AI Came for Bitcoin First | Jameson Lopp

Jameson Lopp (0:02)

The malicious threat actors aren't going to just sit on their hands and say, okay, well, that was good. No, they're going to move on to the next industry, to the next set of valuable internet connected infrastructure that they can try to siphon as much value out of as possible. So the rest of the world, of course, should always have been paying attention to Bitcoin, but they should be paying attention to it for a very different set of reasons now, because they're next. If you're not racing along with everyone else, then it's pretty much guaranteed that you're going to get compromised at some point, because there's a lot of other people out there that are actively using these tools against you.

Danny Knowles (0:50)

All right, Jameson Lopp back on the show, and wow, we have a lot to talk about. When I was going through the list of things for this show, it's basically a never-ending list.

I think probably the best place to start is just to get a 10,000-foot view of the security apparatus around Bitcoin right now and how you're looking at things. Because since the Coldcard hack, we had Rob Hamilton spin up the red team as him and Cali and a load of others doing really great work there. Then we had the Liquid hack more recently. And it just feels like the game of security, when it comes to Bitcoin, has changed entirely, or maybe it's the game of security more broadly. And what's your overarching view of everything that's happened?

Jameson Lopp (1:32)

Well, the best way I can describe the past month and a half is that my beard used to come down to here. And now it's right here. And it's because I've literally been pulling so much of my beard out over the past month and a half.

So the fundamental nature of security and cybersecurity, what not, has not changed. It is a never ending cat and mouse game, attackers versus defenders. What has changed is the velocity. And that's basically the result of the accelerating LLM iterations. Like every few weeks, a new model is coming out that is pushing the frontier forward. And the open weight models that are orders of magnitude cheaper are catching up. And so basically, the tooling that is available to both attackers and defenders in this space is surging forward. And the attackers, as is the case with most advancements, the attackers tend to be earlier adopters. They are more motivated to be early adopters of this tooling because the bounties, the return on investment is so high. And so the problem is that a lot of the defenders have basically gotten caught off guard. And we've seen an acceleration in vulnerability discovery in the Bitcoin space. And what I've been trying to tell people is that this is the canary in the coal mine.

Once all of the easy money has been picked out of the Bitcoin space, the malicious threat actors aren't going to just sit on their hands and say, okay, well, that was good. No, they're going to move on to the next industry, to the next set of valuable internet connected infrastructure that they can try to siphon as much value out of as possible. So the rest of the world, of course, should always have been paying attention to Bitcoin, but they should be paying attention to it for a very different set of reasons now because they're next.

Danny Knowles (3:49)

The reason it's clearing the coal mine is because if you get someone's Bitcoin keys then they're yours, the Bitcoin is yours.

There's very little recourse. It's very hard to actually do anything about that. But what would the next industry be, do you think? I know we've seen in the last few days that Revolute has got attacked and a load of KYC information stolen from them, but does it remain within financial systems, do you think? Or do you think that you'll see these go after the grid and power supply and things like that?

Jameson Lopp (4:18)

Yeah, I think generally financial systems will be next. Further down the line, basically any sort of system that contains personal identifiable information, things that can then be used to perform identity theft and more roundabout ways of financial theft. And then, of course, infrastructure attacks. That's going to be more of either a nation-state thing or a voluntary anarchist type of I want to screw with other groups type of fun hacking adventure.

But yeah, I mean, anything of value, and of course, over the past few decades, more and more of the global infrastructure has been connected to the Internet. So if you're connected to the Internet, you basically have a door there that billions of people can start knocking on, and now they can really automate that knocking and increase the sophistication of the discovery that they're doing by essentially leveraging these highly compressed knowledge bases into doing a lot of the technical heavy lifting for them.