Jameson Lopp on quantum computing and the risks to Bitcoin

Transcript

GM, good morning. Welcome to the Milk Road Show, the daily crypto show that knows your best trades were made after two beers and zero permission. I'm your host, Jay Hamilton. It's Monday, April the 14th. The China verse US trade war continues. We will see what happens throughout this week. Now, if you're listening to this show, there's one thing I do know despite all the uncertainty in the macro sides. One thing I have certainty on is that you hold Bitcoin and you likely hold Bitcoin in self- custody. Or if you don't hold in yourself custody, then you probably hold it in a centralized exchange where they hold a lot of Bitcoin. And today's episode is all about risk. Risk of two things. one, the risk to your personal

Bitcoin, and two, the risk to Bitcoin in general as a result of quantum computing and some old Bitcoin that is held in some old wallets and what that could mean as quantum computing improves. It could become at risk. We're going to dive into all that. Now, this is some nerdy nerdy stuff, guys, but it is so so important that everybody pays attention to this because if you don't pay attention to this, then the future of Bitcoin is at risk. And that is no joke. And I know we all take that seriously. So today we're joined by Jameson Lop, Bitcoin advocate, co-founder and CTO at Cassa, which is a company that specializes in, you guessed it, Bitcoin security and self-custody solutions.

Before we jump in with Jameson, if you guys are trading right now, and I know you are, you should check out Milk Road Swap. Why? Because we got some of the lowest fees in the space. If you want to trade on Ethereum base or arbitum, you can also trade on Salana all in one simple, easy to use place. Today's episode is brought to you by Moon Pay. Trade crypto fee free, fast, and on your terms. It's also brought to you by Coin Shift, powering top crypto treasuries with their yieldbearing stable coins, CSUSDL. Without further ado, Jameson, welcome to the Milk Road Show. Good to be here. Pleasure to have you. First, I've got to ask who who had the beard first, you or Jack Dorsey? I'm pretty sure it was me. Uh though it's funny to look back over the years and watch both

of us like get the the stripes of gray coming out in our beards. Well, you certainly have one of the most legendary beards in the space. I've tried I've tried to do what you do and it just I can't I can't pull it off, man. So, kudos. Shout out to you. Uh I just want to start quickly before we jump in. Can you give a a short background on yourself? You've been in the space and working in Bitcoin for long time, longer than most. Can you give us an idea of your background and what role you play in the Bitcoin ecosystem? Yeah, I'm a computer scientist by trade. I first started playing around with Bitcoin in 2012 because it kept coming up on the various nerdy news sites like slash dot and started some free open source

projects where I was just trying to better understand Bitcoin. And that helped me start to gain a reputation for, you know, thinking deeply about and trying to help other people understand Bitcoin. So I ended up going full-time a little over 10 years ago. worked for BitGo and managed a a fair amount of their infrastructure for several years and then did a very small pivot to co-found CASA where I took a lot of what I learned at BitGo doing multi-IG self-custody for enterprises and trying to help bring the best practices to individuals and you know as of today Casa you can essentially think of us as a Bitcoin security consultant service.

Um, we help people put themselves into like a top.1% security model that is resistant against both uh thefts and attacks and loss and you know human mistakes. Uh, basically shooting yourself in the foot. That's one of the biggest issues when you go from third party custody to self custody is just making sure that you're not having any single points of failure where one thing could go wrong and end up being catastrophic. And since it sounds like you've got a diverse audience, I will say uh you know Kasa also supports Ethereum and uh some Ethereum based tokens. The short version is that you know we're primarily

concerned with helping people secure large amounts. So, you know, we don't support every token under the sun. We we support uh things that have really high market cap and have a lot of value that people are looking to store securely in a distributed key cold storage setup. Great. Okay. So, it's fair to say that you are a Bitcoin OG, not just as an investor, but also as a builder, and you play a very active role in the community, speaking at conferences, traveling around the world in in educating people not just on the future of Bitcoin and the benefits of Bitcoin, but also the security of Bitcoin and how do we keep our Bitcoin safe? Because if

we all want this to be a long-term store of value, then I think one thing that people need to understand is there is upgrades that might need to be made to Bitcoin, which is really hard for a lot of people to wrap their head around because a lot of people think, oh, Bitcoin 21 million fixed supply, it's done. No worries. We have most of the supply is already mined. the rest will get mined and we'll sail off into the sunset and everybody can have self- custody and no worries. But there is some risk and there is some things that we need to talk about very important things some things that would say that a crisis is coming in the future. Okay.

And one of really what this revolves around is the risk of some older wallets and mainly this starts with Satoshi's stash. Can you just first explain to us what is Satoshi Stash and what the estimates are in terms of the size of it? Yeah, I'll even step back uh a little bit further and just say that um there are many different risks across the ecosystem both to individuals and uh systemic risk to the network itself. Um I would say even more pressing than the the quantum stuff we're going to talk about is centralization risk. And you I think everyone understands 21 million coin supply and you know all of these

other rules that make Bitcoin a very hard asset, a very scarce and valuable asset. But all of the rules that make Bitcoin what it is only really work in so far as the power is distributed well across the ecosystem. you know, we we don't want there to be any entities that are too big to fail, that have, you know, too much Bitcoin um that they're holding on behalf of many other people. Anyone who knows the history of the space should understand, you know, from Gauss to FTX to the dozens of other centralized exchanges that have failed for a plethora of different reasons over the years. And so that's actually one of

the bigger concerns that I have these days because a lot of the inflows are going into ETFs that are mostly held at Coinbase or just any of the number of other large exchanges. So uh you know even uh beyond that of course there are these edge case risk where we're talking about protocol issues and I was actually at OP next conference uh over the weekend and we had a number of really smart nerdy guys talking about a number of different really really low-level problems with the protocol edge case attacks. Um there are actually ways for example that an adversarial mining pool could substantially harm the network. Um and you know create blocks for example

that are really really hard to validate and slow down everybody else on the network. And so you know that's another example just of centralization risk within mining. I would argue that some of the mining pools have a lot more hash rate uh proportionally than we would like and there are efforts to try to distribute that more by improving protocols. So there's many different things uh I think to be worried about. Um though you know the average person I think doesn't need to consider uh these low-level protocol issues. But I I do think that the average person should at least consider the difference between trusted thirdparty custody and self-custody because um the more people who are self-custodying once again that's one form of power distribution

that as as we get more people self-custodying it's just um fewer large uh centralized points of failure that could um I wouldn't say be catastrophic but have major impacts on the market you know whenever there's a major issue at at a major centralized custodian that tends to have lasting impacts for months, if not years. Mhm. Let's be honest, everything in crypto comes with fees. But here's a nice surprise. Moon balance doesn't take a cut. You heard that right. No Moonay fees when you buy or sell crypto with your Moonay balance.

Top up with dollars, pounds, or euros. Then you're ready to trade instantly whenever the market moves. And if you change your mind, withdraw your cash. No Moon Pay fee there either. Simple, fast, ready when you are. Check it out at milkroad.com/moonpay. Disclaimer: Network and ecosystem fees [Music] apply. If there's ever a major issue at a large custodian, then the impact on price, the impact on market sentiment can be can be enormous and and the market sentiment is the part that you know depending upon how bad the issue is, you can't predict how the market will react. And you know it could if it's bad enough that that that is the to

me the big risk of all of this and I'm getting a bit like doomsday here when I say this and but I feel like you understand because sometimes in order to get people to listen you need to point out the worst possible scenario but the worst poss scenario here would be that if there was if there was some sort of a major exploit either either at a centralized exchange wallet or through some sort of quantity computing which could happen in the next 5, 10, maybe 20 years, and enough Bitcoin was stolen and then subsequently dumped onto the market, you could see a price run in Bitcoin and then you could see fear and Bitcoin could go to zero potentially or close to close to zero. Yeah. Uh

obviously there's many variables and in most cases I think it wouldn't go to zero and stay there and there would be some people who are like oh this is you know blood in the streets I'm buying all the Bitcoin up for a few dollars again and um you know Bitcoin is an anti-fragile system but it's only antifragile in so far as there are many many different people all over the world who are contributing their own skill sets their knowledge their time their resources into maintaining and hopefully improving the network from a variety of different perspectives. And so that's one of the things that I do is I take this really really long-term view and I try to look out 5, 10, 20 years and try to anticipate, you know, what are some

potential edge case scenarios that could come about and what might we do to try to get ahead of them. And so quantum computing is a hot topic these days um partially because we're seeing a lot of big tech companies that are making various announcements about breakthroughs in quantum computing. And um the the short version that I'll give on like how afraid we should be about that is that I think we're still several orders of magnitude of you know hardware improvements away from a quantum computer to achieve what we might call a quantum supremacy or to to hit what you might call a Q day which is essentially once you have a quantum computer that is

sufficiently powerful enough then it is possible to use something called Shor's algorithm to essentially reverse engineer a private key from a public key. And if you look at Bitcoin, um most of the Bitcoin that are in various addresses these days are in types of scripts that are protected by hashes and they do not expose the public key to the blockchain until you actually go to spend it. But due to things like address reuse or due to things like the miners from the 20 like 2009 2010 era, so the Satoshi mining era before GPU mining, um those are actually in what we call uh

payto public key outputs where the public key is exposed on the blockchain. So any coins that are sitting on the blockchain with exposed public keys are vulnerable to what you would call a long range attack, which is basically that because the public key is already available, anyone with a sufficiently powerful quantum computer can take their sweet time to try to break that and get the private key. And you know, I gave that talk that you're referring to where it was kind of a clickbait title talking about Satoshi's stash because um it is estimated that Satoshi has around a million Bitcoin. Um but if I was a quantum attacker, I actually would not

go after Satoshi's coins first because there are a number of Bitcoin addresses that have a lot more Bitcoin in them. Um, basically Satoshi's coins are spread out across nearly 35,000 to 40,000 different addresses. So, a quantum attacker would have to crack each one of those individually to get each of those 50 Bitcoin. But there are some addresses that have tens of thousands of coins in them. So, you know, you you just crack that one address, you get much bigger payout. And you know, if we're talking about if a quantum attacker appeared today, uh they would actually go after like the Binance or the Bitfinex addresses that have hundreds of thousands of Bitcoin in them. And that really would be a catastrophic

situation. And of course, we're all hoping that we've still got a lot of time before that happens. And that's one of the biggest um debates right now is that no one knows how much time we have. All we really know is that progress is being made because of these announcements. And we know that various uh standards institutes and uh even governments are basically going around saying hey we really recommend that anyone who is doing you know commerce or other sensitive things over the internet try to get themselves upgraded to using postquantum cryptography over the next five or so years. Help me just understand the risk here and the timelines. So the risk is quantum

computing evolves and gets to the point where it can successfully through this long range attack which basically as you said means you have unlimited amount of time. This quantum computer can just pick an address and forever try to figure out the private key for that address until it hacks it. Is this 5 years away until a quantum computer can do this? 10 years 20 years? I certainly hope it's more than five uh because you know the nature of Bitcoin is such that it is very difficult to make changes to the protocol and because it's uh a system without any rulers. Even if we we get to the point where we agree upon a

quantum resistant signature scheme to implement, we can't force people to migrate their coins. And so this is where I had a fairly controversial post to the Bitcoin development mailing list a few weeks ago where I made an argument that it's actually it's better from a for a number of different reasons in my opinion that we announce a sort of drop deadad date of like after some date in the future if your coins are in a quantum vulnerable address you're just not going to be able to spend them. and and that is mainly well that's for two things. One is to um basically prevent this risk that you were talking about of

massive um economic turmoil due to liquidations of a large large portion of the overall supply by some attacker. I think it's pretty safe to assume that an attacker who has invested enough resources to win the quantum race is going to want to benefit from that. And if we look at any number of other hacks or thefts over the years, when someone tends to come into possession of a large amount of Bitcoin, they don't just sit on it. They tend to liquidate it and turn it into other things and use it for other purposes. Uh the other thing is that it's an incentives issue. And I can tell you, you know, from 20 years of doing software development and watching

user behavior, um, users are very very slow to take action to do any sort of migration. And one example of that was actually when I was working at Bitco for SegWit and SegWit had a number of improvements to it. One of which was that it's actually cheaper uh to spend your coins. Uh you basically get get a discount on your transaction fees if you're spending from segregated witness addresses. Um you would think that the incentive there would be for large entities that are transacting frequently to upgrade to that. But what we found is that was not the case. Um, even though

you know we emailed our various enterprise users and these are entities that are sending out you know thousands of transactions a day, they were not upgrading. And we actually ended up having to write other tooling and do calculations on a per client basis and basically reach out to them and say, "Hey, you are spending, you know, $50,000 a day more in fees than you would if you simply updated your your BitGo client software to be able to use these segregated witness addresses." And so that's why I think incentives are incredibly important and that if we don't give people a specific date by which they need to take action, most people are just going to be like, "Oh,

it's not a big problem." Like, "I'll just wait and I'll do it once it's actually a problem." And then once it's actually a problem, of course, you you have this, some people have called it the thundering herd problem, uh, of basically everybody, you know, running for the exits or or running to uh migrate their coins. And of course, Bitcoin has a a very low throughput volume. If everybody wants to move their coins at once, that's going to take like at least half a year worth of block uh data to do. And in your mind, this isn't inevitable. You don't know the timelines. So, you know, hopefully it's not 5 years, hopefully it's more than that. The quantum computer gets to this point, but this is inevitable in your mind. If we don't take action at some

point in some way, you don't exactly know what the the path is going to be, then we are that is likely that a quantum computer will be able to to hack and steal at least the the Bitcoin that is like it's like what one or two million Bitcoin that's in these old style wallets. Yeah. in pay to public key addresses. I think there's around like 1.5 million and then but then it's it's a it's a multi-level problem like even after that any well anyone who has reused addresses which unfortunately is a big problem even though um that's like one of the basic don't do it is what everybody said basic Bitcoin hygiene is

to not reuse addresses and that's for several reasons. It's for privacy reasons but it's also for some of these esoteric security reasons. So, um, you know, as the quantum computers get faster and faster, it'll it'll change from just doing long range attacks to also be being able to do short range attacks, which is basically that even if your coins are protected by a hash, when you go to spend them and you put that in the m pool and you're waiting to get confirmed in a block, during that period of time, you're vulnerable. So if the quantum computer is fast enough that it can crack the keys in like 10 minutes or so then uh you know those coins become quite vulnerable as well. And I think it's hard to say inevitable because this

is another point of contention around the debate. Theoretically we know that like given enough uh quantum cubits which is a measure of computational power and like given sufficiently high enough error correction and and several other variables of how you kind of try to quantify the actual computational power of a quantum computer. If the threshold is reached then yes uh they should be able to do this. There are some people who think that it will never be reached for various like physics issues and I am not a quantum physicist so you know I can't really make an argument one way or another. All I know

is that it is uh sufficiently concerning that I think that we should be discussing it now. Okay. So let's say we everybody did agree that we needed to make this this change. How long would it take to do this kind of a migration and this kind of a of a shift? So, it'll it'll depend on several factors. Like one of the biggest problems with the quantum safe signature schemes is that they use a ton of data. They use like 100 to 1,000 times as much data for a signature as what we use today. So, Bitcoin's already slow enough. Don't slow it down more. Yeah. So you know

then um like there's there's debate happening over which of these schemes should be chosen because they all have different tradeoffs with like validation time and data cost and uh if one is chosen then I suspect there will be additional debate around uh perhaps a new type of discount similar to what happened with segregated witness discount. uh there may be some sort of quantum signature discount uh to try to bump it back up to be able to do at least like five transactions per second uh on chain. And so then the question is you know are we talking about migrating the entire UTXO set which is something like 160 million UTXOs or are we mainly concerned about getting most of the

value because of course value is not evenly distributed between addresses and UTXOs. I think sorry quickly. What's what's UTXO? The unspent uh transaction output. You know, that's like the real Bitcoin is what is uh currently stored in a transaction output that has not been spent. And so you could probably migrate like 95% or more of the value of Bitcoin in a couple of months. But once again, there's no way to coordinate this. the best we can do is essentially get all of the the media and all of the different wallet software to be putting notices out everywhere. Um, but it's also a sort of metriculation problem

where first of all it's going to take I don't know year if not multiple years to come to consensus about how to to make the change at the protocol and then once you actually activate a change at the protocol then you have to get adoption through the rest of the wallet ecosystem. uh and then once the wallets have migrated then the actual users of the wallets can start migrating their coins. So you know it is a a multi- layered approach and each of those steps takes months if not years. Meet CSUSDL, the stable coin built for institutions and Dows. Don't just hold basic stable coins. Earn yield all without compromising security. Backed by regulated real world assets and secured

with institutional grade risk management by our friends at Steakhouse Financial. Put your treasury cash to work, earning native yields and protocol rewards. Built by the team behind Coin Shift, which is trusted to manage over 1 billion in business treasuries on chain, including a Gitcoin, and hundreds of leading institutions, CYCSUSDL is gaining traction at milkro.com/coinshift. It's not all doom and gloom here, though. uh you believe that we are in a position where and and the sense that I'm getting especially from as you mentioned the post that you made a few weeks ago feels like the the crisis isn't here yet. We still have

time but because of how long it takes to get consensus and get buy in because of how long it takes to communicate with all Bitcoin holders along the world. It's not like you guys have a Bitcoin email address or something like that where you can easily communicate with everybody that we should start now. That the time is now to start to set these deadlines to start. How confident are you in our ability to take the necessary steps in order to protect ourselves for the long term? This is a fun uh problem because I see so many parallels between this uh quantum computing debate and the climate change debate. You know, in both

cases, you can you can look at the trends. You can see that like we're going in a direction that is not preferable or optimal, but no one knows when we're all going to die. and and so, you know, because there's a lot of people who perhaps have incentives where they don't want to have to put in a lot of hard work and and do all of these migrations and changes. And there's always, of course, the there's the the unknown future problem of, well, if we wait, maybe someone will come up with an even better quantum resistant signature scheme that will, you know, be um more performant and not require as much block space and so on and so forth. like cryptography itself is a constantly

moving uh field and I'm not a cryptographer but um suffice to say I think that it's going to be something we're going to be watching for quite a while. Okay. So on the quantum computing risk we've got to start acting soon. It'll take years to get to consensus and then even most likely years to update the protocol and get everybody on board and update all the infrastructure uh wallets everything. So this is something that we need to act on sooner rather than later which is why you're out there uh pounding the drum and spreading the message which is so so important. I want to chat though about people's self-custody of their own Bitcoin

because that's a lot of people listening to the show. I assume everybody I let's let's start with what would you say to everybody that has their Bitcoin in a centralized exchange? You don't have any Bitcoin. What's your view of centralized exchanges? How do you do you use centralized exchanges? And how I mean I use I use exchanges as on-ramp and off-ramp. I don't use them for storage. Um, and I mean I when I got into Bitcoin, Mount Gaus was the Bitcoin exchange. And I did my first ever wire transfer to to send money to some tiny little bank in Tokyo in order to try to get some of these Bitcoin tokens. And thankfully, I understood the

ramifications of trusted third party custody versus self-custody. And I did not get burned when they went down, but a lot of people did. And I think that this is a recurring problem because, you know, every cycle, every adoption cycle, you have a a new cohort of people come in, a larger cohort, and generally a less sophisticated cohort. And if the new cohort is not going and doing a lot of research and looking at history and seeing what has happened and how many many people have been harmed in this space because they have essentially thrown out the window one of the greatest strengths of this network which is that you are able to use it without

trusting uh third parties. then it seems like the cycle of uh large amounts of people getting burned through that very simple mistake is going to continue. So yeah, I keep beating the drum. Um there's only so much that you can really do though. It's it's very difficult. You know, I've been I've been essentially selling security for a decade now. And it's it's difficult to sell these abstract concepts of privacy and security and stuff because uh the average person well they're busy living their lives. They've got a lot of other things they're concerned about. And generally you you take the perspective of oh it won't happen to me or or also

you know if it ain't broke don't fix it. You know I've had my coins with custodian blah for several years and it's been fine. Uh, Coinbase has been around for a decade and they haven't uh become insolvent and gone down. So, Coinbase will be around forever, right? And um, you know, I'm not like knocking on Coinbase like they they No, no. Yeah, you're not saying that there's some big risk to Coinbase like imminently tomorrow or anything. Uh, you know, coin, look, Coinbase is not going to pull an FTX. Um, you don't really have to worry about that, but there's still many other things that can go wrong. And I would also inform people that actually Coinbase users are losing their money left and right. Um, we have reason to believe that Coinbase may be losing 50

to$undred million dollars worth of Bitcoin every month. That's not because Coinbase Yeah. This is not because Coinbase themselves have insecure infrastructure. like Coinbase is not getting hacked and having these funds stolen, but rather uh their end users are getting social engineered and attackers are correctly and successfully authenticating into the Coinbase accounts and withdrawing everything. And so, you know, this this is the same type of problem that really any type of bank has to deal with. Uh is essentially various types of fraud. And this is also this is a result of the fact that we have continued to raise the bar uh on

security and we've continued to increase uh and enforce better practices across the ecosystem. So that really today, generally speaking, for the average user, the risk is not so much in your personal like private keys getting hacked, but rather the the weak point for most people. And this is true regardless of if you're doing self-custody or third party custody. The weakness is you. It's the human. It's your brain. And so that's where we're seeing a lot of attackers focusing their efforts essentially doing these social engineering scams where they're calling you up and they're saying, "Hey, this is Coinbase or Kraken or uh Binance or or

maybe even your uh your favorite like blockchain um wallet and saying, "Hey, uh FYI, there's actually a security incident ongoing and your funds are at risk and if you don't move them very quickly, um you're gonna lose everything. And and so they they use these um you know fear and intimidation tactics to basically get people to authenticate into their holdings and then move them but send them directly to the attacker. Mhm. Mhm. I mean, it's as you said, it's similar fraud that has happened for decades in other industries and just applying it to crypto right now because there's such an opportunity for

these scammers. Okay. What would be your your security protocol or your security best practices for those listening who are doing self-custody? What would you recommend that they think about and make sure that they do have this 1% security uh if that's possible? Yeah, I mean I think security should be commensurate with the amount of value that you have at risk. So, you know, if you have pocket money, if you have less than $1,000, like you might an amount that you might walk around with that amount of cash in your pocket, then you're probably fine with using something like just uh a hot wallet on your mobile phone. Um, you

know, it's it's connected to the internet and it's it's not the highest secure setup, but it's convenient to use. And so that's really what a lot of this comes down to is trade-offs between convenience and security. But if you're going beyond that, if you you have an investment level amount that would sting if you lost it, I think if you have more than $1,000 worth, you should at least invest $50 to $100 in buying a hardware device like um you know, Treasure, Ledger, Cold Card, uh Bitbox, uh really any of the big name brands that are highly adopted and have been well vetted

and that gets your keys off of the internet. So that protects you from hackers. It also it gives you a better level level of validation when you're actually spending the funds so that you know that they're going to the destination where you think that they're going. And beyond that, uh, if you're getting into the territory where you have a significant amount of value, it's like a large portion of your net worth, maybe like generational wealth level, uh, you know, if it gets to the point where you would be totally distraught uh, if if those funds became lost, inaccessible, stolen, what have you, that's when you need to start thinking about single points of failure and, you

know, how how do I put my digital assets into a setup so that if something goes wrong, it's not catastrophic. And basically that's what we do at Casa is that we make it as easy as possible to get into that type of setup. And you know we do that by leveraging things like hardware devices to hold the keys um multi- signature aspects of the protocols so that instead of just having one key that is you know the one one key to rule it all rather you have multiple keys on multiple pieces of software and hardware that are distributed around geographically and all of this different diversity gives you a level of security

that can't even really be replicated with like a fortune Knox, for example, I I I call this like better than bank grade security because, you know, even Fort Knox is one single physical point. You know, if if it got nuked or something, that would be game over. But to to put it in perspective, like our most conscious and secure users who want to be secure against like nation state level threats will actually distribute their keys across nation state boundaries. So that you know even a nation state type of like 6102 or or wrench attack or what have you the nation state would not be able to you know cross over into other jurisdictions preferably jurisdictions that they do

not have good relations with and and so you have this really cool type of jurisdictional arbitrage that you can actually uh take advantage of that like no other asset lets you do that. But you know this is getting to the real extreme end of what is possible with these protocols. I think a lot of people don't even fully understand that we can do this and it's actually not it doesn't have to be as hard as you might think. And then there are companies like Casa out there where we've been doing this for many years and we've we've helped so many clients with so many different uh specific edge case situations that we have an answer for pretty much every possible uh concern that you might have.

Right. And so it's it's not I mean obviously the question of how much value do you have and how your security uh aligns with with that value is an important question which only you can answer yourself. Um and obviously you know first and foremost don't ever go on social media or anywhere online and tell anybody how much Bitcoin or anything else you have. That's security practice number one is just keep it to yourself. don't be telling people. I mean, we all keep seeing stories of influencers gloating about how much of c a c certain asset they have and then very unfortunate situations of them getting robbed at gunpoint or their house getting broken into or whatnot uh because uh you know there's

unfortunately some you know some bad actors out there who will come after you. So that would be number one. It sounds like this the the security best practices though they're not they're not they're not overly difficult. It just takes time. It's they're not over difficult or overexpensive. Am I correct in saying that? Like you don't need to have some access to some, you know, quantum computer or anything like that. Like this is basic things that anybody could set up. It's just a question of time and the cost is going to be, you know, nothing crazy is my guess. Yeah. I mean the the puzzle pieces have been there for about a decade. Uh so you know I worked at BitGo which was like the first real multi-IG focused company. um and they launched in 2014 but like I

said they were primarily focused on enterprises and then also in 2014 I think that's when Treasure came out and then we started seeing a more diverse hardware ecosystem for securing keys. So um there's a lot of different software and hardware um that is out there that you know you can use to set up your own um you know free distributed multi-IG system. Uh, I think the cost that people may not think about is is really just the knowledge. Um, you know, you have a pretty large knowledge gap that you have to get over to understand all of the potential threats.

And so that's what we really kept in mind when we were designing our wallet application is that we're not throwing a bunch of technical jargon at you. Uh it's basically you follow the instructions in the app and that automatically gets you into this like top.1% setup uh simply by you using the the key setup that we've designated for you. And um I if you have you know further questions beyond that you know we actually have high levels of uh support where you know we can work with you one-on-one. And then um you know we also have an inheritance solution built

in that if you're in our two of three product you can onboard an inheritance recipient in about 10 minutes and they don't have to be technical either. That's great because inheritance is one of the big issues that I feel like does not get discussed a lot because Bitcoin's just so new. We haven't had a lot of Bitcoin holders that have died yet, right? But that is inevitable. And and I'm I'm sure a lot of people listening, if you were to die today, would your kids or your wife know or your husband know how to get your Bitcoin? Probably not is the answer for for I'm guessing for most people. Yeah.

Yeah. And I mean even even people who have thought about it, what we commonly see is what we call the treasure map. So uh the people who have put some effort into it generally come up with some set of instructions and they just put them in a safe or you know give them to an executive and they're like you know if I get hit by a truck just follow this and you'll be able to recover my coins. And the thing is, you know, that's of course not guaranteed, but I think the bigger problem is that a lot of those people essentially don't do dry runs. And um if you what I recommend people do is you go uh go to YouTube and search for a peanut butter jelly sandwich instruction video.

And there's a really interesting uh adversarial game that uh people play of basically write down the instructions for how to make a peanut butter and jelly sandwich and then I'll follow them. And you can very easily see from that how it's quite possible to not have sufficiently precise level of instructions um and have them be misinterpreted and and ultimately fail by the person who has been uh designated to follow them which would leave you in a very difficult position. Yeah, it it makes a ton of sense. I mean if I the these are not simple instructions. A peanut butter sandwich is much easier to make. So, if people can't follow that,

then following this will be very difficult. Uh, James, final thoughts before we let you go. How worried are you? Crisis looming. What's your final takeways on where we are and where we need to be in the future? So, you know, what I've I've been kind of raising concerns about for several years are what I consider to be long-term trends that I'm not a big fan of. Um, you know, before I was doing uh Bitcoin security stuff, I was actually an email engineer. And so I have some lengthy presentations where I talk about the history of email as a protocol and how email actually went from being a highly decentralized protocol to being a highly centralized protocol that was captured by about 10 gatekeepers. You know, as of today,

something like 90 or 95% of all email goes through one of 10 companies. And that's that's one of the main things that I'm trying to push back against. And I'm hoping that we can avoid making those same mistakes uh with Bitcoin. Uh it's just the the trends, especially with ETFs and custodians over the past couple years, have have not made me feel better about it. But this is also why I've spent the past 10 years working on self-custody is because this is kind of an issue where we're fighting against human nature. and human nature is generally to choose convenience at the expense of almost everything else. And that's my my main takeaway is that like

every if everyone chooses the most convenient path, I think it's not going to be the best for the long-term health of Bitcoin as a network. That's a tough one when we live in a world dominated by convenience now. So, uh, we'll see. We'll have to see this one goes. Jameson, thank you so much for joining us today. Appreciate your time. Thanks so much for listening in everybody. Please, please take take a chance to follow Jameson on Twitter or go check out Cassa or just take your own time to think about your Bitcoin setup and the rest of your coins for that matter. It's not just about Bitcoin, it's about all your coins and think about your setup and make sure you're secure out there.

Thanks again for your time today, Jameson. Thanks for having me. Have a wicked awesome day, everybody. Thanks for listening in. Thanks for listening in today, folks. Before I let you go, I wanted to tell you quickly about Avalanche Summit happening in London May 20th to 22nd. This is a one-of-a-kind retreat style conference that really blends together history, innovation, and the future of crypto. It's going to be developers founders investors builders, everybody all in one place. Check it out. Link in the show notes. Hope to see you there. As always, if you liked today's episode, please hit subscribe and make sure you follow us so you don't miss out on the next one.

There's also a link in the description to our free 5minute daily newsletter where we simplify crypto for you while making you laugh. And if you're willing to step up your crypto investing game, we're going to also leave a link for Milk Road Pro. You get access to our portfolio where you can see exactly what we are buying. This is your number one resource to help you invest successfully in crypto. One final note, this show is for educational purposes only and nothing we say is financial advice. Investing in crypto or any asset is risky and you should never invest more than you can afford to lose. Thanks so much for listening in my friends. Have a wicked awesome