Loading summary
Transcript1 lines
- [00:03]
A
Yo. Welcome back to another episode of the Jack Maller Show. I am your host, Jack, and you are listening to yet another edition of Mail bag Monday, episode 130. One of the biggest pieces of feedback over the last few weeks is my microphone. You guys are writing comments like, yo, your audio sucks balls. Whoa. Whoops. Kid show. Kid show. Hey now. But I'm sorry about the audio. Hey, not a professional podcaster, but I went to Best Buy and I got a new mic. Let me know how it sounds. I think I got everything hooked up. So without further ado, let's get this show on the road. Ladies and gentlemen, I'm talking to you all. At a Bitcoin price of $63,910, Bitcoin's market cap sits at 1.28 trillion. All time high remains $126,160. We are 49.3% off that all time high. About halfway down. That all time high was made on October 6, 2025. It's now been 308 days since Bitcoin was at its prior all time high. The last bitcoin block mined since I hit stream was block height 961,925. Working our way towards 1 million blocks mined in the bitcoin blockchain. Okay, today's episode. So here's the deal. Another piece of feedback you guys had for me last episode. You guys loved last episode. Last episode was more about bitcoin fundamentals, Some of the technology behind bitcoin, what happened during the cold card incident, it was much more relevant right now. Bitcoin show as opposed to macro stuff. So we're gonna try and do it again because that's pretty much what you guys said. You're like, hey, we know this trade of Hormuz is still closed. So how about you just keep going on this bitcoin stuff? There's a lot happening in bitcoin. We'll get back to the macro stuff later. So keep giving me feedback. If you guys want more of the bitcoin stuff, we'll do more of the bitcoin stuff. Like I said, this show, no ads. This is not how I pay my rent. There's no corporate incentive or motive that I have other than just trying to be helpful and hang out with you guys at least once a week. So we're going to do more bitcoin stuff and no macro stuff today. The other thing is this show should be shorter. Famous last words, I hope, but shorter in the sense that I want to leave room for Q A. So like the content and the slides themselves should not take up 90 minutes this time because last week was a bit shorter on Q A. And I want to give you guys more opportunity for Q A this, this week. So today we are going to talk about AI and Bitcoin. So since we last spoke, there's been lots of bugs found in bitcoin software. Not just Cold Card. Btc, BTC Pay Server had a vulnerability where people lost money. There's now a bitcoin red team running around trying to find vulnerabilities in open source bitcoin projects or I don't know, maybe non open source. I think you can hit them up if you want them to scan your code base. Strike has wrote, written a few blog posts. So we're, we've been all over this. We've been running an internal red team of agents, which I think some people have misunderstood what I meant by that. So I'll talk about that. But today's episode will be all about education around AI and bitcoin. The intersection and the unique time we're living through some of the FUD and destroying a lot of the FUD that seems to be spreading about this topic and then hopefully answering some questions. So before I get started, I'm just checking my phone to make sure the audio is coming through. It looks like it is. All right, let's go. Okay, here we go. AI has changed bitcoin security forever. And really, it's changed security forever. So the Cold Open chapter one. What the just changed. Kids show now. Kids show. Be careful. The last 10 days of Bitcoin has been a doozy. Okay? And there's other things that have happened in bitcoin that I haven't even included in here. So this is what bear markets feel like. This is what it's all about. Don't let these times scare you out. Don't let these times wear you out. Stay strong, young lad. Stay strong. Stay humble. Stack those SATs. Okay, but what the hell is going on? Over the last 10 days, cold card had a critical vulnerability. We talked about it last episode. Securing Bitcoin all comes down to your ability to generate a large enough and random enough number and then secure that number. Cold Card didn't do that. Okay, so there was a critical vulnerability. Very terrifying, very sad. The victims of what happened sucks. It really sucks. There's just no doubt about that. There's no other way to spin that. After that, we saw this kind of amplified security research effort within Bitcoin. So a bunch of frontier AI models continue to be released, which we'll talk about in a second. The difference between an American AI frontier model and Chinese AI frontier models. What's the difference? Why do you choose one over the other? What are Bitcoin researchers choosing? What does it mean about American policy and the really the kind of cold war that's being fought between China and America? But all these AI models continue to release products, continue to raise money. It continues to be the hottest technology trend in quite some time. And there's now a team of researchers both within Bitcoin and really around the world that are using these frontier models to find deep vulnerabilities in software at dramatically lower costs. Okay. A result of that has been Open SATS Bitcoin Red Team. So Open SATS has been funding a team, they call themselves the Bitcoin Red Team. They are using AI and LLM to find Bitcoin software vulnerabilities in primarily open source projects that they deem to be critical to our industry. And as a result of that, BTCPay server, last week, yeah, today's Monday. Last week there was an urgent critical vulnerability patched. Some people lost some funds there. They came out with a blog post today talking about what happened and their go forward next steps. I actually think that they donated 0.21 bitcoins to open SATS Bitcoin Red Team as a thank you for helping find and patch the vulnerability. So there's a lot that's going on. Okay. It feels like the world is changing. Editing at a neck breaking pace, because it is. And this show, we're going to kind of break it all down. What's real, what's not, what's fud, what's not, what to do about it and what not to do. Okay. So AI has collapsed. The cost of expertise. That's kind of the way that I would put it. Okay. The vulnerabilities were always there in the code. The cold card vulnerability has existed for 5 years. Over 5 years, almost 6 years at this point. The vulnerability in BTCPay server has existed for quite some time. Believe it or not, the cost of finding these vulnerabilities in is what has changed, not the vulnerabilities themselves. Does that make sense? Okay. And by the way, guys, let me say Bitcoin, as we've talked about on the show, has a way of being first leading the world because we talk about it all the time. It's a truly free market. And so there are no central planning intermediaries that interfere with Bitcoin's ability To express what's real, what's honest, what's true reality. Okay, an example of that was in the 2022 bear market. FTX blew up first before Silicon Valley Bank. They both blew up for the same reasons. Monetary policy got tight. There was capital that was misallocated, misinvested, there was risk that was mispriced and customer deposits weren't actually there. But Bitcoin, it's just, and I guess FTX was broader crypto. But the point is it's, it's such a more free market, it's, it doesn't close on the weekends, it doesn't close at 5 o', clock, it isn't over regulated in who can participate and how they can participate, isn't managed by politicians and unelected officials. It just is. And because of that, Bitcoin fell before the stock market this year. FTX collapsed before Silicon Valley Valley Bank. And the analogy that you guys can tell I'm bridging here is I think that Bitcoin is experiencing the true pain of software vulnerabilities that AI is detecting and bringing the cost down before it hits the real world. Like make no mistake, this is not a Bitcoin specific issue. This is a, the cost of finding vulnerabilities in software has gone from being immensely expensive or just not possible because the level of expertise you needed to acquire to actually go through the critical vulnerable paths of a software repository just, it didn't even matter how much money you had. Acquiring that level of expertise, managing them, directing them, leading them was just only so many. There's only so many people in the world that could do that. And now it costs 200 bucks a month if you want an American model and if you want a Chinese model it costs a hundredth of that. That's what happened. And so we will, we will see the same thing is my prediction happen to. I'm sure someone is going to hack a bank, I'm sure someone is going to hack a Mag 7 business. I mean it wouldn't surprise me. It wouldn't surprise me. So what has AI changed? And again this is about the cost of expert security research has collapsed overnight. That is the step function. That is the like oh my God, it feels like the world's changing so, so fast. And that's because it is the cost of expert security research went from sometimes just not even an option to, or like really really expensive to like I said, a couple hundred bucks to you know, free open source software. So before, let's put ourselves back in A world before AI. Okay, before artificial intelligence. Finding a deep vulnerability, a critical vulnerability required these things. One, you had to hire scarce expert engineers. So these are not, you know, security engineers are not, you know, normal web developers. Okay. And the level of expertise really scales to likely the type of vulnerability or type of code base that you want to scan. You know, again, there's a scarcity to scanning, I would say cryptographic libraries versus scanning HTML and css. Right? Right. So one, you gotta find scarce expert engineers. Two, you have to spend a really large amount of time reading unfamiliar code and unfamiliar edge cases and unfamiliar business logic and unfamiliar application logic. Like getting a group of scarce engineers and growing them to the place where they totally understand what the application is intended to do, how it's set up, what are the flow of funds. Like, that takes time. That takes human beings time. Those human beings, you can't just task them to do it 24,7 over a weekend. They need to eat dinner. They have families, they have a wife, they have kids. Okay? Then you need to trace all the dependencies and the architecture itself. So what does this thing rely on? What are the assumptions that it's making? Is it using other open source libraries? Like, what if its software is secure, but the software it's using is not secure? Right. There's dependencies built. Then you generate a hypothesis as to where it could be insecure, where it can be exploited. Then you build these proof of concept exploits, and then you try. Here's the last part that's really critical. You try and exploit it in an economically viable way. You know, unless you are politically motivated or motivated for some weird reason, you would not attack something that costs you more than you would gain. So, you know, if you, if you have these niche tiny little projects, like why would you care? You're gonna, you're gonna pay all these expert engineers that are really scarce, that need hundreds of thousands, if not millions of dollars a year on payroll. You're gonna pay them over weeks or months or years to build up all of this work, only to get nothing in return. So there had to be like an economic benefit. You know, again, incentives are incredibly important. Now take that to today. So that's what used to have to happen. And so the amount of even just attempts to hack somebody, it's, you know, you'd have to be relevant enough to attack. You can't, you know, these tiny little niche bitcoin projects, no one gave a fuck. And I'll get to that in a second. Nowadays all that it takes is access to a Frontier AI model. You can ingest the entire code base of someone else in minutes. Minutes. Like I can run a frontier AI lab model, go make myself an espresso. By the time I get back and sit at my desk, it understands the entire code base. You can explain unfamiliar systems and trace dependencies instantly. You can search git history. So you can go through the entire history of how this code base was written. So you know, for those that are unfamiliar, what git history is, is if I make a change to a code base and I want to push an update, like I just changed the homepage, I just changed the login button. You know, engineers will write little messages that document the change they just made and update the code base. And so one of the things that attackers are doing is going through the history of all the changes. So not only do I understand the entire code base and I understand all the dependencies, but I also understand how it was built. Like I'm reading the messages of the developers. The developer wrote a message that said, refactored the security system. And then these models are able to say, hey, that might be one of the changes to look at. Let's over inspect that change. I don't care about changing the color of the button. Let's inspect all the commits that touched this file. Okay, so I get to look at all of the history of how this code base was built. Imagine if you were a human and you had to do this without AI. I mean, this is the weeks or months you're paying guys that need 500 grand a year minimum to do this work for you. And again, like you need to pay yourself back. Who's, who's financing this work. Okay, then generating an attack hypothesis again and writing proof of concepts. This is, this is work that could take minutes, hours, days, a week if it's really, really complicated. These things can work continuously. So these AI agents don't have families, don't have wives, don't have kids, don't need to eat dinner. Like they're good. You know, some of the things we do at Strike, which I'll explain in a second, you AI agents are a first class citizen at the company now. And so we've been able to task AI agents to build proof of concepts of features that we're interested in over a weekend. Like I'm able to say, like, hey agent, I'll see you on Monday. And by the time I get back on Monday, an entire proof of concept for a brand new feature is entirely built. And I have an ability to play around it. Did not need to eat that weekend. It didn't need to go on a walk. It didn't need to go to the gym. It didn't need to sit in the sauna. All it did was just grind out. The proof of concept has continuous work. And then the last one is, it's low cost. It's available to everybody. So the economics of doing this, I mean, there is no reality where it's not worth it. I mean, worst case scenario, you spend a couple hundred bucks or a couple, couple thousand bucks not finding a vulnerability, but you don't have to spend millions of dollars to find a vulnerability and then hopefully a way to pay yourself back. You understand? The, the, the difference here is. I mean, this is insane. You know, I, I say often you can look at it in a glass half empty or a glass half full. I look at it at a glass half full. What an awesome time to be alive. I, I mean, I can't wait to tell my kids, God willing, knock on wood, and their kids that your dad and your grandfather was born during the time when Satoshi released the white paper and when frontier AI models became accessible and powerful enough to like, truly change the world overnight. I mean, this is awesome. This is if. If you are a doer and you care and you want to participate in what the future will look like, and you're not just a couch potato consumer of whatever politicians decide, we're going to go out there and we're going to design and build and architect the future that we want to live in. I mean, what better time? This is a time of change. This is whatever fourth turning, whatever you want to call it. So this is cool. But make no mistake about it, this is real shit. This is not dramatic. Nobody's upselling how impactful AI is to sell you secondary sales of anthropic equity. This is all legit, guys. This is real. Okay? So in summary, AI did not make these vulnerabilities exist. So this is one of the FUD pieces again. This show by the common man for the common man, okay? When people say, wow, AI is causing all these issues, that's not how I would phrase it. Guys, when you hear that on the street, that's incorrect. AI did not cause these vulnerabilities. It made them cheap to find. That's it. But that matters. Okay? That matters. So let's talk about the asymmetry, okay? Defender versus the attacker. The defender. And we'll, we'll talk about kind of the, the, the inevitable and persistent infinite duel between the defender and the Attacker, but the defender must protect every meaningful path. Okay, let's. So the asymmetry here that I'm trying to explain is the attacker only needs to find one exploitable path, one vulnerability and they win. The defender has to defend maybe millions and millions and millions of paths. And that's the asymmetry. That's the challenging part of building a defense. Do you understand? So a defender has to map all of their code paths, all of their edge cases, all of their infrastructure and permissions. What employees have access to what, what admins have access to what, what infrastructure providers have access to what, what vendors are we using for what, what supply chain dependencies, what do we have? What open source repositories are we using? It's one thing for our source code to be secure and safe, but what about everyone else's code that we're also using? Do we also need to check on their code? Okay, a defender has exponentially more work to do just to prevent one exploitable path where all an attacker needs is one leaked password, or one misconfigured commish permission, or one overlooked dependency, or one logic error, one IF end statement that. Oops, I didn't mean the cold card. I didn't mean to set that to zero. That's all the attacker needs. The historical advantage of the defender was that they knew their systems better than anybody else. They were able to build products on their systems and make profit with their systems and hire hundreds or thousands of engineers to know their systems inside and out. And in order for an attacker to get to know their systems as well as they do, it's merely impossible or it's extremely expensive. And is anyone willing to bear that cost and try and keep up with them without the guarantee that they'd actually find an inexploitable vulnerability? But now that's not the case. You could spend decades of time and thousands and thousands of engineers worth of hours and expertise and learning and knowledge base only for a frontier AI model to catch up a rogue attacker in minutes. So AI now lets these attackers cheaply build really deep context about unfamiliar systems to them. You see this asymmetry here? So it's, it's very difficult in this modern day in with AI for a defender because it's exponential. They have to cover a lot more ground for an attacker to be successful. It takes one rogue employee to leak a password or whatever. I don't know, making shit up. A defender has to. I mean, they can't afford any of these dependency paths or code paths or edge cases. Or partner integrations to go wrong. So the conclusion that I'm kind of leading you guys towards is if attackers can now continuously investigate you, the cost to continuously investigate you has dropped effectively to zero. The mar. So the way I like to think about AI is the marginal cost of intelligence is effectively zero. Whereas the marginal cost of intelligence, let's say when it pertains to security engineering, was not 05 years ago. It was very expensive in both time, in money, in resources, in everything. I mean, the network you needed to know really good engineers and then the money you needed to pay them, and the expertise you guys needed to grow knowledge about a code base and about a vendor. That's all like, that's all effectively zero. And so defenders need to continually investigate themselves. That's kind of the point. The best way to defend against AI is to use AI yourself. Okay? And that's kind of the world we're living in. If you think about what the Bitcoin Red Team is, they're a team of attackers that have Bitcoin's best interest. They're doing the same thing. They're using frontier AI models to scan for vulnerabilities, except instead of exploiting them, they're patching them. And so you can think of the game of offense and defense. Just reimagine it. You're. The thing you can't afford to do is use the same tools as your attackers. If your attackers are using all these frontier AI models, then you must as well. So you must continually investigate yourselves before the attackers do. And the only way you can do that in a cost effective way is by using the AI yourself. So that brings me to what I posted last week. And I know you guys had a lot of questions about it, and some people misinterpreted what I was saying. But let's talk about how STRIKE operates. And we've been doing this for many, many months now. This is not something we did in reaction to the Cold card hack or the BTCPay vulnerability, but it certainly has reinforced and validated our strategy that we've adopted. Intern, we call it. You know, before there was a Bitcoin Red Team, there was actually a strike red team. There's a red team of AI agents that run non stop 247 every day that try and attack strike. Obviously, though, they're like the Bitcoin Red Team, where if they find anything that's worth us taking a look at that, they escalate it. And we go and we take a look and it's this idea of secure Systems now have to attack themselves continuously and be on the bleeding edge of AI first. And that is, I mean that is, I'll get to in a second. So anyways, I posted this last week. I wrote, at strike, we built a red team of frontier AI agents that challenges our systems. 247 AI has collapsed. The cost of finding vulnerabilities. A single attacker can now investigate software like an expert team. Trust will be earned by challenging yourself before attackers do. And I think that this is the motto that we all as a bitcoin industry need to adopt. So what do I mean by this? You can kind of picture it like this. So maybe we built an agent at Strike that we consider to be an outsider. An unauthenticated outsider or someone that's malicious. Customer of ours that's unauthenticated. Unauthenticated meaning they don't have the right permissions to call certain parts of our system as if they were an admin, as if they were an employee. So someone on the naked Internet. And then we even are able to build these agents. Like well, what if you are naked on the Internet but you're an outsider? Meaning you're not a customer, you don't have an account. Right? What if you're just a random Internet request? Okay, what if you're a malicious customer? What if you sign up for Strike with the only intent of attacking us and trying to exploit us and then we can build if someone is authenticated. What if you're a compromised employee? What if you're a rogue employee that joined Strike only to attack us or is getting bribed to turn against us and attack us? What if you're a bad partner? What if you're a bad vendor? Strike is not a self contained system. We have banking partners, we have exchange partners, we have all sorts of partners. We're a global financial institution. What if one of our partners becomes compromised and tries to attack us? Now we're able to actually permission every single one of these agents as if they were one of these attackers. So what we've done is we've gone through and created agents that act like everyone that interfaces with our system. So you can imagine us reading the logs that enter our server and we start to document who are the people requesting our servers. And you know, you can kind of pile them up into different groups. Okay. Out on unauthenticated outsiders. Malicious or not malicious, I guess, but customer requests. So people that are checking the bitcoin price, placing DCA orders, taking out loans, you know, there's depositing bitcoin employees. So all of our servers, I mean we have internal APIs that service employees and customer support and you know, people that work here need to use our systems too. And then our vendors, which one of our partners are using our code bases and our APIs and our systems and our internal tools. And then we're able to build this internal red team. And so the way that we. And again, this is something we've been building for a year now. There's two blogs on our website that talk about this, so I would encourage you guys to go check it out if you want to learn more. But we call it the Strike Software Factory. And it's really this ability that we've invested a lot in which is making AI agents first class citizens at the company so that these things. And when I say first class citizens, it means these agents can speak our language, they understand what we're talking about when we talk about features or when we talk about Bitcoin, or when we talk about authentication and APIs, it has the correct context to just kind of understand what's going on. And then our AI agents can actually trace attack paths across our source code and our application logic, our infrastructure, our cloud configurations, our partners, our third party integrations, any identity permissions and authority. So again, a vulnerability doesn't have to necessarily be bad. Entropy by cold card, right? What if you accidentally are giving permissions to an outsider? Authentic unauthenticated request that you would to an employee, you know, identifying that is a vulnerability. Dependency on supply chain. So just mapping out, okay, we use certain Bitcoin open source software, that Bitcoin open source software uses this open source software, that open source software uses this open source software. And there's a dependency on software supply chains of are all of these secure? Do any of these have vulnerabilities? So actually our AI Red team of agents of AI agents, we don't only scan Strike's code. We actually have been scanning lots of other code like Bitcoin Core, like some of the Lightning network implementations. We've been doing this work for quite some time now because securing Strike is not just our own code base. You know, if a Lightning implementation has a vulnerability or if some other code base that we use has a vulnerability, that, that makes us vulnerable as well. And so it's been a very fascinating and I, I think it's worth sharing because for a few reasons. One, you know, people, I, I feel like the mood is very defeatist, like there's no way around this. Bitcoin's inherently insecure. I Know people that are like, fuck this, I'm just going to sell all my bitcoin. It's crazy. It's like the defenders have so strikes a defender, right? We have to care for all potentially critical paths, all source code and application logic. We need to defend against all of it. And we've built this software to do exactly that. And it's cheap, it's very scalable. It's worked tremendously well for us so far. And so I don't, I don't think people should, their perception should be that AI is threatening Bitcoin as a whole. Okay? AI threatens vulnerable projects that aren't good at defending themselves or, or need to defend themselves better. So real quick. And this was some of the kind of misunderstanding. So this is what AI doesn't do AI first strike. It doesn't control customer funds, it doesn't modify production systems, it doesn't replace any of our engineers. So I think when I started to talk about this, people were like, oh man, like I don't want to trust AI agents. So like I don't want to use strike just to be clear, like the, what the agents are doing is what the Bitcoin red team is doing. When, when, when you say we're just going to scan all of these code bases for vulnerabilities, we're going to scan all the hardware wallet code bases for how they create entropy, for how they create these large random numbers. That's what strikes AI agents are doing. So I just don't, I don't want our customers thinking that, you know, their funds or their accounts are being managed by rogue AI agents that, you know, at the end of the day, the way I think the world is trending is everything has a human finish to it. So all authority and access is human protected and human custody and everything that you end up interacting with has a human finish. AI is really bad at having taste. It has no artistic sense. It really struggles with deep empathy and human logic to that level. What it's really good at is what we've talked about on the show is white collar labor. It's very freeing in that way. Like you don't have to read through thousands and thousands of hours of git commit history to understand how a code base went from zero lines of code to millions of lines of code. That's very like, that's a slog of white collar labor. And AI replaces that just really just exhausting white collar labor. But it doesn't replace, you know, what I call human finish. The end Security. The keys the custody, the production, deployments, any of that. And so what these things have been able to do for us is widen the search and deepen the search and being able to automate reports to our engineers to go take a look. Because here's another thing I'll tell you guys from experience, AI slop. You know how, you know people say, oh, the Internet is riddled with AI slop. That's true. And there's AI slop in security as well. Like the AI is going to give you 10,000 potential vulnerabilities and it has no idea which ones like you're going to care about because it really struggles with valuing what your customer is. How do people value your brand? Like, what are the major use cases of your application in your business? Which ones do you make most of your revenue from? These are the things it really struggles with. So again, you need this human finish. So there's a such thing as AI slop as well when it comes to these things. So there's a lot of human involvement, but it really widens and deepens our ability to secure our system at effectively no cost. So what we've done at Strike is we've built automated attackers that basically work for us and are on Team Strike. And again, there's one more really interesting thing. Do I have it as the next slide? Kind of. Okay. There's one more really interesting thing too as well. Which one of the things I will say, you know, I think first of all, I think BTCPay server, I love that project, I love that team. I think they. The situation that they found themselves in was very unfortunate. I think they handled it as well as they possibly could have. I'm really sorry for anyone that lost money and that was affected. Sucks. One of the things that's different about Strike is majority of Strike's code is closed source. It's not open source. And you know, that's because we're a business. We are not a public utility. We are proprietary information that I and my colleagues have been working on for many, many years. And we have competitors and we have regulated licensed stuff. And so it's not for public consumption. But what's really interesting is that actually gives us an advantage in many ways in this AI world where you can think of someone like BTCPAY Server, because they're open source, the attacker has access to all of the same information as the defenders. And so they're kind of dueling it out on even playing field. And also, BTC Pay Server is not a business, so it doesn't have a war chest of a balance sheet or it doesn't have cash flows to subsidize more and more tokens. And so it's an open source project that's funded charitably, you know, by 501C3s like OpenSats and the human Rights Foundation. And because it's an open source project, it's, you know, the attacker and the defenders have access to equal amounts of information. So it's actually a much more difficult thing, which we'll get into in a second, to be an open source project operating in this AI world. Because for Strike, we have a few advantages. One, we have money. We have money to say, hey, I don't like, you know, when some of these Bitcoin Red Team engineers were trying to investigate all the relevant bitcoin code bases and make sure that everyone was secure or disclose potential vulnerabilities, they were tweeting out like, Rob Ham, Hamilton, Kale. They're tweeting out like, we're running out of money. Oh shit, we're running out of money. Or, you know, we could use some funding. Like, that's not a problem for Strike. We've got plenty of money, we've got plenty of bitcoins. And like we, I tell the engineers, like, whatever, go, go run your agents. Like, you know, security is, is the number one feature that a bitcoin company can have. And so that for one, we're a company and so we have money, we make money and they. That's an advantage that we have. Another advantage that we have is not everything's open source. So we actually know much more about our code base and our systems than an attacker does. And so there's a little bit of asymmetry there. Now again, the cost for an attacker to familiarize themselves is very low. And so no one should take that for granted anymore. But with that being said, I'll always know more about STRIKE than anybody else. And that's not necessarily the case about BTCPAY Server, because everything there is to know is public, you see. So it's a very difficult situation. I have a lot of empathy and a lot of respect for all of these open source projects and the Bitcoin Red Team. Everyone that everything, everything that everyone is doing is really admirable. I think the way that the bitcoin community has locked arms and united in this moment and in this bear market we'll look back and be very fond of. And so I also just wanted to acknowledge that like, I'm in no way, when I'm Talking about strike, bragging, we'll talk about this in a second. You're only as secure as your greatest adversary. So, you know, saying you are secure definitively is famous last words. You may have been secure as of last second, but in the current second we're living in, who knows? That's kind of how security works, by the way. It's constantly iterating to defend your systems. Now I'm very proud of how STRIKE has performed in this AI era. I feel like we have been prepared, we have been forward thinking, we have not been scared in investing and investigating what is best and where the world's going. And so I think sharing some of the work we're doing is very cool and very fun and very exciting. But yeah, these open source projects, we'll, we'll talk about them right now actually. And just kind of the security economy that's being created and where I think the world of Bitcoin and open source software generally is going in the world of AI. So let's talk about this new security economy, the Bitcoin Red team and open source security budgets. So first of all, I've talked about this Bitcoin Red Team. I think technically it was started by Rob Hamilton, Shout Out Rob Calais, I think Craig is now. I actually don't really know everyone who's working on it, but I just want to shout them out, thank them for their work. This is basically a group of bitcoiners that realize what happened with the Cold Card incident. It is, I don't know if we're, we'll ever be able to prove for certain, but it is very likely the case that the Cold Card incident was predominantly because of Kimmy K3, this Chinese frontier AI model that came out and was able to find the issue. And then a human exploited it because it had access to this very cheap expert security expertise, which was this AI model. And so this group of bitcoiners said, well, like I've been saying on this presentation, the only way to defend yourself against attackers like that is to effectively exploit yourself first, find vulnerabilities before they do. And so let's get access to funding, let's get access to all these AI models and let's just start scanning everything relevant to Bitcoin to protect ourselves. Because, you know, once you find a vulnerability, you have two options. You can either patch it or you can exploit it. And you know, obviously you call them white hat hackers or black hat hackers. The white hats want Bitcoin to succeed. See the value in patching These things building confidence in the industry and then the black hat see an opportunity to exploit. And so this Bitcoin Red team stepped up to the table. They've been a beacon of leadership in this moment, not falling for fud, not getting the their hopes down and so shout out to them. So this is kind of what we're looking at is OpenSats is funding all of the AI related expenses to allow them to continue to scan these code bases. The expenses are just AI compute. So you have these token costs that, that are now part of everyone's security budget strike as well. So we all are basically strapped with a new line item of cost to secure our systems and we've seen real results. So BTCPay servers Critical vulnerability patch actually came from the Bitcoin Red team themselves. And so we are literally watching the cost of expert security research collapse in real time. Like the security budget of open source used to be almost entirely human time and now it's almost entirely not human time. So here's kind of what I was just talking about. It used to be, you know, the open source security budget used to be human expertise time and then funding and now there's a new line item which is AI compute. So you need LLM token costs, agent infrastructure and continuous tooling. I think Calay released a new tool today which he has been using as part of the red team. He just open sourced it. So you're going to need more tooling, more token cost funding for tokens agent infrastructure. And this is now what it takes to secure Bitcoin software and just open source software generally. Again, this is not a Bitcoin specific problem. Oh shoot, I made this screenshot too small. Let me zoom in here. This is Rob from the Bitcoin Red Team. He wrote yesterday I began fully invest, fully integrating, excuse me, the OpenAI Trust Cyber Program into my Bitcoin Red Team efforts. This morning I woke up to see this. I am now being blocked from doing additional analysis on a code base which I've already responsibly disclosed to and have received confirmation had legitimate findings. To be clear, this is after having already KYC'd and completed the onboarding process months ago to use the cyber capabilities OpenAI has to offer. I am now prevented from being able to continue the investigation in a further effort to make sure their code changes are sufficient as well as understand if there are other issues that have yet to be discovered. It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models to, to conduct my research to protect bitcoin infrastructure. Black hats will not hit these issues. The white hats will. We've hit a local minima in policy. Intelligence is unrestricted for those who don't follow rules and those who engage in harm reduction are left on the sidelines. What are we doing in this country? How is this keeping people safe? Please do something. David Sacks, Sam Altman, Donald Trump. And I just find this incredibly ironic, disappointing, frustrating, but I mean comical as well because we've talked about this on this show. How many times on this show have I talked about with you guys the fact that I mean American policy? I'll just be blunt. China is the one open, sourcing things and allowing free markets to drive the cost to near zero. America is the thing full of lobbyists, political games, creating regulatory moats, preventing free market, just capitalism, competition and closed source repositories. If someone was born yesterday and I were to say, okay, here's what Kimmy K3 is, here's what whatever anthropic opus all these models are, and here's what open AI is, which one is Chinese, which one is American? And they were born yesterday and they had no idea. They would think that Kimmy K3 is American. It's cheaper, it's open source, continue to get driven down. It's crazy. And we've been talking about this on this show and, and this is bleeds a little bit into the macro so I won't get into it too much. But the reason in my opinion that the American Frontier Labs are acting the way they are is because they've borrowed so much money to build this stuff out that having truly free market competition will render everyone insolvent. Not just OpenAI and Anthropic, but Oracle all, everyone that's lending all of this money because how is anyone going to get paid back if all this stuff is open source and almost free? And the reason it is so expensive to build this infrastructure in America versus China is because the dollar is the world reserve currency. There is a premium to the dollar because there is perpetual built in demand to the currency that is world reserve. You need it to cross currency and trade globally. You need it to refinance and pay down debts. You need the currency no matter what, so it trades at a premium. Another way of saying this is gold and bitcoin should be multiples higher because the dollar should be worth less. But it's this world reserve thing and so America is perpetually more expensive. Why is the iPhone not built in America? Why is it built In China. Well because China has weaker currency, cheaper labor, better infrastructure. There they've become the world's factory. So here you have like someone who's, who's run first of all running a trade surplus. By the way, I'm no fan of the ccp, right? Everyone knows that. Abolish the CCP but let's call spade a spade. China is running a trade surplus. Recycling their trade surplus into gold. They are promoting and pushing the world towards using neutral reserve assets. And they are open sourcing their frontier AI labs and models and they're running at a fraction of the cost. Meanwhile Anthropic is lobbying, lobbying in D.C. against open source software. It's crazy. Are you, have you lost your mind? What country am I living in? They're lobbying against open source software. They, they're lobbying for regulatory moes. They're saying this is all so dangerous. The thing we've created is so dangerous no one else should be allowed to create it. We will govern who has access to intelligence. What? You're the, the God amongst us plebs, You. So anyways, I have written on the slide. The problem is that these American AI companies are blocking legitimate security researchers. So this is the problem. When you create central planning, human interference, you over regulate. The best regulator of society is the free market itself. The less is more. Let people do what they want. Let them put, they want, put what they want in their bodies. Let them do what they want with their lives. Guess what? If they do fucked up unhealthy shit, I bet they stop because they're going to feel bad and they're going to ruin their life. It's very simple. If they build a business that doesn't work, let them, it will fail, everyone will learn from it and they'll have to do something else. But more government, more regulation, more politicians, more central interference. And people say well what's the worst that can happen? This is the worst that's going to happen. Legitimate security researchers are now dispositioned against attackers because you have these American companies that aren't letting American researchers protect themselves. Fucking ridiculous. And here, here we are having an American bitcoiner and rob say thank God for China crazy. I mean if this isn't a wake up call like get your head out of your ass, I don't know what is. Do we want, really want to build a world where the people with good intentions that are trying to protect people's funds and build secure software and keep America on the bleeding edge of finance and technology, which is Bitcoin by the way. That is what the bleeding edge of finance and technology is. It is bitcoin and it is AI. And you have people like Strike and like Rob that are trying to make sure that this country remains on the bleeding edge. And in first place we are dispositioned, we are paying more, we are on waiting lists and the black hat hackers that want to fuck everybody that don't follow the rules, they have an advantage. Crazy. I mean strikes infrastructure, we, we invested heavily in plugging in all the Chinese models. It is drastically cheaper. And they don't cut me off, they don't, they don't wave a political flag in my face and say sorry, we're not going to help you investigate BTC pay server because we're anthropic and we don't trust your judgment as a human you. So we've been talking about this dynamic on this show for months, for a very long time. I've been saying time and time again, China knows the leverage they have in open sourcing these models. They know that the US is screwed because I mean it will pop this AI bubble if OpenAI has to bring their costs to zero. They're not, they can't pay back Oracle, they can't pay back Nvidia, they can't pay anybody back. These are trillions and trillions and trillions and trillions of dollars of infrastructure build out and money lent. And I mean this is why these companies aren't going public. The, the value of their equities will collapse because I don't think that these companies are actually worth a trillion dollars. You know, if you can get one, one venture capitalist to agree that you're worth a trillion dollars, then you're worth a trillion dollars. But in the public markets that's not how it works. You're worth whatever the last traded price was. I digress. We'll do macro stuff on a later episode. But anyway, I responded to Rob's tweet and I said Bitcoin, open source software and free markets embody American values. Whatever this is, doesn't, this is the most un American thing, you know. And that's kind of the hilarious reality of this whole situation. Do you know what's un American? The dollar. Do you know what's American? Bitcoin. You know, it's un American. Anthropic. You know what seems to be pretty American? Kimmy K3 it's fucking weird. And whatever, like we'll figure it out as a country. We're going to figure this out, we're going to persevere. But like, you got to call a spade a spade. That's why this show exists. I don't care if, you know, you can imagine if someone was my sponsor, they'd be like, oh, you know, can't sponsor that guy. He's out there, you know, telling the US Government they need to get their act together about AI. Well, guess what? I don't have any sponsors. You know, the people that fund me are you guys. The fact that you guys use strike allow me to do this show. So I got to. Someone's got to call a spade a spade. Someone's got to tell the truth. You know, us Americans have to defend American values and American ideals. We got to open source software, allow free markets, embody things like Bitcoin, protect Bitcoin in this country. That means enabling researchers in this country to protect the fucking infrastructure of the space. So I talked a bit about open source software versus source visibility. Damn, sorry these rendered so small. So I tweeted this as well last week. I just wanted to have it. I think that this is a valuable conversation for the community to have. So I tweeted out relatedly, I think AI is forcing a harder conversation in open source software. The cold card incident is an example and forces an uncomfortable realization for bitcoiners. Source visibility is not a security model. So by the way, Spark notes, source visibility means that your code is viewable on the Internet. Open source does not guarantee security. The advantage of free and open source software is not only visibility, it's also the review economy. It can create people and companies can build on the code, fork the code, compete with it, depend on it, challenge it and improve it. Coldcard's firmware was public and reproducibly buildable, but it was licensed under the Commons clause. It was source available rather than truly open source. Spark notes that means that it was visible to the public, but you couldn't use it commercially. You weren't allowed to build your own services and products with it. So that's very different than, hey, what's mine is yours. Use this because then you're very incentivized to take care of it if it's also supporting your business or it's also supporting your family or your customers. Where Coldcard didn't allow anyone else to truly use their software. Technically it was viewable, but just because it's viewable doesn't mean people will care about it. You know what I mean? Okay, I go on. The license did not cause the bug, and I can't prove a different license would have caught the bug. But my point is commercial freedom is one way open source creates more independent companies and developers with real skin in the game. The cold card bug survived for years. Even though the code was visible, it clearly was not challenged enough. Why take Bitcoin Core as the contrast? Its advantage isn't simply that its repository is public. It is genuinely open and sits at the center of an ecosystem whose money, products and businesses depend on continuously reviewing, testing, challenging and improving it. AI makes this distinction. Urgent source visibility is symmetric. Defenders and attackers can inspect the same code. AI has collapsed the cost of expert scrutiny. A small team can no longer assume that publishing source means that the public is defending it. More than an expert level scrutiny is attacking it. Without real review economy and continuous adversarial thinking and testing, the most motivated reviewer might just be the attacker. So the question in Bitcoin can no longer be can I read the source code? It has to be who is continuously incentivized to prove it wrong and fix it before an attacker does? When I think about software being safe enough to trust with my life savings, especially in the age of AI, I think about Bitcoin Core. It is genuinely open and continuously challenged by an ecosystem with real skin in the game. This is something to think about. Okay, so what am I talking about? So basically my point is this. I think that there was a notion in, in Bitcoin and in the world that as long as the code is publicly available, then it's secure because people can review it, people can test it and try it, and there's no such thing as just a dormant bug sitting in the open for years. I mean, if there was a bug, someone would have already found it. Now clearly that's being proven wrong. The cold card issue existed for five years, five and a half years, right? So my point is, to be truly open source, not only is it mean that your code is viewable, but your code also has to be able to be used by other people and is getting used by other people, meaning Coldcard. They were using the commons clause. So you couldn't actually use their firmware to build your own hardware, wallet or to build your own stuff. And for that reason, no one else was using the firmware outside of cold card themselves. And because no one was using the firmware outside of cold card themselves, not that many people cared to investigate the firmware, at least technically. Like businesses, engineers. Sure, lots of customers cared about the firmware, but customers don't have the technical chops to actually go in and check it out. And so, you know, like strike wasn't using cold card firmware, for example, even if we wanted to, we weren't allowed to. And so you guys have to understand, and I want the community to understand that part of the security that comes with open source is being truly open source. And meaning that not only are you the only person using your software, but a community of other businesses and other developers in the entire industry is using your software because that greatly deepens the security. Because now you have all sorts of people that are constantly reviewing, testing, investing in building, fixing the code. So I write here, open source does not guarantee bug free software. The benefit of a truly open source project is in the review economy that it creates. Developers, companies, competitors, researchers, users and downstream businesses can all have an economic and technical incentive to challenge and improve widely used code. A public GitHub repository does not automatically make a system secure. Okay, So I contrast ColdCard and Bitcoin Core. Cold Car's firmware was publicly inspectable, reproducibly buildable source available and it was respected in the bitcoin community. But the vulnerable path that was exploited remained insufficiently challenged for years, despite being technically visible. Bitcoin Core on the other hand, it's genuinely open source. So it holds an MIT license, not commons clause. It's widely depended on. So everyone in Bitcoin depends on Bitcoin Core. Michael Sailor, Jack Dorsey, every single Hodler, every single nation state. Now the United States of America depends on Bitcoin Core. If Bitcoin Core fails, Bitcoin fails. That's at the protocol level. It's not an application layer, it's not a business layer, it's not hardware layer. That's the, that's the consensus rules. So Bitcoin Core has the largest review. Economy devs, miners, exchanges, researchers, nation states, businesses, capital markets. BlackRock cares about Bitcoin Core. You see what I'm saying? And that how the incentives matter because what these AI era is going to do is like you know, ColdCard was a very small team and you say yeah, but their software was open source. Yeah, but not really. Like no one else was allowed to care about it. So something like Bitcoin Core is continuously challenged, tested, fuzzed, improved. MIT professors and researchers are constantly battle testing Bitcoin Core. Sailors funding engineers for Bitcoin Core. Dorsey, I am BlackRock the United States of America. Like if the United States of America is really truly custodying their own Bitcoin and they in running a node, they use Bitcoin Core. So when you, when you start to think about like security and what to trust for your life savings. And obviously, you know, in the industry what we need to check on and keep ourselves honest about is if you have fringe open source repositories that don't have a lot of contributors and a lot of reviewers and a lot of other businesses using it, you have to ask yourself, is the most motivated reviewer an attacker? Right, like. And so anyway, I think that this is a very important conversation that the bitcoin community needs to have. You know, you can have fringe small projects that are open source and that's fine, but it, you know, it doesn't cost a lot. Previously someone would have had to pay a lot of researchers a lot of money and a lot of really good engineers a lot of money to try and inspect the cold card. And who knows what if there was no bug, then you lose a bunch of money. So there was, the risk reward was really uncertain and nobody really cared enough to double check seemingly and actually take a closer look. But AI drops the cost of that drastically. So in order to be secure we you have to have a lot of defenders. Like you want a lot of defenders and you can either afford a lot of defenders by being a company and having the money to build your own team of red team of agents like Strike does. But if you're an open source project, you have to be truly open source and you have to allow other people to use the software, adopt the software and care about the software. And again I have keep bringing up, people are like oh man, is securing bitcoin? Is cold storage dead? No, cold storage isn't dead. Self custody is not dead. But I will say that being truly secure in an open source manner in the world of AI, it's going to be harder. You can't just be a rogue developer that open sources this project that no one else has heard of or used. How secure is that versus the bitcoin repository that's responsible for consensus rules that everyone between BlackRock, the US government, plebs around the world, businesses, capital markets, everyone is relying on using testing funding, you know, so source visibility is symmetric. The defender can expect and the attacker can inspect. So AI lowers the cost of both and it's just something to think about. So anyways, is AI a threat to bitcoin? The answer is no. So this diagram I have, you know the protocol layer, consensus, proof of work, SHA256 like the, the monetary policy of bitcoin that all lives in bitcoin core. That's all math, that, that's all cryptography, no problem. Okay, AI is Going to battle test a lot of the business and application layer and infrastructure layer on top of that. So Lightning BTC, pay server hardware, wallets, APIs, exchanges, web services, these are all going to be challenged and tested in a way to ensure security. Okay, so just to make the explicit point, like Bitcoin's math 21 million supply proof of work elliptic curves, the key space of creating a large random number in Bitcoin 2 to 256. Like that's not broken by AI, that's math. AI can't break that. Like, don't worry, AI is rather very good at finding human mistakes. So that is a very different concept than breaking math. And so, you know, right now what we're living through is kind of can you, can you find, can, can white hat hackers find human mistakes before black hat hackers? And what does it mean to be secure in the world of AI? Like if you're an open source project that doesn't guarantee security, especially not today. So the new standard, what secure software means now, yesterday it was be open source, be audited, be pen tested and be battle tested. And I believe it's all the same, except now you need to be continuously red teamed. And whether that means we as an industry continuously fund a Bitcoin red team via something like OpenSats or you build your own red team of agents like we have at Strike, we're going to try and open source as much of our AI work as we can. That's why we've started to blog it, so that people can engage with what we're doing, ask questions, maybe we can learn a thing or two or get feedback from other companies and corporations. But I think you need to add now this new line item which is continuously red teaming yourself, like what we're seeing with the Red team, funded by open sats and run by Kali and Rob and what STRIKE is doing, I think that has to be part of the standard because as I was alluding to before, you don't get to decide how secure you are, your adversary does. You know that that's, this is kind of the humility that comes with building something secure. You can't have hubris and say, oh, I do everything perfectly and I'm smarter than everybody else. That's not how it works. The people attacking you decide how secure you are. And so your job is to cover every access path, use all the best tooling and to assume that you can make mistakes or an employee can turn against you, or a partner might not have your best interest. You have to Prepare for that. It's an ego driven idea and worldview to say no, everyone's going to love me, every employee is going to respect me, every, everyone is going to take care of me. No one's going to try and attack me. That, that's an inflated sense of self and ego and a very optimistic worldview which may or may not happen. And so, you know, this is the energy that you know, in order to build something secures. You don't get to decide that whoever's attacking you decides how secure you are. And so I made the cost of that like Dr. Dramatically less. So I believe in this new era trust is going to be earned by proving yourself secure before attackers do. And that's what we do on a daily basis at Strike with AI. And that's what the bitcoin community is now doing on a daily basis. So you know, in the near term I think that latent bugs will get exposed. You know, project smaller projects, smaller open source projects may have a difficult time. Some things may be exploited, maintainers are going to be scrambling, the industry might scramble for a little bit weaker projects, might have a tough time surviving. So far so good. Generally speaking, I mean BTC pay servers, the only kind of post cold card exploit I've seen exploited at any scale. But in the long term I think that the industry is tremendously stronger for this. Bugs eliminated the depth of the review and security and open source increases dramatically. Security knowledge becomes reusable. I mean think about how much we're learning as an industry from each other and banding together and battle tested software hardens what survives continuous AI review becomes much, much more robust every single day that goes by. And we continue to harden our infrastructure, harden our exchanges, harden every bit of tooling that we use to support it. So yeah, I mean I'll just recap. AI did not change Bitcoin's 21 million supply cap. It did not change proof of work. It did not change the key space for creating a private key. It did not change cryptography, it did not change math. What it changes is the cost of finding human mistakes. And so in a way we must be grateful for, for this change. It's going to harden our work, it's going to make us better, it's going to make bitcoin stronger. I think that bitcoin right now needs leadership, it needs clear headed thinking, it needs proof of work really people to show the way, which I think many people are very grateful for them. So the response is not to be scared and not to be fearful. The response is to use the tools ourselves. So open source, the code fund, the reviewers run, the agents, fix what breaks and bitcoin will be better off for it. I wrote here, bitcoin has always gotten stronger just by surviving. And you know, at the end of the day, what must break in order for bitcoin to break is math. So and, and concepts like money itself. Like obviously if Elon Musk's version of the future pans out and money is no longer necessary or needed, then okay, but you know, assuming scarcity is valuable money, there, there, there is a delta between wanting things and actually having things. And we need to, you know, allocate capital and there's division of labor and all of that stuff then. And mathematics works, then yeah, bitcoin works as well. And all of this is just, you know, some, some pain along the way for long term gain. So hopefully that was useful and laid a, a solid groundwork for what's going on in the space and for you guys to be able to ask some questions. We only are about an hour in, a little bit over, so I should have time for a nice chunk of questions. But Bitcoin's okay, Bitcoin's okay. I think AI is making the world a dramatically better place. It's very exciting. Reducing the marginal cost of intelligence to zero is really, really fun and exciting. But obviously it changes the world in a material way and we need to be active about it, open the dialogue and learn from it. Okay, let's see what questions you guys got. Okay, question one, Macro. Are Chinese AI frontier models better than American ones? Is this strictly because the US companies have to keep a leash on their models for quote, unquote safety? There are different ways that people measure these models. You know, there's speed, there's depth, there's mathematics. And I'm not necessarily an AI expert like some other people on the Internet, so I'm not going to pretend that I am. What I'll say is this. They are cheaper, I think, because like I said, China is cheaper. Energy production, infrastructure. I mean, China owns the physical layer of all of this, like the hardware, the chips, the actual commodities, like the rare earths that go into building stuff. So like, you know, industrial infrastructure like China's leaps and you know, the US needs to reshore. We've talked about this on the show a lot. The US needs to get away from just printing infinite money and running infinite deficits to actually doing real proof of work again and an ability to produce its own stuff. Now what comes with that is A tremendously weaker dollar. You cannot reshore production and not tremendously weaken the currency. Labor has to be competitive. I mean, so anyways, we've talked about this a bunch now. I think you put in, quote, safety, like AI models are about keeping us safe. Again, I think that the best thing for safety is free markets let people do what they want and if they do something that harms them, they won't do it again unless they're an idiot. So you know, it's almost like a form of Darwinism. The giraffe whose neck wasn't long enough to eat off the tree didn't survive to reproduce. And over time giraffes had long necks. So you know, like, I think free markets are the best way to like truly govern us. I think capitalism works. But yeah, I mean these AI labs are lobbying in D.C. saying this stuff is dangerous and there's only certain people, namely us anthropic, that should be allowed to govern who has access to artificial intelligence and who has access to this stuff. And that's ridiculous. And clearly they're doing this for business incentive. And again, I think that certain parts of the AI space can't afford open source, cheap competition. They can't afford Google and Meta to get into the game and compete with them because they're taking, they've taken on all this debt, they have all, they owe all this money, they need to go public and pay back their investors. And competition breeds innovation and lowers costs. And I don't think that they can, I don't think they want to compete with China or Google. I think that they want American politics to ban Chinese models from Americans and to create regulation which makes Anthropic like the de facto king of all of this. And then with that in place, they'll pay everyone back and they'll be God amongst us all. I literally think that's, and that's obviously asinine, ridiculous, the most anti American thing I've ever, ever heard. But that's seemingly what's happening. I mean reading OpenAI researchers write blog posts about how open source software is bad. I mean this is, this is ludicrous, it's crazy. And this is I guess what Elon has a lot of issues with. At least this is his kind of marketing claim is that these people are evil and they have their own self interest over the betterment of humanity. I mean Elon, I've never met Elon, I don't know Elon, so I can't vouch for his credibility in these claims. If he's Marketing himself or if he truly means it, he seems to truly mean it. I kind of believe him. And he's claiming these, you know, there are evil interests, evil, evil, big corporate interests at play here. And that AI is going to dramatically reshape society and it is going to be a step, function change for all of us to digest. And it can't afford to be closed sourced. It can't afford to live in a world of D.C. lobbying and overregulation and regulatory moats. That's been his aggressive pitch and you know, he's been in legal battles with open AI and he's had very harsh words for anthropic and I mean again, I'm not, I, I spend my time working on bitcoin, but it's my two cents. Okay. Bitcoin and market questions. It feels like Bitcoin Core is the most decentralized, verified and secure software and therefore the best to create a wallet and keep our funds safe. Is there anything else that can compare? I don't, I personally don't think it gets better than Bitcoin Core. You know, now I talked about in the last episode, it depends on what you want to do. You know, hardware wallets can be valuable. Certain use cases like Bitkey makes multisig very easy. So does CASA Unchained, although there's very different trade offs for each of those services. So would I, for someone who's a novice who's getting a bitcoin hardware wallet for Christmas, would I gift them an offline laptop with instructions on how to set up Bitcoin Core? Probably not. But at the end of the day, the most truly open source battle tested, reviewed and incentivized across a broad range of bitcoin participants like Bitcoin Core. There's no one close to Bitcoin Core. And at the end of the day, if you want to generate a really large random number, Bitcoin Core can do that and, and it's got the most eyeballs on it, the most investment. So yeah, if that's the answer you're looking for. I don't want to imply that there's no other project that should be part of self custody. I think custody will continue to be sub industry within the space that develops and evolves and there's going to be all sorts of products and services. I mean I talked about how Strike is very interested and excited about things that we could do in the space. But yeah, Bitcoin Core is definitely unique in certain respects. Hey Jack, can you spend five to 10 minutes talking about Multisig. And if you set up, let's say a two of three with three completely different devices, if it protects you better, how do you feel about the Sparrow Wallet? I love the Sparrow Wallet. I'll let everyone research that and take a look on their own. But yeah. So multisig is very cool. Bitcoin actually has a language called script. And bitcoin script allows us to add logic to bitcoin transactions. So you can say something like this bitcoin, these bitcoins, this unspent bitcoin can't be spent until block X. So, you know, I said at the beginning of the show, the bitcoin block height. Right now, let's refresh. I'm looking at latest bitcoin block height of 961,932. So I could conditionally say to some of my bitcoins, these bitcoins can't be spent until block 2 million, which is way out into the future. Those bitcoins are then stuck until that block height. So you can add scripting language to your bitcoin transactions that says this bitcoin can't be spent by, you know, can't be spent to any by. By before this block height. Now, one of the other things that is multisig is this bit. These bitcoins cannot be spent without two signatures from one of, from these three key pairs wallets. Does that make sense? So you say, here's Jack, Dylan and Bill. Now, these bitcoins can't be spent without two signatures from any of the three. So either Jack and Dylan, Jack and Bill, Dylan and Jack, Dylan and Bill, Bill and Jack, Bill and Dylan. One of those variants. If only one, if only Jack wants to move the coins. Not possible. If only Dylan, only Bill wants to move the coins. Not possible. So that adds some security because if Jack gets compromised, if Dylan gets compromised, if Bill gets compromised, the coins are fine and they're still spendable because you still have two left over. Now, you could do 2 of 4, 2 of 5, 2 of 6, 2 of 7. Okay? Now if two people get compromised, the coins can move. So you can do 3 of 5, you can do 5 of 7, you could do whatever 5 of 9, 6 of 11, you could do whatever you want. Add that logic. Now let's take out the names and let's do hardware wallets. You create one key with a cold card, one key with a ledger, one key with a treasure. Cold card incident happens. But the cold card is not enough to move the funds because you created a 2 of 3 multi sig. So the cold card is compromised. But the attacker can't move the funds out of a two or three multi sig because they only have one. And so you are protected because you still have the ledger and you still have the trezor. And then you move the funds and you recreate one. You remove the cold card out of there. Does that make sense? So, yes, multisig is great. Now, multisig adds complexity. The scary part about multisig is if you set it up wrong, maybe the funds are never spendable. Like, what if you program it? I'm just trying to oversimplify this a little bit. But you program it to say, you know, only two of three of Jack, Dylan, and Bill can sign. But what you accidentally sent up is, you know, Jack, Joe, and John, you're like, oh, shit, I don't know Jack and John. I accidentally hit the wrong number. Now, these bitcoins can never move because you can't file a customer support ticket to the bitcoin protocol. It's all cryptography. So once you set it, you set it. So the only reason I say that is there's no silver bullet. You know, multisig adds complexity. And so which is fine. It can add redundancy and security. There's also a thing called key sharding, where to make up one key that can sign. You can shard it and split it up so you can have, you know, 12 people make up one key of a multi seg of five, right? So you could have 12 people make up one key and three of those keys of the five total. And that's like real, real, real, real redundancy. So even just to make up one signature, you need a bunch of people to go meet up in a city together with their respective pieces of the key to get the key together, to actually sign and broadcast it. There's all sorts of complexities you can add that make the security of the bitcoin extremely redundant. But the more complexity you're adding, the more expertise is required because you must get it right. Any mistake could potentially lose the coins forever. So that's why I'm just always very careful at just acknowledging that, because if you send novice folks out rogue and say, yeah, go Google multisig and give it a try, you might end up losing bitcoins. So that's why there are vendors out there that help people do multisig. So what is bitkey? Bitkey is two of three multisig, where one of the keys is on the device that you buy another key is on your phone with the app that you download and then the third key is with the company, with Block itself. And there's two of three. So you know, if you have the device and you have the app on your phone, you can move it, you know, now there's a little, there's some, a little bit of trade offs. Bitkey is optimized to be more of a mainstream product, but that's kind of the idea. You guys get the idea. And there's all sorts of really cool stuff you can do. Now bitcoin again, the fact that a money has a programming language, how cool is that? I cannot program gold to do shit. It sits there, it's just mother nature, it's just sitting there. So it's unbelievably cool. I think we've only scratched the surface of what's possible with all of the tools and the services that Bitcoin companies and all of us can build. I mean I'm. You'd have to daydream a bit to think what are our grandchildren going to be using? Who knows, how exciting is that to think about. But it adds complexity and needs to be done with care. What do I think about BitKey? Kind of answered that. I think BitKey for beginners, great. I think Block is great. I think they're a great company, they do a lot for bitcoin. Would you say a hardware wallet should be open or closed source? Open source for sure. Like what? Trezor for example. So from my understanding, Trezor, open source, their firmware and by open source, truly open source, like anybody can use it. Guess who used it? Coldcard. So Coldcard took the code, started using it and again, this is really important because now there's multiple people incentivized in the success of the code. So you're getting multiple businesses, multiple developers, lots of researchers all vested in and incentivized for this thing to work. Not just like a small team, right? Then what happened is someone took Coldcard's open source code and started using it and Coldcard didn't like that. So they changed the license on their code and they changed it from like truly open source MIT license to commons clause license, which it's open to the public, but you can't actually use it or else you get in trouble. And that is where the bug was actually introduced. But no one caught it because no one was really allowed to care. So Trezor has been doing it, in my opinion, like the right way. Truly open source. Lots of people use the firmware, lots of eyeballs on it. It's been battle tested and a lot of people are incentivized to ensure that it's successful. So yeah, I would say open source, to be honest. I wouldn't really trust hardware wallet that is closed source because think about it, you don't get to see and validate and nor does anyone else how your large random number is being generated. Fuck that. Gotta be crazy. Jack, what do you think about the trade offs of single sig multi sig multi vendor. Yeah, so I kind of have talked about this. I don't want to be too repetitive, you know, single sig I think is great because it's simple. Can you generate a really large, really random number and then can you make sure that nobody else but you ever knows what it is? Really simple, you generate it once and then, I don't know, you laminate it, you put in a safety deposit box and you move on with your life, whatever. Now there's not a lot of redundancy. If something goes wrong, if it gets compromised, if your number wasn't large or random enough, then yeah, there's no two of three protection, there's no key sharding, there's no vendor that you, there's no customer support you can call like strike to say, hey guys, can you help me out real quick? I accidentally screwed this up. So you're not a customer of anyone else, you're a user of the Bitcoin protocol and there's not a lot of fail safes there. Now you can do multisig, you can add a lot of logic and complexity and new cooler features, but it's more complicated. And you know, you can be a customer of another business to do that and you can pay for it and sacrifice maybe a little bit of privacy or you can try and do it yourself. But that raises the bar of the level of expertise and time investment from you. So I, it's, it's all trade offs guys. And I think that the market will continue to grow and fill, fill a void of allowing people to sleep well at night. There's going to be people that don't want to trust themselves, don't want to be experts. There's going to be people that are more than comfortable saying I generated my large random number. I know I did a good job. I used bitcoin core offline and then I made a bunch of backups of that. I laminated it. It's in a vault, it's in a safety deposit box, it's buried in my backyard. And I'm comfortable with that. You know another thing guys you can take. So think of it this way. You can generate 10 single SIGs using different vendors, you know, one dice roll, one Bitcoin Core, one Trezor, one Ledger, and have 10 different large random numbers generated by in 10 different ways that use true randomness, true entropy. And that way if one of the single SIGs fail, it's 10% of your stack and you're, you're hedged that way. Another way to hedge is to use multisig, right, and say, well, one's compromised, they still can't spend, so there's a million different ways. You know, I almost want to, maybe I should create like a visual diagram of the trade offs and it just depends on what you're optimizing for, what you're scared of, what you want to protect against, where you think you're weakest, what level of expertise you are if you're willing to be a customer of someone and kyc onto a platform. Right? Okay. Okay, Strike. Questions? Hey Jack, I love this show. What are your thoughts on the BTC Pay server situation and how is STRIKE ensuring the security of users Bitcoins with all these AI enabled hacks? I. Yeah, I talked about this a little bit. I think the BTC pay server situation's unfortunate. Obviously it's clearly a function of this AI world we're living in where access to frontier AI models is bringing the cost of finding these vulnerabilities to near zero. And open source projects are very vulnerable because the attacker has access to as much information as the defender. And if the defender does not have the resources and the funds available to basically do what the attacker's doing, but in an effort to defend themselves, then there's an opportunity where the attacker is actually better positioned to find a vulnerability before the defender. So. And that wasn't always the case, at least at this scale. So that's basically what happened from my understanding. Obviously a lot of things to be thankful for and proud of. I think BTC Pay Server handled it the best way they can. I think the Bitcoin red team continues to be a positive for the space. And how is STRIKE ensuring the security of our systems? We have a automated red team of agents that work 247 to do exactly what this Bitcoin red team is doing. And they've been doing it for a long time now, which is constantly battle testing our systems. Agents are first class citizen at strike, so we have all sorts of agents that are testing all sorts of code paths and dependencies because Security, the name of the game is really using the tooling to find the issues before an attacker does. And again, it's really interesting. Open source projects carry a totally different profile than closed source. So strike is a business, so we have money and capital to fund these AI token developments. Whereas open source projects don't have a native business model. They rely on donations and donors. And our source code is closed source. And so it's actually not true that attacker knows more about our systems or as much about our systems as we do. It's the opposite. So in many ways businesses in closed source actually have an advantage a little bit. Now open source, something like bitcoin core has an advantage over everyone because there's a trillion dollars that relies on bitcoin core. So everyone has invested in interest in it. You know, I, I don't think a trillion dollars has a vested interest in, you know, any bitcoin exchange. But I digress, that makes sense. But you know, strike we, we use automated red teaming of AI agents to secure our systems. So far it's worked very well for us. Could Strike create a way to send bitcoin to someone who doesn't yet have a strike account? Imagine sending them a strike link. Yeah, definitely. All of this kind of comes down to priority and what customers would value most from us. Especially in the wake of this cold card stuff. You know, we've gotten a lot of demand from institutions and even just plebs of securing bitcoin, multi sig, collaborative stuff, insurance. So we are definitely, when it comes to, we're about to release, you know, things like interest on cash, we just released beneficiaries, we're doing a lot for EU uk. There's some roadmap items coming up. We're translating our app, I think Spanish, French, German. So there's a lot of stuff coming in the immediate term. And then over the coming months we're starting to take a look at the roadmap again and say, hey, have things changed? Is this cold card incident a big wake up call for the space? Is there a way that we can step in and be more helpful than we already are? And so, you know, maybe something like strike links makes the cut. Maybe it's something for a bit later. There's a lot of exciting stuff we could do. But as always, you guys let us know what you want and we work for you guys. And really our job is to see of all the things everyone's asking for, what, what do we hear the most about and what are people really saying, hey, you know I can wait on a Strike link, but what I really need is a variety of Strike custody products. Like that would really make me sleep better at night and make me feel better. So we'll see. We're hearing a lot about custody and services for institutions, but in plebs. But in that space, we'll see. Okay. Oh, wow. Only three questions left. Is it possible for STRIKE to ever accept Zelle? Yeah, I'll take a look. I remember years ago we tried to. And I think we were close, so I would assume it's only gotten easier, but who knows? Zelle is like a consortium of banks, so it's really up to the banks. It's not like an open payment standard by any means. So I can. I can take a look. Okay. Two questions labeled other, which are usually random questions. I'm a little nervous to read these. Jack, what are your thoughts on God Sl. The existence of a creator? Someone superior to Satoshi. Wow. Why did Dylan include that? I have no idea why Dylan did that. I. I don't. I honestly don't know how much I want to share here. I. I can tell you guys this. I. I was not raised a very religious, so. But, you know, I do believe in a greater existence, so I'll just leave it at that. Not really part of my life that I want to share on the Internet. At least not right now. So that'll be my answer. Dylan, question for Jack. Can you share more about your AI setup for personal use and whether you've made any changes, slash upgrades recently? Yeah, I feel very blessed to work with the technical team at strike. I always have some of the latest and greatest AI goodies. I use both anthropic and OpenAI. Now, obviously, we use Kimmy K3 and. What's the other one? Queen. Something like that. Starts with a Q. It's newer. Newer Chinese one. I. I use Mac Whisper for my text to speech, or. Excuse me, speech to text. Although Kali just came out with something new, which looks kind of cool, so I might be upgrading to that. Hmm. I'm trying to think. I mean, I use VS code as my dev environment. That kind of hooks into all my agents. So in my VS code, I've got access to all the OpenAI agents, all the anthropic agents, all the agents that I need, and I can select depending on the task I'm doing. So I literally hold a key on my keyboard and I talk to my computer, and then it transcribes it into text, and then I can select which agent should perform the task. And each agent is better at certain things than others. Or if I don't really need a lot of expertise, then I might as well use one of these open source Chinese ones because it's so much cheaper. You know, if I'm like talking to it about making a slide or like changing the color of something, I don't need to be paying American prices. But if I need to do like really difficult research, maybe I want to pay for higher premium. But that's my developer environment, I think. Oh. I mean, I do really like Anthropic's design beta thing. I use that a lot. Maybe I'll do a bit deeper dive on AI, but if you guys have any specific questions, let me know. I would say my environment has gotten fairly complex and I don't remember the last time I gave you guys an update. So I don't want to spend 20 minutes because it also might be a little bit complicated. But give me some specific questions for next episode and if you guys would be interested in like, you know, me walking through my AI setup, I could certainly do that. Okay, that's all I got. Appreciate you guys. Let me know. Hey, give me feedback. The last two episodes been very current in the moment, Bitcoin specific. Hopefully this was helpful and useful. Hopefully also gives you a little bit of confidence. Bitcoin's gonna be okay. We're gonna survive this as an industry. We're becoming more secure. I think bitcoin is a leading indicator of where the world is going always. So I more vulnerabilities to be found outside of bitcoin sometime soon. But yeah, we can get back to macro. I can keep doing this. I appreciate all the support. Hopefully my mic sounds better and I appreciate you guys keep building. Stay humble, stack stats. Don't let this market scare you out or wear you out. Better days are ahead. Much love. Take care. Peace.