:29] billion chance. I mean the the again
[41:32] guys the size of the space if if listen
[41:37] if you do it truly randomly because
[41:40] again guys if you have one bit of
[41:43] entropy
[41:44] then it's either a zero or a one. It's
[41:46] not secure. So it's all about how random
[41:51] how effective your randomness is. But if
[41:53] it's truly random, meaning it could be
[41:56] any of the potential outcomes, it is
[42:00] like one of the most, if not the most
[42:02] secure things ever
[42:04] because the potential space of outcomes
[42:07] is just unfathomably large. Like the
[42:11] human brain cannot possibly comprehend
[42:15] the size of that number. Does that make
[42:18] sense? And so when people say like,
[42:21] "Well, just roll a bunch of dice." Well,
[42:24] in this slide, I use a deck of cards
[42:26] because uh I play cards with Dylan all
[42:29] the time. We play this game called golf.
[42:31] And it's not like poker, and I'm not
[42:33] like a card player, but it's just like a
[42:35] fun game when we're out with, you know,
[42:36] our fiances and stuff. And sometimes
[42:39] someone will go on a run and get really
[42:41] hot and like win a bunch of hands in a
[42:43] row. And I'm usually dealing. And people
[42:46] will be like, "Dude, like you're not
[42:48] shuffling or you know, I can't believe
[42:51] that the cards ended up in the same
[42:54] order again." And it's funny because as
[42:57] a Bitcoiner and someone that's familiar
[42:59] with this math,
[43:01] I don't think people appreciate that if
[43:04] you properly shuffle a deck, it is
[43:07] almost certainly in an order that no one
[43:10] else has ever held in the history of the
[43:13] universe.
[43:15] And again this goes to show how this
[43:18] math works.
[43:21] You see because
[43:24] again guys if you if the randomness is
[43:27] true and so like you shuffle properly
[43:31] the potential outcomes. Imagine you know
[43:33] how we did well one bit is 0 or one and
[43:36] two bits is either 0 0 1 1 0 1 or 1 0.
[43:40] So you've gone from two outcomes to
[43:41] four. Now, imagine doing that for a deck
[43:44] of cards. Like the first shuffle could
[43:46] be king, king, queen, queen, right?
[43:48] You've got all the possible cards and
[43:50] you've got the the four the the two
[43:53] colors, the four suits, and and so every
[43:56] properly shuffled deck is almost
[43:58] certainly in an order that no one else
[44:00] has ever held. And mind you, the key
[44:03] space for Bitcoin is still 1.44
[44:08] billion times larger than that.
[44:13] So when people say roll a bunch of dice,
[44:17] shuffle a bunch of cards, and people are
[44:20] like, "How what are these crazy people
[44:22] in Bitcoin talking about? What do they
[44:23] mean roll dice?" The point is they're
[44:26] trying people are trying to encourage
[44:28] others to generate sufficient
[44:30] randomness.
[44:32] Sufficient randomness.
[44:34] Cuz just like we're going through in the
[44:36] bits, 01 is one bit. 0 0 1 1 0 1 1 0 is
[44:41] two bits.
[44:43] How can I get sufficient randomness and
[44:46] create enough potential outcomes where
[44:48] the space to guess is far too large?
[44:53] Make sense?
[44:55] Let's go on.
[44:57] So the point is your key is somewhere
[45:01] inside of this massive space that like
[45:05] the universe and us humans can't even
[45:08] comprehend. the size.
[45:11] And the point is, as long as it's it's
[45:14] sufficiently generated as random,
[45:19] it's safe. It's as safe as you can keep
[45:22] it. So when people say storing Bitcoin
[45:24] is dead, self-custody is dead. I
[45:27] disagree. Self, guys, self-custodyy's
[45:30] always been the same. And I don't want
[45:33] to make light of this incident and I'll
[45:34] get all the way back to what I think
[45:37] people should be doing and how Strike
[45:39] does it and all stuff, but like for
[45:42] someone that's been in Bitcoin for
[45:43] almost 14 years now, self-custodyy's
[45:45] always been the same. One, did you
[45:50] generate a large enough and random
[45:52] enough secret number? Yes or no? And if
[45:57] you did, how can you protect that
[46:00] number? And then on top of that, the
[46:03] Bitcoin space back in my day, it was
[46:04] only single SIG.
[46:07] And now that nowadays, we have multi-IG,
[46:09] we have key sharding.
[46:11] Okay? But don't let people scare you or
[46:15] over complicate what securing Bitcoin
[46:18] is. Securing Bitcoin is just generating
[46:22] a secret that lives within a space of a
[46:25] large enough amount of potential
[46:26] outcome. So, it has enough randomness.
[46:28] has enough entropy and then being able
[46:31] to keep that safe. That's it.
[46:34] Again, I don't want to oversimplify it.
[46:36] I don't want to mislead. This is for
[46:38] educational purposes only. But you know,
[46:41] you guys, that's it. That's how it
[46:44] works. Okay. So, this is what a private
[46:49] key looks like. And again, this is for
[46:52] illustration purposes only. Don't ever
[46:54] ever use that. Um, but this is what it
[46:57] looks like. It's one line and nothing
[47:00] about the line is particularly special.
[47:03] But everything about it being
[47:05] unguessable is the point.
[47:09] That's the whole point. Okay. So now if
[47:13] we go back to Bitcoin wallets and how
[47:15] they work and what you guys are
[47:17] accustomed to seeing when you download
[47:18] something on your phone, what is
[47:20] actually happening under the hood is
[47:23] someone is creating this root entropy,
[47:27] this really really large and really
[47:30] really random number. Okay, that is able
[47:35] to be converted to and consumed as
[47:38] seedwords. Those seedwords are the root
[47:41] of your wallet. And then from there you
[47:45] can sign messages. You can have
[47:46] addresses. So you can create an address
[47:48] from that have send funds from strike to
[47:51] that address. And then if you need to
[47:53] move funds from there, you can sign
[47:55] transactions and publish those
[47:56] transactions to the Bitcoin network. But
[47:58] that's a Bitcoin wallet, guys. Again,
[48:01] I'm not encouraging everyone to make
[48:03] their own Bitcoin wallet. I'm not
[48:04] encouraging everyone to oversimplify all
[48:06] of this technology educationally.
[48:09] Don't let people make this more
[48:11] complicated for you to say like, "Oh,
[48:13] humans are never going to be able to
[48:14] self-custody Bitcoin." It's can we
[48:16] generate a sufficiently large and a
[48:18] sufficiently random number? Yes or no?
[48:20] And then can we keep that secure and
[48:22] build software around that that makes it
[48:25] usable? That's it, guys. That's it.
[48:28] That's what Strike does. That's what
[48:30] Coinbase does. That's what BitKey does.
[48:32] That's it.
[48:36] Okay. Do I really hope you guys
[48:38] understand and let's go back to well
[48:41] when people use the term in Bitcoin
[48:43] secrets or passwords, you know, are
[48:45] these secrets human chosen like the
[48:47] thing I'm using for my Gmail account.
[48:49] No.
[48:51] Right. And and and now you guys
[48:53] understand why. Because words or quotes
[48:56] or just what the human brain can
[48:59] comprehend and produce itself is way too
[49:02] guessable cuz an attacker searches what
[49:05] people usually pick. Right? The whole
[49:08] point is finding a space of numbers that
[49:11] is so unbelievably large that in order
[49:16] to chew through all the potential
[49:17] outcomes, it's impossible. It's
[49:21] impossible. And again, nothing in life
[49:25] and in security and in Bitcoin is ever
[49:28] like super duper guaranteed, right? Like
[49:31] it's it's all probabilistic, but it's in
[49:34] feasible, right? This is why dice
[49:38] generated entropy or card shuffled
[49:41] entropy. The point is how do you find
[49:44] sufficient randomness
[49:47] which in itself is difficult, right? And
[49:50] different wallets have different ways of
[49:52] doing it. But it's h how can you be
[49:55] sufficiently random to generate this
[49:58] really really really large number that's
[50:01] really really really really random that
[50:03] is infeasible to guess.
[50:06] Okay.
[50:08] Um now let's start to dig into cold card
[50:13] what's going on today and what happened.
[50:16] So I want to show you guys something. Uh
[50:19] at the top, okay, is a 40bit internal
[50:24] state. So this is what the cold card the
[50:30] the the level of randomness and security
[50:32] that the cold card uh MK3, the one that
[50:36] was the least secure, that's what it was
[50:38] generating. And at the bottom is 256
[50:41] bits of independent entropy
[50:44] which is like what you want. Okay.
[50:50] What you notice is they look the exact
[50:52] same. Now these are illustrative values.
[50:54] These these are not this is not the
[50:57] again I'm I'm just trying to make a
[50:59] point here. But the length just tells
[51:03] you how the number is written. Okay. The
[51:06] length just tells us it's 256 bits.
[51:12] The entropy tells us how many
[51:14] possibilities an attacker cannot rule
[51:16] out. So the reason that all of this is
[51:20] happening is because an attacker
[51:21] realized that the cold card was only
[51:24] using a 40bit internal state level of
[51:27] entropy of randomness. That's why all of
[51:30] this is happening. But do you see how
[51:33] when when people say, "How did this go
[51:35] on for 5 years and no one noticed?"
[51:37] Well,
[51:39] the point isn't, how do I articulate
[51:41] this? The point isn't that a a less
[51:46] secure
[51:48] secret looks different. They look the
[51:51] same, but why they're weaker is because
[51:54] the amount of possible outputs is
[51:57] significantly less.
[52:00] So what I have here is this 40bit
[52:01] internal state that's only around a
[52:03] trillion possibilities
[52:06] which for a normal computer is not that
[52:10] many. You can chew through a trillion
[52:12] possibilities fairly quickly.
[52:15] You know, we're seeing instances of um
[52:17] cold car generated seeds being wiped and
[52:20] swept in, you know, minutes in 10
[52:23] minutes
[52:25] versus if the amount of possibilities is
[52:29] generated correctly. We just went over
[52:31] it. Like there's not enough. Even if you
[52:33] had 40 universes and thousands of
[52:35] Googles for every human and every human
[52:37] had an Earth with 1% of the stars in the
[52:40] galaxy, you still wouldn't come remotely
[52:42] close. That's the difference again from
[52:44] a million seconds versus a billion
[52:46] seconds versus a trillion seconds. Just
[52:48] these exponentially large numbers are
[52:51] way larger than you think. Okay? And so
[52:55] here's another way of visualizing this
[52:59] stuff. If there was only ever six
[53:01] possible inputs,
[53:03] the the the point of this slide is that
[53:10] the the the randomness
[53:14] has to be solved in generating the
[53:16] secret. Okay? and all of the things that
[53:20] you guys saw from the cold card like
[53:22] seed phrases and the addresses that
[53:24] those seed phrases were able to generate
[53:26] and the messages that they were signing
[53:27] for the Bitcoin network. There was no
[53:30] way for anyone to be able to distinctly
[53:32] look at any of the public information
[53:35] and be like, "Oh my goodness, there's
[53:36] something wrong with cold card." Because
[53:38] all of the public information again, it
[53:40] the format remains the same. The problem
[53:43] with cold card is there wasn't enough
[53:45] randomness, meaning there wasn't enough
[53:48] possible outcomes that an attacker would
[53:50] have to sift through. The space that
[53:54] they can start guessing was so small
[53:57] that for some of these seeds, it took
[53:59] them 10 minutes on a MacBook.
[54:02] You see?
[54:04] So, going back to just how Bitcoin works
[54:07] and cryptography and why this is so cool
[54:09] and hopefully inspiring. If if you think
[54:13] about the physical world before Bitcoin,
[54:15] if you apply enough force to anything,
[54:18] you can and will open anything like a
[54:22] door or a gold vault or a country's
[54:24] border. If someone shows up to your
[54:27] front door with the military and a gun
[54:29] or a police force or the FBI, they will
[54:32] get in and take over your house. Same
[54:34] thing to your gold vault. Same thing to
[54:36] your country.
[54:38] Bitcoin's treasure chest is designed
[54:40] very differently because it's math.
[54:43] Strong cryptography inverts the power
[54:45] balance. This is why it's so cool. It
[54:48] inverts the power balance of the
[54:50] physical world. It doesn't matter how
[54:53] many people show up to my house with a
[54:55] gun or to my gold vault or to my
[54:58] country. Good luck guessing my number.
[55:02] [ __ ] you.
[55:04] think go through the mental exercise of
[55:07] trying to think of something that's that
[55:09] secure because pretty much if I show up
[55:12] to someone's house with the military,
[55:14] it's now my house. If I show up to
[55:16] someone's country with the military,
[55:17] it's now my country. If I show up to
[55:19] someone's gold with the military, it's
[55:21] now my gold. But if the military shows
[55:23] up, I say, "What do you want me to do,
[55:26] guys? You could kill me. You could kill
[55:28] my neighbor. You could take over the
[55:29] land, but you're never going to guess
[55:32] that number ever.
[55:34] That's why cryptography is so cool.
[55:38] Only if it's implemented and done
[55:41] properly. Only guys, it has to be a
[55:44] large enough and a random enough number.
[55:47] That's it. That's the most critical
[55:50] part. You cannot [ __ ] that part up
[55:53] because going back to the one bit, if
[55:55] you secure it with one bit, how easy is
[55:58] that to guess? It's either zero or one.
[56:00] So when cold card 40 bits 40 bits isn't
[56:03] nearly enough, not nearly enough
[56:05] potential outcomes, an attacker can
[56:08] guess that number because the potential
[56:11] outcomes just the the the the space of
[56:14] probability it just was not big enough.
[56:17] This is why Julian Assange said no
[56:19] amount of chorus of force will ever
[56:22] solve a math problem. This is the cipher
[56:24] punk idea. We finally have technology
[56:27] resistant to force, to weapons, to
[56:29] violence.
[56:31] You can kill me and put a gun to my
[56:33] head. But think about it, guys. If you
[56:36] walk into my house, you put a bullet in
[56:37] my head. Okay, you got you got my house
[56:39] now. Good for you. Okay, you got my
[56:41] gold, too. Okay, you got all my hoodies
[56:44] and you got my fridge and and you got my
[56:46] workout equipment. Guess what? You
[56:50] didn't You can't guess my number. you.
[56:52] The only way to guarantee you don't get
[56:55] my secret is by killing me because you
[56:57] need me alive to figure out what the
[57:00] secret is. That's the power of large
[57:02] numbers and cryptography.
[57:05] You see, that's what's so inspiring
[57:07] about this strength in numbers. That's
[57:09] what Bitcoin brings. And by the way, how
[57:12] accessible is math and numbers? Everyone
[57:15] on the planet can use math, use large
[57:18] numbers, and share information. That's
[57:21] why Bitcoin is the most accessible
[57:22] monetary system in the world and it's
[57:24] the safest with the most distilled
[57:26] property rights because as long as you
[57:28] have a sufficiently large and
[57:30] sufficiently random number, you are
[57:33] secure. That's it. No military, no
[57:37] state, no corporation, nobody can guess
[57:40] that. As long as you generated it
[57:42] correctly and you kept it safe, you're
[57:45] good. That's what self-custody is, by
[57:48] the way, guys. That's never going to die
[57:51] ever. And if you're storing your coins
[57:53] with someone else, all you're saying is
[57:55] I trust you in the number that you
[57:58] generated and the randomness that you
[58:01] used and I trust you to secure these
[58:03] secrets. That's all you're saying. Do
[58:05] you understand?
[58:09] So now let's get into the cold card uh
[58:11] cold card failure. Um because the the
[58:16] terminology I used on the slide here is
[58:18] that the lock itself wasn't broken. The
[58:20] key maker failed at making a good enough
[58:24] key is what honestly happened at the end
[58:27] of the day. So let's walk through it. A
[58:30] hardware wallet theoretically now that
[58:33] you guys understand how Bitcoin works
[58:34] which it's really just about safely and
[58:37] securely generating this secret. That's
[58:40] it. Again, I don't want to oversimplify
[58:43] it, but like to if I were to dumb it
[58:45] down for the layman on the street,
[58:47] that's it.
[58:49] And a hardware wallet has really three
[58:51] jobs if I were to distill it down to
[58:53] three. One, generate. So, create a root
[58:57] secret so large and so random that
[58:59] nobody can predict it. And we just went
[59:01] over that that we can use cryptography
[59:04] and like just massive numbers that the
[59:07] human brain can't even comprehend.
[59:10] Okay. The second job is to protect that
[59:13] root secret. So you keep that root
[59:15] secret away from untrusted network
[59:17] systems. So one of the one of the um
[59:22] like dreams of a hardware wallet is it's
[59:25] not something that can persistently
[59:27] lives on the internet which is online
[59:30] and within a broad network a broad
[59:32] public network. So it is something that
[59:34] you can put in a safety deposit box that
[59:36] you can put under your mattress you
[59:37] could put in a vault in your house. And
[59:39] then the third job is it has to be able
[59:41] to sign and authorize transactions
[59:43] because obviously there's no point in
[59:45] owning Bitcoin that's stuck eventually.
[59:48] None of us want money for the sake of
[59:51] money itself. Like you don't want
[59:52] dollars for the sake of the paper or
[59:54] bitcoins for the sake of the bites. You
[59:56] want what money can get you. As much as
[59:58] we want to hodddle and everything,
[60:00] eventually at some point the whole point
[60:02] is that it gets you a bigger house. It
[60:04] gets your kids a better life. It gets
[60:06] your wife uh the dream whatever the [ __ ]
[60:09] backyard. So if you can't sign and
[60:12] authorize a transaction that you
[60:14] actually own the root secret that
[60:17] corresponds with the ledger entries on
[60:20] the blockchain. So these are technically
[60:22] the three jobs and cold card failed at
[60:25] the first one. So what what did cold
[60:28] card [ __ ] up now that you guys
[60:29] understand from a high level how Bitcoin
[60:31] works? It [ __ ] up at generating that
[60:34] root secret. It did not generate a
[60:37] random enough number that nobody can
[60:40] predict.
[60:44] The one true job of owning Bitcoin, it
[60:48] [ __ ] up.
[60:51] Like I hate to be that blunt. Honestly,
[60:55] I take that back. I don't hate to be
[60:56] that blunt.
[60:58] That's what happened. I have to call it
[61:01] how I see it.
[61:03] the one job of a Bitcoin wallet. The
[61:07] first job, create a large enough and
[61:11] random enough number. That's it.
[61:15] And they [ __ ] that up.
[61:22] So, let's get into some of the
[61:24] technicals of what actually happened
[61:25] because I haven't seen too many people
[61:27] talking about it, at least what I
[61:28] consider to be reasonably accurately. So
[61:31] I'm not again it's interesting decision
[61:33] on my part because I'm not like a highly
[61:35] technical show. This is for the streets
[61:37] but I think you guys will be interested
[61:38] in this. So what happened is there
[61:41] actually is
[61:44] the um how do I dumb this down?
[61:49] The cold card could have actually
[61:53] generated
[61:54] a large enough and random enough root
[61:56] secret for Bitcoin or storing Bitcoin.
[62:00] it had the capability on the device. The
[62:03] problem was it was turned off,
[62:08] which I'm not going to uh spark
[62:11] conspiracy theories because I actually
[62:13] think that this was a genuine software
[62:15] bug after taking a look at what happened
[62:16] and reading a bit. But um the point is
[62:20] and the very like novice catastrophic I
[62:24] mean the level of incompetence here is
[62:28] really difficult. I I really think cold
[62:31] card owes uh when the time is right,
[62:34] Coin Kite uh owes uh the community a
[62:37] postmortem here because I'm having a
[62:39] tough time comprehending. Listen,
[62:42] people write bugs all the time. So much
[62:45] of security, guys, which we'll get into
[62:47] in a second, is not doing everything
[62:51] perfectly all the time. It's designing
[62:53] systems that inevitably when [ __ ] goes
[62:56] wrong, it's still okay.
[62:59] That's security in a nutshell. Okay. So,
[63:04] why was why was it set to zero? I don't
[63:07] know. But people write bugs all the
[63:10] time. Like it's it's okay. The problem
[63:14] is the cold card then fell back like
[63:19] like think of the device going, "Oh, oh,
[63:22] the the true tried and true and random
[63:24] enough entropy is turned off. Well, plan
[63:27] B, I'm going to fall back to this other
[63:29] one, which was awful, not nearly random
[63:34] enough, and inevitably lost a bunch of
[63:36] people a lot of Bitcoin.
[63:38] But it's the mere fact that the cold
[63:41] card had a fallback in the first place
[63:44] that wasn't nearly random enough.
[63:46] Because, like I said before, just
[63:48] because it's not nearly random enough
[63:50] doesn't mean it won't generate and it
[63:52] won't actually create valid seed words.
[63:54] And those valid Cwords won't be able to
[63:56] actually work on the Bitcoin network
[63:58] because like I said, the format itself
[64:00] doesn't change. What changed is the
[64:02] amount of potential outcomes and
[64:04] possibilities of the numbers that coin
[64:07] car uh cold card was generating. Does
[64:09] that make sense? So, it had a it had a
[64:11] plan B. It had a fall back
[64:14] to something extremely weak. And the and
[64:17] the incompetence is as a security
[64:20] engineer how you failed
[64:24] silently.
[64:26] You cannot do that.
[64:29] So let me explain what that means.
[64:32] What happened is
[64:35] the the entropy was defined like the the
[64:40] secure randomness was defined but it was
[64:43] not enabled.
[64:46] So check a so again this isn't like too
[64:49] technical but just imagine this check a
[64:52] in cold card is is the hardware RNG
[64:55] which is this again enough randomness is
[64:58] the hardware's randomness flag defined
[65:01] does it exist and the answer is yes now
[65:05] the problem is is the hardware's
[65:07] randomness flag enabled and it was no
[65:11] okay so when they were testing the cold
[65:14] card and and you'd get a green light
[65:17] like is the hardware's randomness
[65:19] defined? Is it there? And it would come
[65:22] yes, test passed. It's here. And they
[65:24] say okay, that's good enough. And then
[65:26] it would produce seeds and it would work
[65:28] and the Bitcoin and everything looked
[65:29] normal. And no one thought to look for
[65:32] well is the hardware
[65:36] uh randomness enabled? Not just is it
[65:38] there, but is it enabled? And let me
[65:40] tell you guys something.
[65:43] You cannot fail this way as a security
[65:47] engineer.
[65:49] So
[65:51] meaning this, a device that generates a
[65:54] weak key, a weak secret in silence is
[65:58] far more dangerous than a device that
[66:00] refuses to generate one at all. So the
[66:03] problem is not that someone accidentally
[66:08] disabled it really like like they they
[66:11] set the value to zero. it looks like in
[66:13] the code. Okay. Again, like I said,
[66:17] people make mistakes.
[66:19] When you're a security engineer, that
[66:21] has to result in a fatal error. What I'm
[66:25] confused by and what I don't understand,
[66:27] and I think what Coin Kite is going to
[66:29] have to explain to somebody someday is
[66:31] why there was a fallback to something
[66:35] that was not nearly secure enough.
[66:39] Do you understand what I'm saying? said
[66:40] in human language is
[66:44] if the ability to create a large and
[66:46] random enough number fails, then halt,
[66:50] stop, freeze, break. Don't just generate
[66:54] a weak random one instead. That's the
[66:56] thing because bugs happen all the time.
[66:58] But this is this is uh an idea in in
[67:02] security engineering called fail closed,
[67:04] which is you you do not you do not fail
[67:07] silently like that. silently meaning,
[67:10] well, we'll we'll just generate one
[67:12] anyway. That's really weak. That's the
[67:14] um incompetence that I'm struggling
[67:17] with. It's not the fact that it wasn't
[67:20] enabled
[67:22] because like I'm telling you guys, that
[67:24] [ __ ] happens, but this is more like um
[67:27] best security practice is is the
[67:30] software has to work a very specific
[67:33] way. And if it doesn't, don't build in
[67:35] fallbacks. Why are you falling back to
[67:38] anything? It either has to work the
[67:40] right way or it shouldn't work at all
[67:44] because giving people weak seeds is far
[67:48] more dangerous and catastrophic than
[67:50] just doing nothing. How much better
[67:53] would Bitcoiners be if the [ __ ]
[67:55] device just said, "Sorry, I'm not
[67:57] working right now."
[68:00] Why the [ __ ] was a fallback implemented?
[68:04] That's the part that I can't understand.
[68:08] It's one thing to write a bug. Fine. You
[68:11] run the thing and it says I'm not
[68:13] working. I'm not working. And then you
[68:15] dig into it and you realize, oh [ __ ]
[68:17] there's sufficient randomness on the
[68:20] device. It's en it's it's defined, but
[68:22] it's not enabled. It's not turned on.
[68:24] Fail, fail, fail, fail. Why it fell back
[68:28] to generate something so weak. And again
[68:33] part of part of being secure and part of
[68:36] security and security engineering is
[68:39] being humble and carrying humility.
[68:41] Okay. So it is it is it is dangerous to
[68:45] cast stones
[68:47] like I said because everyone makes
[68:50] mistakes and the goal of building secure
[68:52] systems is actually not training to be
[68:56] perfect. It's training to be secure
[68:59] despite things going wrong.
[69:03] So I I am not sitting here, you know,
[69:06] and there are way better I'm a CEO now.
[69:09] Okay, there are way better
[69:12] uh security engineers that I would love
[69:14] their opinion on, but my people want to
[69:16] know my personal take on where the
[69:20] incompetence was, potential
[69:22] incompetence, right? Like I don't know.
[69:23] I we haven't heard any of the story.
[69:25] It's not that the secure randomness was
[69:30] disabled.
[69:31] Okay, again, of course, it should have
[69:33] been enabled. I don't I don't understand
[69:35] that. But things [ __ ] happens. It's this
[69:38] design decision to have implemented a
[69:40] fallback. Like you must fail violently
[69:45] in this type of engineering. You you
[69:50] cannot
[69:52] you'd rather fail and break and the and
[69:55] the software just crash than give
[69:58] somebody something so weak.
[70:02] A device that generates a weak key in
[70:04] silence is more dangerous than a device
[70:06] that refuses to generate one at all. And
[70:09] so
[70:12] that's what happens guys. The one job of
[70:15] a wallet is to create a random enough
[70:18] route.
[70:20] And and the cold card didn't do that.
[70:24] And so you can see here the MK2 and the
[70:28] MK3
[70:29] it's estimated and these things are
[70:31] changing so don't hold me to this. But
[70:33] the point which you guys will get is you
[70:35] know 2 to the 40th
[70:37] it's just it's not nearly large enough
[70:40] number
[70:41] in in random. It's that combination of
[70:44] big and random, right? Because you're
[70:46] trying to get as many potential outputs
[70:49] as possible. Obviously, if a human were
[70:51] to do it, it wouldn't be as random as
[70:54] rolling dice, shuffling cards, whatever.
[70:56] Like true randomness, true entropy,
[70:59] right? And that's why when you when you
[71:02] hear people say, well, the MK4 and the
[71:05] MK5 and the Q, these were the later
[71:07] models of the cold card. when you hear
[71:08] people say, "Well, those were a little
[71:11] bit more secure, but not secure enough
[71:13] because the randomness actually
[71:15] improved, but only by a little bit." So
[71:17] that's why you saw certain devices get
[71:19] wiped immediately. And someone seemingly
[71:22] was able to do it with an AI program,
[71:23] maybe on a laptop. And then the later
[71:26] devices, it took some time because you
[71:28] had to get enough compute, enough like
[71:31] it actually took a decent amount of
[71:34] compute to go through the amount of
[71:36] guesses required to find it. and crack
[71:38] it, but it's just not random enough. It
[71:42] It had to have more randomness, and they
[71:45] failed at that.
[71:47] But I need you guys to understand
[71:49] something. Bitcoin did not become less
[71:51] secure. Bitcoin did not get hacked. And
[71:54] cold storage, self-custody for itself
[71:57] did not have like a catastrophic design
[72:01] error. It was one company [ __ ] up at
[72:06] the one job they had.
[72:08] That's why people say, "Well, is it the
[72:10] same for Treasure? It the same for
[72:11] Ledger?" Now, we'll get into do should I
[72:15] be recommending and telling people what
[72:17] to do? I'll get into that in a second.
[72:18] I'm not going to sit here and tell you
[72:20] guys, oh, Treasure is really secure.
[72:23] They're as secure
[72:26] as the how large and how random their
[72:30] number they generated is.
[72:36] And that is why we encourage people to
[72:39] open source as much as they can. It's
[72:41] why we audit code bases. This is why and
[72:45] we'll get into best practices and what I
[72:47] would recommend and stuff, but back to
[72:50] the point, you know, is what happened to
[72:53] cold card mean Ledger is insecure?
[72:55] According to Ledger, they say no, cuz
[72:59] our numbers are large enough and random
[73:00] enough. And here's our proof. Treasure
[73:02] said the same. So how is this only a
[73:05] cold card specific issue? It's a cold
[73:07] card specific issue because it comes
[73:09] down to how they were generating that
[73:12] root random large number. That's it.
[73:16] That's all that happened. I'm not I'm
[73:18] not belittling what happened. It's
[73:20] [ __ ] up. It's terrifying. It's sad.
[73:22] It's horror horror for for Bitcoiners.
[73:27] But let's not let's not misconstrue this
[73:30] to like, oh, it broke self- custody. No,
[73:32] no. Come on, guys. Can we generate large
[73:38] random numbers and can we secure those?
[73:40] Come on. For the future of money for our
[73:43] kids, can we do that? Come on. Yeah, we
[73:46] can. Come on. Yeah, we can. Okay.
[73:51] Um so anyways uh
[73:57] the the
[73:59] issue was introduced into the cold card
[74:02] firmware in March of 2021.
[74:06] Uh block published technical analysis
[74:10] identifying this RNG. So this randomness
[74:12] this fall back issue. It's really this
[74:14] issue about falling back. Like I said,
[74:16] if they shipped a bunch of customers
[74:18] hardware devices and the hardware
[74:19] devices were just like, "Sorry, I can't
[74:21] do what you bought me for," people would
[74:23] be pissed. But, I mean, they wouldn't
[74:24] have lost their life savings. So, it was
[74:26] this fallback issue. Um, that was August
[74:31] 1st, August 2nd. Coite then validated it
[74:36] and we're able to watch the hack go down
[74:38] in real time. Uh, this episode's
[74:41] happening on August 3rd and this issue
[74:44] is ongoing. So,
[74:46] um, if you're listening to this fairly
[74:48] real time, please, uh, take a look at
[74:52] how you what wallet you're using as just
[74:56] check it's not cold card. If it's cold
[74:57] card, get it off. Um, deposit to strike.
[75:00] Deposit to strike for the time being.
[75:03] Um, okay. Now, let's get into I I have
[75:07] this last kind of chapter for what are
[75:11] better practices? um you know well
[75:14] because people are should know what is
[75:16] multi-IG what is uh key sharding what
[75:20] are what are ways to ensure randomness
[75:22] and do this the right way I want to I
[75:25] want to say something real quick here
[75:26] and I know this is a long episode guys
[75:28] but I I think it's worth it and if
[75:29] you're if you're here for macro and
[75:32] markets and stuff come back next week is
[75:34] what it is all right is what it is but
[75:36] you know you know bit Bitcoiners need
[75:38] Bitcoiners right now okay So
[75:42] now that you guys understand
[75:46] how Bitcoin works from a high level,
[75:48] it's just about generating a large
[75:50] enough and random enough root secret
[75:53] root number and protecting that and
[75:57] being able to use it to sign
[75:58] transactions when you need to. Okay,
[76:01] that's it.
[76:03] Now advising on what people should use
[76:06] and should do.
[76:09] That's why I'm ne I've never been big on
[76:11] that. What I've been big on is I've
[76:13] built my own financial service in Strike
[76:17] that does all of these things incredibly
[76:19] well. If you want to use a financial
[76:22] service, that means trusting me and us.
[76:28] Now, if you don't and you want to do
[76:31] things your way, which is incredibly
[76:33] valuable, I am not implying that
[76:35] everyone needs to use strike or that's
[76:36] the only way. It becomes interesting on
[76:39] what to advise because it depends on
[76:42] your use case. It depends on what you're
[76:44] optimizing for. Is multi-IG better than
[76:47] single sig? Well, it depends. Multisig's
[76:50] more complicated.
[76:52] So, yes, it improves certain areas,
[76:56] but it makes it easier to [ __ ] up and
[76:58] fail because Bitcoin that's stuck in a
[77:02] contract or in a setup that can't be
[77:04] moved ever again is also lost.
[77:09] So it depends.
[77:11] I think multisig is great. Strike uses
[77:13] geographically distributed multic.
[77:16] But why I've never been religious about
[77:19] recommending things for others is
[77:21] because once you understand it's it's
[77:23] all it's about is generating a large
[77:25] enough and random enough number and
[77:27] securing that.
[77:30] Well, what then what's best? Well,
[77:33] depends.
[77:35] depends on what you're trying to do. For
[77:37] example, I'll tell you guys this. If all
[77:39] you're trying to do is store Bitcoin and
[77:41] rarely if ever touch it or move it, you
[77:44] could just buy a laptop
[77:48] and run Bitcoin Core.
[77:51] Boom.
[77:54] Keep keep the laptop offline, never
[77:56] connected to the internet.
[77:58] Like spin up a Bitcoin core node.
[78:02] By the way, when we talk about code
[78:05] bases that have been reviewed to death,
[78:08] like clearly not enough eyeballs were on
[78:10] the cold card firmware source code,
[78:13] right? There weren't enough people
[78:14] reviewing the cold card firmware. What's
[78:17] the most reviewed codebase in the
[78:19] Bitcoin ecosystem?
[78:21] Bitcoin Core.
[78:23] That's why often times my advice is like
[78:26] listen, if you're not trying to do
[78:28] something fancy, cuz you know, let me
[78:30] say this. Cold Card had a lot of
[78:31] features and the features were great and
[78:33] people geeked out on the features and
[78:34] that's fine. But me, like I use Strike
[78:39] if I need to send a lightning payment,
[78:41] if I need like a hot wallet for any
[78:43] reason. Obviously, I trust Strike cuz I
[78:45] built it. And like when people say, "Do
[78:48] I self custody?" I mean, Strike is
[78:49] technically my custody. I have different
[78:51] custody than Strike, but I also use
[78:53] Strike to custody. So, you can get why,
[78:55] you know, I love Strike and and there's
[78:57] a lot of other Bitcoiners around the
[78:58] world. there's, you know, millions of
[79:00] people that have Strike account and they
[79:02] do the same. So, I wasn't on cold card,
[79:05] you know, um, using all the features and
[79:08] doing all this crazy [ __ ] I have I have
[79:11] cold storage just to like store the
[79:13] coins. That's it. I They just need to be
[79:15] protected.
[79:17] Bitcoin Core. Bitcoin Core. Why? One
[79:22] reason is because like I said it's the
[79:24] most audited actively reviewed codebase
[79:27] in the entire ecosystem.
[79:30] So this is the problem is like
[79:33] do you need a hardware wallet even? It
[79:36] depends on what you're doing.
[79:38] It depends. And and and now that I'm I
[79:42] really am and this was before the cold
[79:44] card incident went down. I'm so
[79:46] motivated and dedicated to doing more
[79:49] content and trying to be more of a
[79:51] leader and just helping people. It's not
[79:53] even telling people what to do cuz the
[79:55] other thing Cold Car never paid me
[79:57] anything. You guys want to talk about I
[79:59] have no sponsors on this show and this
[80:02] is one of those reasons like it's it's
[80:03] just authentically me. I don't want
[80:06] anyone to be paying me to tell me what
[80:08] to say or tell me what to promote. [ __ ]
[80:10] that [ __ ] [ __ ] that. you guys can come
[80:12] here and know that I'm just genuinely
[80:15] trying to do my best and I'm not like
[80:17] paid pro I'm not paying my mortgage
[80:20] selling you a product. Okay.
[80:22] So, nobody paid me to say anything about
[80:25] anybody. It it it it just it it
[80:29] ultimately depends and I'm very very
[80:30] committed to not even telling people
[80:33] what to do or getting sponsors and
[80:35] telling people to use my sponsors. It's
[80:37] just education of like, okay, at the end
[80:39] of the day, you need to generate a large
[80:42] enough and a random enough number. Here
[80:44] are the different options to do that.
[80:47] Here's what each option is optimizing
[80:49] for. If you're just looking to store
[80:52] Bitcoin, an offline laptop that you know
[80:56] is a bit you you spun up Bitcoin core,
[80:59] you created a Bitcoin address, you sent
[81:02] the Bitcoin to it, unplug that [ __ ]
[81:04] keep it offline. That's the most audited
[81:07] and reviewed codebase in the whole
[81:09] ecosystem.
[81:10] Like there there's no such thing as like
[81:12] not enough eyeballs on Bitcoin Core. I
[81:14] mean there's always a shortage of
[81:16] developers. Come on. Come on. Don't
[81:17] misconrue my Always a shortage of
[81:19] developers. You guys get it. But it's
[81:21] the most actively reviewed codebase.
[81:27] You know what I'm saying? Now there's
[81:29] definitely a market for hardware wallets
[81:32] 100%. And like is everyone going to buy
[81:36] a new laptop? Like is that the
[81:38] mainstream way? No. Is Bit Bit key the
[81:41] mainstream way? Maybe. Is the mainstream
[81:44] way I like. You understand what I'm
[81:46] saying? You got to got to understand at
[81:49] the end of the day the job to be done.
[81:50] The job to be done is it big enough
[81:52] random enough number
[81:55] many many ways to do it. Many ways to do
[81:57] it. Okay. So let's get into some stuff.
[81:59] Multistig. So, here's what you guys need
[82:02] to understand about multisig. Um,
[82:06] multi-IG
[82:08] changes
[82:10] the fact that once your your secret is
[82:13] compromised, it's over. Whoever is able
[82:17] to recreate that secret or get access to
[82:19] that secret or find your secret, it's
[82:21] over. Because what multisig does, it
[82:24] requires multiple keys. So what is a
[82:27] very frequent solution is what's called
[82:30] a two of three multisig. And what this
[82:32] does is it requires two of the keys to
[82:36] move Bitcoin, not just single one. So
[82:39] what you guys will hear as you are
[82:41] researching this and you're on Twitter,
[82:43] you'll hear people say single sig,
[82:45] multi-IG. Single sig is in reference to
[82:48] one large random number and it's a
[82:52] single single sig. So once it's signal
[82:55] signature. So once you are able to
[82:57] produce a signature because you have
[82:59] either guessed or stolen or hacked or
[83:01] whatever that large random number,
[83:04] you're good. It's over. The Bitcoin is
[83:06] whoever is is broadcasting that
[83:08] signature. Now what multisig does, which
[83:11] is fascinating,
[83:13] is it requires two. So if one of them is
[83:16] compromised. So let's say you had a
[83:18] multi-IG where you created one with a
[83:22] cold card, one with a ledger, one with a
[83:24] treasure,
[83:26] you're good cuz yes, the cold card's
[83:28] compromised, but the that's not two.
[83:31] That's only one. You you need two. You
[83:34] need the cold card and the ledger or the
[83:36] cold card and the treasure.
[83:39] And so you're okay. And so what this
[83:42] does is it is it addresses security in a
[83:45] slightly different way. It says again
[83:48] guys remember security is about
[83:49] humility. It's about being humble. It's
[83:51] about saying what if something goes
[83:53] wrong or am I still going to be okay?
[83:56] And this is why I recommend multisig and
[83:59] I think it's a great option and
[84:01] geographically distributed multiig is
[84:03] what strike uses to secure coins
[84:07] is it's well you need multiple
[84:11] secrets to move the coins and it could
[84:14] be as many as you want. There's two of
[84:15] three, there's three of five, seven of
[84:18] 11,
[84:19] right?
[84:21] And what this does is it allows a key to
[84:24] be compromised. It allows one of these
[84:27] large random numbers to be stolen,
[84:29] theft, guest, and you're still okay.
[84:32] That's why multi-IG is more redundant.
[84:34] Now, it's also more complicated.
[84:38] So, some of the problem, now I have to
[84:40] be honest about the pros and cons.
[84:41] People have tried to set up multiig
[84:43] themselves and they've accidentally set
[84:45] it up wrong and all of a sudden your
[84:46] Bitcoin is locked away forever because
[84:49] you set up the software in a way that
[84:51] you can never move the Bitcoin ever
[84:53] again.
[84:55] So it's more complicated,
[84:57] pros and cons to everything. That's why
[84:59] companies create solutions for this type
[85:01] of stuff. It's why Strike exists. Okay.
[85:04] Experts can do it. But that's what
[85:06] multisig is. So again, single sig, one
[85:11] affected key, one signature required,
[85:13] you're toast. Multi-ig, if one key is
[85:16] affected, you still have the other two.
[85:18] You're good. You can swap that one key
[85:20] out and life goes on. And then obviously
[85:23] if two keys are affected in a two of
[85:25] three multisig then the multisig fails.
[85:28] But uh the point is you're creating
[85:31] redundancy to failure cuz again guys
[85:35] being secure is all about it's not about
[85:37] being perfect. It's about how can I
[85:39] create an environment where things can
[85:40] go wrong and I'll still be okay. You see
[85:44] that's what being secure is that that's
[85:46] people only the paranoid survive right?
[85:51] What could possibly go wrong?
[85:56] Um,
[85:59] skip that. Okay. Uh,
[86:02] another thing you'll see is sharding.
[86:05] So, sharding is
[86:08] so you have these these keys. So, you
[86:10] you could have a two of three multisig
[86:12] and sharding is
[86:16] distributing
[86:18] the key itself.
[86:20] So it's it's one signing authority. So
[86:23] one key distributed across people,
[86:26] systems, locations. It changes like who
[86:29] can actually reach the key and how hard
[86:31] the key is to assemble to sign. So not
[86:35] only can you distribute the keys, you
[86:37] could say, "I'm not going to have one
[86:38] key. I'm going to have many keys and I'm
[86:40] going to require multiple keys just to
[86:42] move the Bitcoin." You could say, "I'm
[86:44] not going to have one person own one
[86:47] key. I'm going to have 12 people
[86:50] combined make up for one key where you
[86:53] need at least seven of the 12 people or
[86:55] something like this to make up one key
[86:58] and then you need another 20 people to
[87:00] make up the second key. And so you can
[87:02] do very fancy things which again just
[87:05] implement fail safes which just
[87:07] implement redundancy. What if something
[87:09] goes wrong? What if one person gets
[87:12] hacked? What if one person gets a gun to
[87:14] their head? So there are many ways to
[87:16] take these really large, really random
[87:18] numbers and protect them. Now, this is
[87:21] not an advertisement for mainstream. I'm
[87:24] not I'm not solving mainstream
[87:25] self-custody on this episode. I need
[87:28] education. Education, brutal honor,
[87:30] honesty, leadership, okay? Just like,
[87:33] hey, this is what's going on. This is
[87:35] how you can understand it. What
[87:36] questions do you have? Here's the
[87:38] information necessary. And let's just
[87:39] take it one step at a time. Maybe this
[87:42] maybe this episode doesn't get the most
[87:43] views. That's okay. Some people will
[87:45] learn some stuff. You guys will ask
[87:47] questions. You'll give me feedback. We
[87:49] march on. We march on. We march on.
[87:51] Okay.
[87:53] Um and so lastly, something to to think
[87:57] about in regards to custody. Custody has
[87:59] two enemies, okay, to think about. One
[88:02] is theft. So someone else gains
[88:05] authority to your secret. Okay, so
[88:09] predictable key generation is what
[88:11] happened at cold card. malware, uh, an
[88:15] insider job, some inside compromise,
[88:18] physical extraction of the secret. The
[88:21] other is loss. And that's the other
[88:22] thing that we, you know, we have to be
[88:24] careful of. We have to make these tools
[88:25] easy. We have to make them accessible
[88:27] because if they're too complicated,
[88:29] people are going to lose the Bitcoin,
[88:31] which happens, I mean, it doesn't happen
[88:33] as frequently anymore because the space,
[88:35] excuse me, has gotten so much better
[88:38] with tooling and companies and and
[88:40] projects. But, you know, back in the
[88:42] day, it was very easy to lose bitcoins
[88:44] cuz if you set it up wrong, you're like,
[88:46] "Oh, crap. I set it up in a way where I
[88:49] can't move the Bitcoin cuz I don't have
[88:50] the right secret." You see? So, really
[88:55] good Bitcoin custody both keeps Bitcoin
[88:58] inaccessible to attackers and
[89:00] recoverable by its rightful owner.
[89:02] That's like the way that I would think
[89:04] about storing bitcoins myself, which is
[89:08] what are we doing to prevent attackers
[89:10] and what are we doing to ensure
[89:12] recoverability by its owners and that's
[89:15] well let's multi-ig well let's do key
[89:17] sharding well let's do let's do let's do
[89:19] let's do and you're adding you know that
[89:21] that when I say geographically
[89:23] distributed that's what I'm saying is
[89:24] like well what if you're able to keep
[89:28] these things in different
[89:31] places so that it's not all down to one
[89:33] geography.
[89:34] Um, and so this slide, custody is a
[89:38] stack. It's not a product. Okay, so
[89:40] you've got recovery, operations, key
[89:43] protection like sharding or geography or
[89:45] access. You've got um multi-IG
[89:49] and then the generation. And the
[89:50] generation, again, just a reminder, is
[89:52] where cold card [ __ ] up is just
[89:56] generating like
[89:58] the the the severity of this issue and
[90:01] the level of error here again is hard to
[90:04] comprehend because you're like, well,
[90:05] where where did they screw up? Was it in
[90:07] the operations? No. No. It was literally
[90:09] in generating a large enough and random
[90:12] enough number. It was like the very
[90:14] basics. Bitcoin 101 is where they messed
[90:16] up. unfortunately super sad for everyone
[90:20] involved.
[90:22] So it all comes down to strong enough
[90:25] random enough number. From there you
[90:27] build up. From there you build up.
[90:32] So in recap in summary the Bitcoin
[90:36] ledger records the Bitcoin. Okay. The
[90:39] randomness makes this key undecable.
[90:42] Multi-IG makes one key insufficient.
[90:47] And distributed control makes one
[90:48] person, machine or location
[90:50] insufficient.
[90:52] Recovery makes failure survivable.
[90:55] Everything can be public except that one
[90:58] root secret. You got to get that part
[91:00] right. Okay.
[91:06] Um All right. in regards to Strike. Uh,
[91:11] listen,
[91:13] I I will say kind of uh it's a little
[91:17] disheartening that Strike hasn't been um
[91:22] mentioned as a place that does custody
[91:24] well or you know I I mean we do I think
[91:29] I I think I need to talk about it more
[91:32] and we as a company need to talk about
[91:34] it more and promote it more. Um, so just
[91:37] to be clear, Strike is unaffected,
[91:39] incredibly safe, incredibly secure, um,
[91:42] geographically distributed, multi-IG.
[91:45] Now, I can't get or not I, of course I
[91:48] can. I don't want to,
[91:52] uh, talk too much about some of the
[91:55] details because at a certain point,
[91:57] you're severely disadvantaging yourself
[91:59] versus providing trust and comfort to
[92:03] customers.
[92:04] Um, so I saw a lot of you guys like,
[92:07] well, what are you guys doing to protect
[92:09] Bitcoin? How do you secure Bitcoin? I am
[92:12] working with the strike team, um, our
[92:15] tech, our technology team, our security
[92:17] team on the best ways for us to answer
[92:21] these questions without, you know,
[92:23] potentially
[92:26] uh, I don't know, just carelessly giving
[92:28] away information that we probably we
[92:31] just shouldn't to be quite honest. Um,
[92:34] so I'm curious what questions you guys
[92:36] have if I can answer them today. And
[92:37] we're we're trying to do a lot more,
[92:39] like I said, content, blogging,
[92:41] promotion,
[92:42] um, and, uh, just about our services and
[92:45] the quality of our services. And, and
[92:46] the other thing I will say is, uh, is we
[92:50] are taking a look at custody products
[92:53] just based off the back of this event.
[92:54] And, and people I mean, so many
[92:57] customers ran to strike in the wake of
[93:01] this event. I mean, we saw hundreds and
[93:03] hundreds and hundreds of millions of
[93:05] dollars of deposits. I again I what was
[93:07] disappointing to me is I saw people
[93:08] showing like, oh, this is how many
[93:10] deposits Coinbase got in the last 24
[93:12] hours and no one mentioned Strike. And
[93:14] again, I think it's because I don't
[93:16] know, people don't think of us that way
[93:18] or I don't talk about the custody
[93:21] technology that we've built or some
[93:23] maybe I'm not sure. Um, but who knows? I
[93:26] mean, I didn't see a lot of people
[93:27] mentioning Cash App necessarily and
[93:29] they've built a lot of amazing things.
[93:30] So maybe it's just a brand thing that I
[93:32] need to work on, but we're going to be
[93:34] blogging a lot more, producing a lot
[93:35] more content, technical stuff, just to
[93:38] give customers enough information to
[93:41] know we do things the right way. Um, and
[93:43] we're doing Bitcoin custody well. And,
[93:47] uh, obviously I want to be able to
[93:50] promote and encourage you guys to do
[93:52] custody yourselves and hopefully just
[93:54] educate you enough to make decisions on
[93:56] your own. And if strike can build
[93:58] products like we're taking a look at
[94:00] collaborative custody, we're taking a
[94:02] look at multi-IG solutions that we can
[94:04] help provide. I mean, we have all of the
[94:06] infra infrastructure and all the
[94:08] licenses and distribution. Um, to be
[94:10] honest, we never really got the demand
[94:14] uh to do things like proof of reserves
[94:16] or do things like some of the custody
[94:18] products. I mean, people tell us to
[94:20] build things all the time, but there
[94:22] wasn't that much noise about some of
[94:24] this stuff. There is now. We'll see how
[94:27] long it lasts. Obviously, we'll see how
[94:28] persistent it is. Um, obviously, this is
[94:31] all happening in real time, but we are
[94:32] taking a look at custody and just the
[94:35] brand and the messaging and how we talk
[94:38] about ourselves just so that people know
[94:40] um we're safe, secure, uh, in an amazing
[94:44] place to do all things Bitcoin, not just
[94:47] buy or get or get a loan. Um,
[94:50] another thing I wanted to say regarding
[94:52] strike, uh, this hack seemingly involved
[94:57] AI a decent amount more than other hacks
[95:00] in the past because AI is so new and
[95:02] prevalent. So, I wanted to show you
[95:04] guys, no, not that. Uh, I wanted to show
[95:08] you guys
[95:10] I tweeted yesterday that Strike We built
[95:15] So, we've been running this. People are
[95:17] like, "Oh, did you build this
[95:18] yesterday?" Uh, we built an Agentic
[95:20] system that reviews our codebase daily
[95:22] using Frontier AI models, including
[95:25] Kimmy K3. Uh, we we've been doing this
[95:30] for months. So, every single day, a
[95:32] bunch of AI models attack our system and
[95:36] try and find vulnerabilities, try and
[95:38] find threats, try and find insecurities.
[95:40] Cuz it's one thing to do Bitcoin well. I
[95:43] think it's increasingly important to do
[95:45] AI well and doing AI well has grave
[95:48] implications on security too. And so
[95:51] we'll be writing about this and
[95:53] publishing this too. um in just not only
[95:58] how we do Bitcoin well and I'm I really
[96:01] want to hear from you guys what type of
[96:05] custody products Strike can offer you
[96:09] that would grow your trust, make you
[96:11] feel safe, you know, like sleep well at
[96:13] night technology. Um I if you know if
[96:16] you don't want to do the hold your own
[96:18] large random number yet what we can do
[96:21] whether that's information blogging
[96:23] content videos actual products like
[96:26] collaborative custody collaborative
[96:28] institutional collaborative custody
[96:30] multi-IG
[96:32] um all sorts of stuff we can do uh and
[96:35] then we're going to do a lot on the AI
[96:36] side of just how we are using AI uh to
[96:40] actually harden our systems and better
[96:42] our systems as opposed to, you know,
[96:44] people feeling scared that AI exists.
[96:48] Um, so just wanted to shout that out as
[96:50] well. But I'm incredibly proud of the
[96:53] Stripe team. I mean, like I said, we saw
[96:56] I think we saw a quarter billion dollars
[96:58] of deposits in like 36 hours or
[97:02] something of Bitcoin. And the whole
[97:05] team, whether you guys were a customer
[97:07] or not, was all weekend answering
[97:09] tickets, answering DMs. I mean, I was in
[97:13] and out of this wedding, uh, trying to
[97:15] help the best I can. Uh, and our service
[97:19] stayed online, stayed available, stayed
[97:21] secure. Um, we continue to iterate and
[97:24] innovate when it comes to the
[97:26] intersection between Bitcoin and AI. I
[97:28] think I just need to talk about this
[97:29] more and um, and we need to brand it a
[97:32] bit better. But incredibly proud of the
[97:34] team and just all the work that they've
[97:37] done up until this point and that we're
[97:39] doing actively and that we'll do in the
[97:41] future is just really proud moment um as
[97:43] a founder. So um as much as this sucks,
[97:46] I'm glad that Strike was a beacon of
[97:49] trust for a lot of Bitcoiners around the
[97:51] world. Um and that you know when times
[97:54] get tough and people get scared that
[97:55] they feel like they can come to me and
[97:57] come to us and come to our services.
[98:01] Okay. Uh, with that, let's do some Q&A.
[98:06] Um, I know this is already a really long
[98:08] episode. Like I said, apologize if
[98:11] you're not too interested in this stuff,
[98:12] but it it felt really necessary.
[98:16] Let me blow up my camera here and uh
[98:19] pull up Dylan's questions. Um, we've
[98:22] already spent over an hour and a half,
[98:26] so I don't know how much more time we'll
[98:28] do, but I'm gonna just try and chew
[98:30] through as much as I can, guys. I mean,
[98:33] [ __ ] it.
[98:35] Let's see.
[98:41] Um, okay, let's do it. Uh, Jack, I'd
[98:45] love to see someone like you make a
[98:47] YouTube series on self-custody, most
[98:49] importantly written. so anyone can
[98:51] understand. Us nonp power users are now
[98:53] paranoid since the cold card incident.
[98:56] Yeah, man. Listen, I get it. Um, I feel
[98:59] so bad for
[99:01] not only the Bitcoiners affected, but
[99:03] all Bitcoiners because it introduces a
[99:05] level of paranoia and fear that is hard
[99:08] to live with, especially if you're a big
[99:11] believer and so much of your life
[99:12] savings is in Bitcoin and you just can't
[99:15] live with that level of stress. So
[99:18] hopefully this episode was useful in
[99:21] what this is all about. At the end of
[99:22] the day, it just comes down to cold card
[99:25] failed at the one core job of any
[99:28] Bitcoin wallet securing any Bitcoin,
[99:30] which is creating a large enough and
[99:32] random enough number. They [ __ ] that
[99:34] up in a preposterous way. So that's what
[99:38] happened. If it makes you feel any
[99:40] better, that's all it is. and Treasure
[99:43] and Ledger and and everyone in the
[99:45] community is going about
[99:48] proving that their ability to generate
[99:53] this root number for your wallet um is
[99:56] sound and good and open sourcing any any
[100:00] software that previously wasn't and
[100:02] battle testing it with these frontier AI
[100:04] models. So, it has been encouraging to
[100:06] see the industry rally uh around this
[100:09] incident and support each other. there's
[100:11] so much time we spend fighting which I
[100:13] don't think is bad I think it's
[100:14] necessary and good but in the moments
[100:16] where it's it's needed we have each
[100:18] other's backs and that's been cool and
[100:21] so yeah Strike safe and secure many
[100:24] other Bitcoin exchanges do an incredible
[100:26] job and build incredible technology and
[100:28] and they seemingly are safe and secure
[100:31] um and Treasure Ledger um again I I
[100:34] don't want to guarantee anything because
[100:38] unless I've done the work or built it
[100:40] myself But I it's all about doing your
[100:43] own research, trying to verify your your
[100:46] best. You know, feel free to reach out
[100:48] to the support staff of these companies
[100:51] and say, "Hey guys, point me to the
[100:53] proof of entropy used to create my root
[100:57] secret and they should be able to do
[100:59] that, right?" And like I said as well,
[101:02] you know, if this is a question of,
[101:04] well, the cold card firmware codebase
[101:06] just didn't have nearly enough review or
[101:08] there just wasn't enough battle testing
[101:10] like what is the most Jack? What's the
[101:12] most battle tested secure software in
[101:15] Bitcoin? Bitcoin core. Bitcoin core, you
[101:19] know.
[101:21] Um, so anyways, uh, I do plan on making
[101:26] more content. So, uh, like I said, I'm
[101:29] going to spend a lot more time on this
[101:31] show. Um, potentially do episodes with
[101:34] guests. I know a lot of you are like,
[101:36] "Don't do that. I like the Monday just
[101:38] you." The Monday Just Me is not going
[101:40] anywhere, but it's can I have
[101:42] interesting guests on? Can I create
[101:44] series, tutorials, written content? I
[101:46] wrote a really long essay, but that was
[101:48] more introspective and philosophical.
[101:50] That wasn't educational. So, I don't
[101:53] want to like run in a million directions
[101:55] at once because then none of the content
[101:57] will be good at anything. It's all about
[101:59] quality and focus. So, I'm just trying
[102:02] to get my bearings a little bit. Um,
[102:04] like I need a new mic, for example. I
[102:06] got to get that done. Um, but yeah, more
[102:08] more content on the way for sure. Single
[102:10] sig question. Given this hack, how do
[102:12] you feel about single sig devices such
[102:14] uh as Trezor? Can we still trust them
[102:16] even if they have good entropy? Is
[102:18] multisig going to become more important?
[102:20] Yeah. So, you know, hopefully you guys
[102:22] can start to answer these questions on
[102:24] your own. Single SIG is as secure as
[102:28] that one large random number. So, one,
[102:32] is the number large enough and random
[102:33] enough?
[102:35] Two,
[102:38] can you can you secure it? Can you keep
[102:39] it safe? And if the answer that I know
[102:42] Bitcoiners that have hundreds of
[102:45] millions of dollars of Bitcoin that have
[102:47] been securing their Bitcoin on a really
[102:52] large, really random number for over 10
[102:56] years, single SIG,
[102:59] it's very simple.
[103:01] It doesn't involve multisig and other
[103:03] software and potentially [ __ ] it up
[103:05] and all this. is my number was random
[103:08] enough and large enough and I can secure
[103:11] it. So, I'm good.
[103:15] I and I know plenty of Bitcoiners that
[103:19] are good there. Now, if you want to
[103:21] build redundancy to that, multisig has
[103:24] been growing in popularity with every
[103:26] year that's gone by because it builds
[103:29] that redundancy. Well, if one of these
[103:31] goes wrong, well, at least it requires
[103:33] two. So if someone steals one, they
[103:35] can't steal the money. If I [ __ ] up one,
[103:37] if I lose one, if I spill a drink on
[103:39] one, well, I'm good. And there two of
[103:43] three, three of five, so on and so
[103:45] forth, so on and so forth. So yeah, and
[103:48] now there's, you know, institutional
[103:50] collaborative custody where it's like,
[103:52] what if Strike holds one,
[103:54] another institution holds one, and
[103:56] another institution holds a third. So
[103:57] not only is it you need two keys, but
[103:59] you need two institutions to sign off
[104:01] and move your money. So, not only is one
[104:04] key compromised, but like one
[104:06] institution has to fail and not only
[104:08] fail, but like get hacked. And there's
[104:12] all sorts of ways to go about it.
[104:14] There's all sorts of companies that
[104:16] provide varying different services. But
[104:18] I don't want to say like single sig is
[104:20] dead. I know really OG, really competent
[104:25] Bitcoiners that are like, I know how to
[104:28] generate a really large, really random
[104:29] number. And people make fun of rolling
[104:31] dice, guys.
[104:34] I don't know. Like, I get that it's not
[104:36] a mainstream thing. I get that. It's not
[104:38] a mainstream thing. It's not something
[104:40] we can expect millions of people to do.
[104:42] Totally agree.
[104:44] But the question is, are you comfortable
[104:47] doing it? [ __ ] everyone else for right
[104:49] now. This is your life savings. This is
[104:52] your sovereignty. This is your ability
[104:54] to store the best money yourself. You
[104:58] have to find randomness that you're
[104:59] comfortable in in in trusting.
[105:02] And so I know a lot of
[105:05] really OG Bitcoiners that rolled dice
[105:11] 10 years ago and it's single SIG. They
[105:14] know how to protect a secret,
[105:17] whatever. They've got a safety deposit
[105:19] box. They've got guns. They've got
[105:20] whatever they got and they're good. They
[105:23] feel super secure. Because by the way,
[105:25] there's no silver bullet. For every
[105:27] institution you trust, they could [ __ ]
[105:29] something up. For every multi-IG, like
[105:31] any anything could go wrong.
[105:36] So, I don't know if that was helpful,
[105:38] but I know a lot of smart people that
[105:40] store bitcoins in so many different
[105:42] ways.
[105:44] I'm just very I'm very bullish that the
[105:46] space will continue to build tools.
[105:48] We'll continue to innovate. We'll
[105:49] continue everything is good for Bitcoin
[105:51] as long as we survive. If we survive, we
[105:53] get hardened and we get better for it.
[105:55] People learn more. People like me are
[105:58] going to be pushed to producing
[105:59] educational content. I mean, the level
[106:00] of guilt that I have that I spent so
[106:03] much time talking about the Fed and
[106:06] talking about like the straight horses
[106:10] and not enough about this stuff. Like, I
[106:12] need to get better at this stuff. I need
[106:14] to do more presentations on it. I need
[106:16] to make more short form content on it.
[106:18] Like, I just like [ __ ] man. Like so we
[106:22] we all become better for it if we can
[106:24] just survive if we can just no matter
[106:26] how dark it is just show up tomorrow and
[106:28] keep going.
[106:30] Um do we need to have a hardware wallet
[106:33] to make a new seed phrase using dice
[106:35] let's say ledger? No.
[106:39] See this is the thing guys a hardware
[106:41] wallet isn't needed to create this
[106:45] really large really random number.
[106:48] That's the thing people don't
[106:49] understand. PE the brand of hardware
[106:52] wallet has just like dominated what
[106:53] we're calling cold storage
[106:57] or self- custody.
[107:00] But it's not like these little devices
[107:03] are like uniquely capable of generating
[107:05] all these numbers. Not not the case at
[107:08] all. You can do it a million different
[107:11] ways.
[107:14] So
[107:17] um but yeah like yes le L le L le L le L
[107:19] le L le L le L le L le L le L ledger the
[107:20] the question ended like ledger question
[107:22] mark sure ledger treasure but there's a
[107:25] million different ways to do this and
[107:27] you know I I will try and start putting
[107:29] together the different ways and how they
[107:31] work and the trade-offs and what they're
[107:33] solving for and at the end of the day
[107:35] ultimately it's your choice and so like
[107:37] let's talk about BitKey for example
[107:39] which I still think for like someone
[107:41] who's fairly beginner who's in between,
[107:44] I'll just keep the coins on strike for
[107:45] now. I trust Jack to oh, I actually
[107:48] want, you know, some level of quote
[107:50] unquote self-custody and and ownership
[107:52] of my coins. The key is great. Why the
[107:56] keys multi-y
[107:59] key keys fail gets compromised, so on
[108:01] set and so forth, like you're good. Got
[108:04] the other two. So, there's some
[108:06] redundancy there. And the user
[108:08] experience is a little bit more
[108:10] mainstream. You get this device, it
[108:11] feels like an Apple product when you
[108:13] open it. You got an app that pairs with
[108:14] it. It's designed by Dorsy that he's got
[108:17] great taste, great design. Um, always
[108:20] been good at both hardware and software
[108:22] engineering.
[108:24] So, different different trade-offs,
[108:26] different products. It just really
[108:27] depends. But do you need a hardware
[108:30] wallet to create like a root secret to
[108:33] participate in the Bitcoin network? No,
[108:35] you don't. Actually,
[108:38] I remember way back in the day. Let's
[108:40] see if this website still exists.
[108:43] Put you guys on.
[108:45] Uh,
[108:49] there used to be,
[108:51] yeah,
[108:53] here, let me share this. So, there used
[108:56] to be a website and it still exists,
[108:58] bitress.org.
[109:00] And so, watch this.
[109:04] First of all, I'm going to create a
[109:05] wallet right in front of you guys. Don't
[109:07] use it, obviously. Okay, please.
[109:11] Um, so this is how this So, you can see
[109:14] bitress.org or open source JavaScript
[109:16] client side Bitcoin wallet generator.
[109:17] So, it's going to generate a Bitcoin
[109:19] wallet for us. And you're like, Jack,
[109:20] what do you mean? Don't you need a
[109:21] hardware wallet to do that? No. I'm
[109:23] telling you guys, no. That's not how
[109:25] Bitcoin works. We got to get back to
[109:27] understanding. It's all about generating
[109:28] one really large, one really random
[109:30] number. So, how does it do that? What's
[109:32] it say right here? Here it says, "Move
[109:33] your mouse around to add some extra
[109:35] randomness or type some random
[109:38] characters into this text box." So, I'm
[109:41] going to start moving my mouse around.
[109:43] And do you see it's creating the really
[109:45] large, really random number? And you're
[109:47] like, "What do you mean?" Well, it's
[109:49] taking the movement of my mouse on the
[109:51] screen and basically the randomness is
[109:53] derived from, well, what are the odds
[109:55] that someone is going to move to the
[109:57] pixel the exact amount that I've moved
[110:00] my mouse? And if you do the math on the
[110:04] size of the screen and the pixels and
[110:05] the potential ways I could have moved my
[110:08] mouse, it's probably pretty [ __ ]
[110:09] random. And it's at 39%. So what's it
[110:12] what it's saying right now is this isn't
[110:14] quite random enough. Like if we were to
[110:16] stop here,
[110:18] you wouldn't you wouldn't feel
[110:20] comfortable enough with the randomness
[110:22] of this number. So keep going. So, I
[110:23] keep going and I'm moving my [ __ ] around
[110:25] and then I go in here and I start
[110:28] quacking on my keyboard and it's just
[110:30] random, random, randomness, randomness,
[110:32] randomness. Look at all this randomness.
[110:34] We're random. Boom. It hit what it
[110:37] considered enough randomness.
[110:40] Here's the secret that obviously if I
[110:42] were to use this, I shouldn't share with
[110:44] you guys. And here's the public part
[110:46] that I could say, "Yo, send some
[110:47] bitcoins here." And then as long as I
[110:49] kept this part secret, I just generated
[110:51] a large enough and random enough number
[110:54] to have a Bitcoin wallet. Did I need a
[110:55] ledger to do that? No.
[110:59] Back to basics, guys. Self-custody is
[111:01] all about can I generate a large enough,
[111:04] random enough number, and can I protect
[111:06] it? That's it.
[111:09] I continue to say it. If you want the
[111:12] most auditable, most reviewed codebase,
[111:16] just get a machine, plug it in,
[111:21] set, let Bitcoin Core sync to the
[111:23] blockchain, create an address, unplug
[111:26] the machine, turn that [ __ ] off, send
[111:28] the Bitcoin to the address, you're good.
[111:30] Bitcoin Core gets reviewed by like
[111:33] Bitcoin Core is the most one of the most
[111:34] popular code bases in the world. It's
[111:37] been reviewed by everybody like all day,
[111:39] every day. But boom, I just created a
[111:42] really large, really random number and I
[111:44] didn't need a hardware wallet. So a
[111:46] hardware wallet is one way to do it. And
[111:49] it's good because you know it's offline
[111:51] and and right like you need to protect
[111:54] the information that it generates from
[111:57] attackers and so you don't want it to be
[111:59] on the internet and you know it hardware
[112:02] wallets are are not bad. They have
[112:04] features, but I think people often think
[112:06] too synonymously of like, oh, cold
[112:08] storage and self-custody means hardware
[112:10] wallet. No, it doesn't.
[112:13] Just tr truly understand it's about
[112:15] creating a large random number and then
[112:17] protecting it.
[112:21] Hopefully that was uh useful.
[112:25] Um,
[112:26] okay. Oh [ __ ] I just realized my screen
[112:30] was protecting
[112:33] my whole demo.
[112:36] Oh wow, that was so dumb. Okay, well I'm
[112:40] not going to take all the time. Here,
[112:42] here. Here.
[112:45] Sorry.
[112:47] Saw guys. Si
[112:50] hold on.
[112:53] Uh, okay. Hold on.
[112:56] It's called bit address.org.
[113:01] Do you guys see what it says here? Move
[113:03] your mouse around to add some extra
[113:04] randomness. And so when I move my mouse
[113:07] around, do you see that it's generating
[113:09] this really large really random number?
[113:12] See that?
[113:15] That's enough randomness. And then I I
[113:17] can even click clickity clack on my
[113:20] keyboard. Boom.
[113:23] There's my Bitcoin wallet. So, sorry you
[113:26] got the audio version first and the the
[113:28] spun uh sped up. Uh, now obviously do
[113:32] not use this Bitcoin wallet.
[113:43] Do you guys see that? I'll do it one
[113:44] more time. It doesn't have a wallet yet
[113:47] because I haven't done enough
[113:49] randomness. It says move your mouse
[113:50] around to generate some extra
[113:51] randomness. Move, move, move, move,
[113:53] move, move, move, move, move, move.
[113:55] Random, random, random. Clicketity
[113:57] clack, clickity clack, clickity clack,
[113:59] clickity clack. Random, random, random,
[114:02] random, random, random, random. Boom.
[114:05] It does not need to be a hardware
[114:06] wallet.
[114:14] Now, also to be clear, don't use this
[114:17] wallet. I would not recommend using
[114:18] bitaddress.org. Don't do that.
[114:22] Um, there are way better ways. Like,
[114:24] like I said, I'm a Bitcoin core guy. Uh,
[114:29] Bitcoin Core is really great
[114:32] audit. Like, like I said,
[114:37] Bitcoin Core is one of the most
[114:39] reviewed, but then you're going to have
[114:41] to keep the laptop safe. So, you
[114:44] shouldn't use Bitcoin Core to store your
[114:46] life savings with the laptop that you're
[114:48] taking through the airport and stuff.
[114:49] But you could buy a machine, download
[114:51] and run Bitcoin Core on the machine,
[114:54] create an address, take it off the
[114:56] internet, store it in a vault or
[114:58] something, and then just periodically
[115:00] send Bitcoin that you're stacking to
[115:01] that address. And there you've got like
[115:03] software that has been audited and
[115:05] reviewed like arguably more than any
[115:08] other codebase in the world.
[115:11] I don't recommend bitress.org, but that
[115:13] was just a good way to kind of
[115:15] visualize.
[115:16] You know what I'm saying? You guys get
[115:18] it. I hope uh thanks Jack for all that
[115:21] you and your team has done to help
[115:23] during the stressful time. Quick
[115:24] question, how do you suggest calling out
[115:26] blind spots in the Bitcoin space and
[115:28] avoiding group thinking?
[115:30] Um
[115:32] this is kind of why the meme of like
[115:34] being a toxic Bitcoiner is never
[115:36] considered a bad thing. Um I think
[115:39] Bitcoin bare markets are inherently
[115:43] humbling. They're full of humility. um
[115:47] heroes are slayed. And so you have to
[115:50] Bitcoin is the money of humility. It is
[115:53] it's the money, you know, where you
[115:55] where you're like, wait, we're not meant
[115:57] to central plan the universe. We're a
[115:58] child of the universe and you know, I
[116:01] have to accept what comes with that that
[116:04] I'm not in control. So it's the money of
[116:06] humility in that respect. And uh I think
[116:09] these bare markets are all about
[116:11] humility, learning, uh being secure,
[116:14] planning for the whatif scenarios. uh
[116:16] and
[116:18] um Bitcoiners remaining vigilant and
[116:21] don't trust verify and taking that to
[116:23] heart. Clearly there was too much trust
[116:25] in cold card and not enough verifying.
[116:28] Um so I and and every single time that
[116:31] we
[116:32] um as a community go through tough
[116:34] times, as long as we survive, we're
[116:36] better off for it. And I can't speak
[116:39] obviously for the independent victims.
[116:40] Hopefully, we can raise a bunch of money
[116:43] or we can get the we can catch the the
[116:46] thief and get the stolen Bitcoin back.
[116:48] You know, I can't speak independently to
[116:51] everyone's in independent experience and
[116:54] whether they're better off for it, but
[116:56] um as a community and as an asset class,
[116:58] we're better off for it if we can just
[117:00] survive.
[117:01] Uh thoughts on Coin emailing customers
[117:04] warning them of a security flaw and what
[117:06] to do given that they've always claimed
[117:07] they didn't retain customer info? Yeah,
[117:10] I don't know much about that to be
[117:11] totally honest. I saw that kind of past
[117:13] my timeline. I didn't look too much into
[117:15] it. I mean, you know, the optimist in me
[117:20] would like to think that they were only
[117:21] able to reach out to recent customers
[117:23] because I think their policy said that
[117:24] they delete customer info after 3
[117:26] months, but I didn't look into it and
[117:29] obviously I don't think anyone should be
[117:32] trusting that their word. So, I don't
[117:34] know.
[117:37] Uh, can you confirm that using a dice
[117:39] rolled private/pubkey pair on a cold
[117:42] card would be fine? Then it would only
[117:44] be a signing device, not using the key
[117:46] generator. Yeah, but it all comes down
[117:50] to like sufficient randomness. So, for
[117:53] example,
[117:55] like do you have high quality dice? I'm
[117:58] not kidding. Like obviously if you had
[118:01] dice that only had the number one on it,
[118:04] then you know it wouldn't be that good.
[118:06] Or if you had dice that had like a chip
[118:08] on it, so like it actually ended up
[118:12] falling on one or two numbers more
[118:14] frequently than other, then you'd have
[118:16] less randomness than otherwise, but
[118:19] probably still enough randomness to be
[118:21] secure. So it all comes down to the
[118:24] quality of your randomness. And you're
[118:25] never really going to know for certain.
[118:28] But and the other thing of like, well,
[118:30] why didn't anyone else attack cold card
[118:33] and catch this earlier? Well, because
[118:35] nobody had found out that they were only
[118:38] using 40 bits worth until recently and
[118:41] then it took the attacker that. But once
[118:44] the attacker realized like, holy [ __ ]
[118:46] like I they did not use near near enough
[118:50] randomness. Um so it's it's also Yeah.
[118:54] So uh yeah, I think 100 plus dice rolls
[118:58] um in theory is is plenty uh entropy.
[119:03] So the answer would be theory. Yes. But
[119:05] I wasn't there while you were rolling
[119:07] the dice and I don't know what dice you
[119:09] used, right? So just keep that in mind.
[119:12] It it's it's just all about the quality
[119:14] of your randomness. So I I can't The
[119:17] question is can I confirm
[119:20] I could tell you that? Yeah, for sure.
[119:22] In theory, yeah, that like 100 plus dice
[119:25] rolls is you know sufficiently random.
[119:27] Yeah, but just keep it in mind like
[119:30] security doesn't work that way. Can I
[119:32] confirm?
[119:34] Yeah. Uh, I sent everything from my, uh,
[119:38] Ellie Pal cold storage back on strike. I
[119:40] think I'm going to leave it on strike
[119:41] moving forward without bias. What are
[119:43] your thoughts on this move? Yeah, I
[119:45] mean, listen guys, that's totally fine.
[119:47] Like, strike is secure, safe, and like I
[119:50] said, you know, we're take I'm taking a
[119:53] look at our road map personally and
[119:56] seeing what we should move up when it
[119:58] comes to security and custody. Should we
[120:01] just start to I mean there are in some
[120:03] instances I mean our I won't again I
[120:06] won't talk too much about our stack but
[120:07] we do collaborative custody in some
[120:09] instances like we can productize that
[120:12] there's certain features where we can
[120:14] make like
[120:16] there's there's different things we can
[120:18] do but even as it is today I mean strike
[120:20] is extraordinarily secure and safe I
[120:22] store like a a lot a lot of bitcoin on
[120:25] strike um if it's meaningful to you guys
[120:29] to know that I have a ton of Bitcoin on
[120:32] strike. So, um it's up to you. There's
[120:36] no right way to do it. Like, should you
[120:38] use single sig? Depends what you want.
[120:41] Should you use multisig? Depends what
[120:42] you want. Should you use strike? If you
[120:45] if you trust me and us and our ability
[120:48] to generate large random numbers and
[120:51] secure them, then yeah, of course, no
[120:54] problem. Just understand the decision
[120:56] you're making. No right answer.
[120:59] Obviously, I think over the long term
[121:02] people, it's it first of all, it's
[121:04] incredibly important that you can
[121:06] self-custody. Like obviously making it
[121:09] as accessible as possible and ensuring
[121:13] that people can enact that and that a
[121:16] certain percentage of people do is
[121:18] critically important to the future
[121:20] success of Bitcoin. But, you know, if
[121:23] someone I I said on the Natalie Brunell
[121:25] podcast, like
[121:28] I'm much more personally interested in
[121:32] the fact that nobody even vaguely
[121:35] understands money. Like when people say,
[121:36] "Oh, Bitcoin has been adopted by 1% of
[121:38] the world." No, it hasn't.
[121:41] That's 80 million people. 1% of 8
[121:44] billion is 80 million. You think 80
[121:46] million people have a vague
[121:47] understanding of anything we talk about
[121:49] on this show? You're [ __ ] crazy.
[121:52] I wouldn't even think eight million
[121:54] people kind of understand that money is
[121:57] an abstracted form of time and energy
[121:59] and that printing money is an affront to
[122:01] human dignity and that Bitcoin solves
[122:04] core monetary principles in the most
[122:07] important information system in human
[122:10] history. People don't understand that
[122:11] [ __ ] And so I would much rather someone
[122:15] truly understand what money is and what
[122:19] Bitcoin's role in money is, but like,
[122:22] oh, because they're a fund manager, they
[122:24] they have to own the ETF for now. I'm
[122:27] much more okay with that, to be honest,
[122:29] than having someone have Bitcoin
[122:32] exposure through a proxy, through a
[122:33] proxy, through a proxy, through a
[122:34] securities rapper like then.7% to their
[122:38] 401k is in Bitcoin. Like, what the [ __ ]
[122:40] That's not adoption.
[122:42] I consider it's much more adoption
[122:44] someone like I get money. I understand
[122:47] the affront to human dignity that fiat
[122:50] currency is and that Bitcoin solving
[122:51] that and right now I'm only comfortable
[122:54] or I can only or my fund uh mandate is
[122:57] only this IBIT thing or whatever or or I
[123:00] I'm going to keep it on strike for now.
[123:01] But I get it. I get it and I'm I'm
[123:03] listening to your show Jack and I'm
[123:05] looking forward to the products and I'm
[123:06] looking forward to self custoy in the
[123:07] future. Like I'm much more that's
[123:10] adoption for me. You know what I mean?
[123:14] So, no, if you want to use Strike, use
[123:16] Strike. That's why I built it.
[123:19] That's why I built it, guys. And we'll
[123:21] work on it. We'll produce content.
[123:23] People And by the way, it's not always
[123:25] about Strike. People will build more
[123:27] tools. Like, it's it's what is it?
[123:30] Rising tide lifts all boats. Like, we'll
[123:33] keep building. We'll keep building.
[123:35] We'll do it right. We'll open source
[123:36] everything. Strike will share how we use
[123:39] AI to test all of our all of these code
[123:41] bases. And it's not just our codebase.
[123:43] We're testing all of the open source
[123:44] Bitcoin code bases that we use because
[123:46] our security is only as good as the
[123:48] other open source code bases we use.
[123:50] Right.
[123:54] Um can you please go into some detail
[123:56] about strikes custody, security, proof
[123:58] of reserves, audit, etc. Yeah. So, uh, I
[124:02] kind of touched on it a little bit
[124:03] before, but, um, we use multisigg, um,
[124:07] geographically distributed multisig. Um,
[124:11] our systems are very safe, secure.
[124:13] There's some part of our stack also do
[124:16] collaborative custody. Uh, which I think
[124:18] is interesting. That's about as much
[124:21] detail as I'm comfortable to go in for
[124:23] now, but you know we we custody it
[124:27] ourselves like we generate have the keys
[124:31] secure
[124:34] and um what else did you write? Yeah, we
[124:36] also get audited. We provide proof of
[124:39] reserves for our lending uh product
[124:42] right now to be honest. Um, I know some
[124:46] other Bitcoin companies have done proof
[124:48] of reserves and,
[124:51] you know, not like
[124:53] uh mad or thrilled about it. I think
[124:56] it's cool, but our customers are like, I
[125:00] don't know, I I need to borrow against
[125:02] my Bitcoin or I need you guys to get in
[125:03] Europe. And so it actually, you know,
[125:06] despite some like sometimes on Twitter
[125:09] is a very loud minority, but so despite
[125:12] like a lot of voices on Twitter, it
[125:14] actually wasn't like a really top
[125:16] request until obviously the last 48
[125:19] hours. People are like, "Hey, can you
[125:21] take a look at that again?" And that's
[125:22] what we're doing. So whether it's proof
[125:24] of reserves, different uh variants of
[125:27] custody products that we can offer, all
[125:29] of the above. Um we're taking a closer
[125:32] look, but um any other specific
[125:35] questions about our custody I could
[125:36] potentially answer. Um audit, we're
[125:40] audited. Yes. Um and we do provide proof
[125:43] of reserves for our lending book and
[125:45] taking a closer look at that.
[125:48] Um
[125:50] uh question for Jack. Would Shrek ever
[125:52] create your own cold storage wallet?
[125:54] Obviously with the recent loss of trust
[125:56] and what was the best wallets in cold
[125:58] card? Could you fill the need? Maybe.
[126:00] [snorts] And I So here's the thing. When
[126:02] you say cold storage, I think you're
[126:04] using that synonymously with hardware,
[126:07] which I'm I'm trying to explain to you
[126:09] guys is not the case. So can Strike
[126:12] build cold storage product like a
[126:13] multisig product or a
[126:14] multi-institutional
[126:16] collaborative custody product? Yeah,
[126:18] 100% we could do that. In fact, we've
[126:21] built so much of that for ourselves
[126:23] internally that we can expose it and
[126:26] productize it. We're going to take a
[126:28] closer look at that for sure. Um,
[126:31] but uh do do we want to get in the
[126:34] business of hardware? I'm not sure about
[126:36] that. I'm not so sure about that. And
[126:40] I'm not so sure that a hardware wallet
[126:41] is going to solve everyone's problem.
[126:43] I'm trying to tell you guys a hardware
[126:45] wallet does some stuff,
[126:48] but it it like it isn't the solution for
[126:50] everybody.
[126:52] I just generated a Bitcoin wallet in
[126:54] front of you guys in my browser. You
[126:56] don't need a hardware wall. I think that
[126:57] the branding for hardware wallets been
[126:59] like so successful in many respects that
[127:03] people don't understand what is going on
[127:05] under the hood. It's really simple. Big
[127:08] large random number. There's a lot of
[127:11] ways for us to ensure and help people
[127:15] create those or create multi-IG that
[127:18] people can use between different
[127:19] institutions. There's like all sorts of
[127:21] stuff I'm thinking about.
[127:24] Uh, hey Jack, when will strike make its
[127:26] way to Canada and what's the holdup? Um,
[127:29] we will be in Canada in my best guess is
[127:32] early 2027. We're actually we've been
[127:34] working on Canada this whole year. The
[127:36] holdup is all the licensing and
[127:38] regulatory approvals that are required.
[127:40] So, we're just chewing through that. It
[127:41] takes it's a 12 to 18month process to go
[127:44] from, hey, I I think I want to do Canada
[127:46] to paying money, hiring people, filling
[127:49] out all the paperwork, working with the
[127:51] regulators, um actually like changing
[127:54] our software to what the regulators say
[127:57] like, "Hey, we need you guys to display
[127:59] this this way." So, it just
[128:01] unfortunately it's not that easy or else
[128:04] everyone would do it. Um, but uh we've
[128:07] already started. We're well into the
[128:09] process and hopefully we are months
[128:12] away.
[128:16] Uh, oh my god, I just realized I'm not
[128:20] even remotely close to finished to get
[128:23] through all of these.
[128:27] Wow.
[128:29] Uh, and we're over two hours.
[128:35] Wow. I thought that was the last
[128:36] question. There's at least
[128:40] 50 to 100 more.
[128:48] Um,
[128:51] yeah. So, I'm just going to summarize
[128:54] these. I see a lot of you guys want
[128:56] strike custody products. You want
[128:58] multisig, a vault, some type of
[129:00] self-custody product feature. And uh
[129:03] we're taking a close look at it. I I
[129:05] swear we are. I I actually was working
[129:07] on it this weekend. So we're taking a
[129:10] look at it and uh I'll get back to you
[129:13] guys with any concrete plans. Obviously,
[129:15] this all is happening so fast. So
[129:17] there's nothing like in the super
[129:18] immediate. And I do want to see where
[129:21] the demand normalizes like what people
[129:23] actually want, what type of vision I
[129:26] actually have, how important certain
[129:28] features are. But um I'm all ears and I
[129:30] I want your guys feedback. Just tell
[129:32] tell me what you need to feel safe. Um,
[129:36] I'm trying to summarize here.
[129:42] Yeah, I think I'm going to call it here.
[129:46] Uh,
[129:50] I think I'm going to call it here and
[129:52] and try and summarize.
[129:56] Oh, yeah. This one from Liberty Mugs,
[129:59] who I who I love. Uh, how does code
[130:01] review on Bitcoin Core compare to any
[130:03] given wallet and how does that affect
[130:04] security? Yeah, hopefully I made that
[130:06] pretty clear. I mean, one of the
[130:09] takeaways is that there just wasn't a
[130:11] lot of eyeballs on Cold Card's firmware,
[130:14] at least enough. No one was able to
[130:15] catch this. And uh, again, I think one
[130:18] of Bitcoin Core's strongest selling
[130:20] points is it's the most reviewed
[130:22] codebase like in the world, maybe. I
[130:25] mean, I I don't want to make that claim
[130:26] repeatedly. I don't know if that's true
[130:27] or not, but it's up there.
[130:32] Um,
[130:33] so, okay, I'm I've got these documented.
[130:37] I just think any longer of a show is
[130:39] just unreasonable. Um, like my throat's
[130:42] starting to hurt. So, I'm going to uh
[130:46] work with Dylan to load these up for the
[130:48] next episode. We'll try and if there's
[130:51] because I don't know how many of these
[130:52] are repeated, how many of these can be
[130:54] answered with the same answer. So, I'll
[130:56] stop for now. Um, and uh,
[131:01] and I'll try if these are all on Twitter
[131:04] or DMs and stuff while I'm eating dinner
[131:06] tonight, I'll just try and chew through
[131:08] these and maybe it won't be answered on
[131:09] the show. Maybe it'll be answered uh,
[131:13] via DMs and stuff. And if there's, like
[131:16] I said, repeated themes or consistent
[131:19] um, questions, then hopefully next
[131:21] episode I can answer it. But um yeah,
[131:24] with that, hopefully you guys, uh
[131:27] learned something this episode.
[131:29] Obviously, a new one, a little bit dark
[131:31] of a time for Bitcoin. I'm so sorry for
[131:35] anyone impacted and affected by this.
[131:37] And I'm really sorry that cold card was
[131:39] was within my lexicon of wallets that I
[131:42] thought was reasonable at generating
[131:44] these large random numbers. Hopefully,
[131:46] you guys understand what it means to
[131:48] secure Bitcoin from a very high level.
[131:50] At the end of the day, you got to just
[131:52] create a really large, really random
[131:55] number and take care of it. And you can
[131:57] build redundancies with multi-ig and key
[131:59] sharding. You can engage with companies,
[132:02] whether you trust them outright and use
[132:04] something like strike or you want some
[132:07] type of collaborative custody or
[132:08] multisig. There's so many different ways
[132:10] to do it. Um,
[132:13] please give me feedback, ask questions,
[132:16] um, direct me towards content that would
[132:18] be valuable to you guys or valuable for
[132:20] you to share with others. Um, I'm going
[132:22] to think long and hard. Obviously, a lot
[132:24] of this is raw. I got home from the
[132:27] wedding really late last night and I I
[132:29] mean, I didn't have too much time to put
[132:31] together this presentation. I hope it
[132:32] was it was valuable. Um, this was all
[132:35] just like off the top of my head here.
[132:37] Um, so with with time uh and feedback,
[132:42] I'm I'm really interested in making some
[132:44] highquality content for you guys to just
[132:47] grow education, understanding, and and
[132:49] ultimately adoption.
[132:53] Um, and while building products, that's
[132:55] the one unique thing is I'm going to
[132:57] both try and educate and build at the
[132:59] same time.
[133:02] Okay. Well, I love you guys, man. Um,
[133:09] yeah, chin up. It it it's it's all just
[133:12] large random numbers. We'll be okay. We
[133:15] can generate those. We can secure those.
[133:17] 99%
[133:19] of
[133:21] achieving anything is just showing up.
[133:24] Just showing up. No matter how hard the
[133:27] day was or the last month was or the
[133:29] last year was, just show up. Show up
[133:32] tomorrow and keep going. Um, I promise
[133:35] you that's 99% of the job is just keep
[133:40] your chin up and show up. And so as long
[133:43] as we all keep showing up and we Bitcoin
[133:46] is an idea that's just far too strong
[133:48] for us to give up on. It's the idea that
[133:51] has reached enough adoption to have a
[133:54] pulse of its own. And I'm never going to
[133:56] give up on this idea. And I know so many
[133:59] of you aren't either. So, we wake up
[134:01] tomorrow, we show up, and we keep
[134:03] pounding pavement and chopping wood for
[134:04] this idea. Doesn't matter how long it
[134:07] takes us. And it doesn't matter how we
[134:08] get there. But, you know, the idea that
[134:11] Satoshi instilled and and propagated is
[134:14] strong enough to have a life of its own.
[134:16] And we and and that's the one job we all
[134:18] share. Just keep [ __ ] showing up.
[134:20] Show up for the Bitcoiners beside you.
[134:22] Show up for the people that are hurt.
[134:24] Show up for the people that don't know.
[134:25] Show up for Just Show up. Just show up.
[134:28] That's the culture.
[134:32] So, I'll keep showing up for you guys,
[134:34] man. I really will. And um I appreciate
[134:38] you guys. Leave all the feedback. Tell
[134:40] me what content to make. Tell me what
[134:41] features to build. Uh one team, whether
[134:44] you're a customer or not, just let me
[134:46] know how I can help. Talk to you guys
[134:48] later.