Hello to the public of crypto Noticias, we're going to be here in Trustless by Design,
the conference organized for Trezor to reveal their new hardware wallet.
We're here with Jameson Lopp, he's co-founder of Casa, a security company,
and he's one of the people who has most followed the physical attacks of Bitcoiners,
and we're going to talk a little bit about it.
Hello Jameson, how are you?
Not bad, not bad.
I wanted to ask you, as I said to you before,
you've been the person that has been following more and keeping record of the
growing cases of physical attacks to Bitcoiners.
What are your general thoughts about this growing trend?
It's still an edge case, you know, a total number of people who have been attacked are
a couple hundred that we're aware of. There are probably, you know, another several hundred that
we're not aware of, but, you know, that's a tiny portion of everyone who is in this space.
And it's like you said, it's more about the trend.
The trend is going in the wrong direction, which is up.
And so this year we're already at an all time high where I want to say 53 attacks that I've
cataloged so far this year.
And it's probably going to keep getting worse before it gets better.
And this is concerning because it's sending a signal to the rest of the world that wrench attacking a Bitcoin holder is probably going to have a good payoff because most of these attackers are successful.
Thankfully, a lot of them do eventually get caught, but not all of them.
And the ones that are successful in many cases get away with a lot of money, sometimes millions of dollars worth.
That can grow in time as well if they hold.
Yes, we don't really know yet whether or not these attackers are going to be holders.
I think that in many cases, it's it's more you're like common street criminal that's happened to learn about Bitcoin rather than like a Bitcoin or who's decided to become a violent criminal.
But I get it.
So you you think that for now it's just a marginal thing that it's going on.
They're just a but growing.
So and the growing part is maybe what it's a becoming concern a concern through Bitcoiners, but there's still nothing to worry about there in there.
Well, you have to you have to understand what puts you at greater risk of being attacked and actually what you and I are doing right now is not very helpful.
We are currently we're making public information and we're putting ourselves out there as we are, you know, in the Bitcoin space.
So, you know, for people who are public about being a Bitcoiner that puts you in a high risk category.
If you are doing face to face trades, that is a very high risk thing where a lot a lot of the trades are a criminal who is basically,
you know, coercing a victim to meet them and then they just rob them.
You know, there's nothing really novel about that.
You know, that type of robbery has happened for as long as people have been doing trading, right?
And then, you know, if you are if you're flexing your wealth, if you're flaunting, you know, luxury on social media, that that can also make you a big target.
Yeah, definitely. But at the same time, I have been wondering maybe the reason why it's becoming a growing trend.
This physical attacks, this range attacks is because people still perceive the Bitcoin and Bitcoiners as someone special as if you hold Bitcoin, you are probably a millionaire.
That's kind of the math that goes through the head of these people, I assume.
So at the same time, maybe going public and spreading information about Bitcoin to made it like a normal thing, like just having regular money, regular fiat money.
Do you think that will, like, could mass adoption help to minimize physical attacks?
It depends on the security practices of people, which I am pretty pessimistic about, right?
Okay.
Being in the security space for a decade, most people have terrible security practices.
And so even even regardless of whether or not they're doing self custody, to be clear, you're not at any greater risk of self of this type of attack.
If you're using self custody, there are plenty of people who have been wrench attacked who left all their money on the exchange and the wrench attacker just said, okay, open the exchange app and do a withdrawal.
You know, it's effectively the same thing.
Whenever you have a single point of failure, if you yourself can easily transfer large amounts of your wealth, then you should be reevaluating your security posture.
Because that is effectively what happens with a wrench attack is that you become compromised and, you know, you can then be forced to hop through whatever security and authentication mechanisms that you have.
And so if it's possible for you to authenticate and, you know, send a substantial portion of your Bitcoin very quickly, then an attacker can do the same thing if they're pointing a weapon at you.
So this is where you, you actually have to put access to your cold storage, your long term savings, you have to put it outside of your immediate control if you want to protect yourself from this attack.
And how will that work?
Like hiring some custody company or something like that?
There's multiple ways that you can do it, right?
So a lot of people, because people tend to go for the most convenient option, a lot of people are like, oh, well, you just buy the ETF and you can't be wrench attacked.
And I'm like, sure, you're also giving up like the most important aspects of this ecosystem by leaving your money with a trusted third party.
But, you know, also, you know, if you're using some sort of custody provider, then a lot of them have ways for you to place like velocity limits or lock down your account and require additional authentication.
But of course, I'm a self-custody proponent, and I would recommend that you put your storage into a distributed setup where you have multiple keys that are geographically spread around that requires some level of travel.
And this is where it can get very complicated or flexible in the sense that you have to make decisions about this.
Because of like, to give the extreme example, we have clients who keep keys in different countries, sometimes different continents, especially stored by a by Casas or by a specific company or like how we could you yourself without hiring anybody distribute your your keys in different places?
Well, so this comes down to, you know, what do you have access to, so for the really wealthy people, maybe they have homes in multiple different countries, or maybe they have friends and family in different countries that they visit every once in a while.
But in many cases, you can hire someone, and it doesn't have to be a like Bitcoin specific company, it could just be some sort of safety deposit box.
And if you were doing that with a single signature wallet, we would not recommend, you know, putting your seed phrase in a safety deposit box, because of course, it could get opened up by law enforcement or an employee or whatever.
But if it's only one key out of a multi-sig, then it's not a big deal, because one key being compromised doesn't result in loss of all of your funds.
But the travel portion is important because a big aspect of security in general is just introducing friction to slow down an attacker.
And especially if you go to the level where you have to pass through some sort of border control checkpoint, then obviously an attacker is not going to be able to walk through a highly secure area with you, you know, under their control as a hostage.
But probably, I mean, there is still the possibility of coercion in which I could kidnap you and your family and say, I wouldn't liberate you, I won't release you until you call someone and tell him.
Yeah, so that is a separate problem of coercion where you yourself are not being held hostage, but someone you care about.
And there is no technical solution.
There is none.
They can do anything for that.
Well, you know, the technical solution there is physical security for everyone that you care about.
But, of course, that can get very expensive.
And, you know, I believe that actually that is what happened when the Ledger co-founder was kidnapped, is that they weren't trying to extract his money.
I think they were trying to get the other Ledger co-founder to pay the ransom.
And so you saw the solution there was you get law enforcement involved.
Yeah, definitely.
And I was thinking about this also, like the emergence of Glock, this Elena Branova new company that provides physical security, not provides physical security, but like tries to solve this problem of physical attacks.
Do you foresee, do you think this is somehow helpful or do you foresee that it's going to be a thing, a problem to need to be solved in the space?
Like learning how to fight a kidnapping or something like that?
I mean, I think it mostly will come down to the trend of, you know, if the attackers continue to be successful most of the time and the signal that keeps being sent from the Bitcoin community is that it's a very profitable activity to attack us.
Then yes, I think it's going to become more important to have that level of physical security on an optimistic side.
If we're able to stop more of these attackers and they're not able to get away with a lot of money, then that could reverse the trend.
If people, you know, criminals start to realize, you know, actually these Bitcoiner folks tend to have really good security and I probably won't get a lot of money by attacking them.
But like I said, I'm kind of pessimistic.
So you believe that the best solution is to add friction, no, like to, because also law enforcement could act more like the criminals are, Lunatico said this to me a few hours ago, are like entrepreneurs which are risking as well while doing that kidnap.
And you have to, you have to, you have to, you have to, you have to, you have to, you have to, you have to add, like, increase the possibility of they being trapped.
So maybe friction is what can do this and, uh, uh, uh, yeah.
So this instant, this instant device, the, the kidnapping or the physical attacks.
Yeah.
So, you know, there's, there's multiple layers to security, but in general, I tell people, um, you know, you should think of privacy as your outermost layer of security.
So if you have strong privacy, you're not going to get targeted in the first place.
Um, and, uh, strong privacy is a lot cheaper to implement than strong physical security level of the sense that makes sense.
Yeah.
So what, uh, privacy, uh, recommendations will you give to our audience right now to do a safe on on security?
Yeah, well, I mean, the big one is don't associate your real name and face with being a Bitcoin holder.
Um, but if you want to be a public advocate for Bitcoin and be doing like what we do going around to conferences, uh, talking publicly, uh, that's when you need to go down the, the rabbit hole of figuring out how do I harden myself?
Um, so that it's difficult for people to find where I live, to find where I sleep at night.
Um, because if they can find your residence, then that's what opens up, uh, home invasion, uh, generally being surveilled to figure out what your day-to-day patterns are to try to figure out where are you most vulnerable to being kidnapped?
You know, they're, they're, uh, for example, there was a CEO in Canada who he didn't have a home invasion.
He actually got kidnapped in the parking garage as he was leaving his office because I guess they surveilled him and figured out that's where he was the most vulnerable.
Um, so there's also many other things that you can do from a technical perspective, but, uh, legally, it really depends on the jurisdiction in which you live.
Um, I've, I've spoken about this at length, like in the United States, we have a lot of legal ability to create things like trusts and corporations to hide the ownership of assets to like hide your home and the ownership of, of your real estate and your cars and stuff like that.
Um, otherwise you might have to forego owning, you know, publicly registered property, you know, perhaps it makes more sense for you to rent rather than to own something.
If that means that you're, you're, you're not creating records, but a lot of other records get created in many cases, um, just like with your utility bills or, you know, paying for television, uh, and water and whatnot.
And so if you can put those into the name of either someone else or, or, or a corporation or something, um, you know, prevent that information from getting out there into like all of these databases that then will resell it and make it very easy for people to find you.
Um, but, uh, but, uh, it really becomes a lifestyle because there's many different things that you have to deal with, uh, to prevent information from leaking.
And as a default, like if, if you just sort of go through the default lifestyle for the average person, you leak a ton of information.
Yeah.
And then it's already leaked, no, like you, you, you can adjust, uh, unlinked it.
Yeah.
So when, you know, when I went down that path after I got swatted, um, I, I had to basically walk away from my entire life.
I had to sell all of my publicly registered, uh, possessions and I had to set up a bunch of legal entities and then, you know, purchase new property that was all, you know, under the umbrella of the legal protections.
And, and also I had to get very comfortable with lying a lot, um, with not telling people my real name.
That took a few years to, to get used to, to, uh, basically realize that it's, it's, it's ethical to lie to people.
If you're doing it to protect yourself and you're not trying to do it to deceive or defraud the other people.
So James, well, that's the, the tricky thing is Jameson Lump is my real name.
So I have to have other names for when I am, uh, when I'm dealing with, uh, like friends and neighbors where I live now.
Oh, that's crazy.
Yeah.
Well, it's pretty interesting.
Like it does become a lifestyle and a very, like, how, how do you feel like dealing with paranoid after you got swatted and all of that?
Like it's a, a life threatening experience as well, or, uh, and yeah, like, and most of the people outside the, the, the industry say that and Bitcoiners are paranoid and all of that.
But, well, you know what they say about paranoia, uh, you know, it's, uh, that's because you're paranoid doesn't mean that your fears aren't true.
And so my problem is I wasn't paranoid enough and then I got attacked.
And so now, uh, I've been extremely paranoid and it's been seven years since I have been attacked and I want to keep that streak going.
Okay.
Well, let's hope it, it does it that way.
Thank you very much, Jameson.
Yeah, you bet.