Episode notes
Mentor Sessions EP 110: Jameson Lopp on AI Cyberattacks, Security Debt, Multisig Self-Custody & Wrench Attacks
Jameson Lopp, co-founder and Chief Security Officer of Casa, says the safest way to use a computer is to never turn it on. With Binance losing $6.3 billion and AI tools finding holes faster than anyone can patch them, decades of security debt are coming due, and Bitcoin was only the first target.
In this Mentor Sessions interview, Nathan and Jameson break down why builders need to attack their own systems with AI before somebody else does, how AI-driven worms and swarms could become very difficult to wipe off the internet, and the minimum self-custody setup Jameson suggests for anyone you care about. You'll hear why a single-signature wallet is still a single point of failure, how the Ledger supply-chain attacks and fake Trezors make the case for spreading trust across vendors, why agentic coding tools can show "malicious compliance," and why Jameson warns everyday users against pointing AI agents at their own computer. Plus: a scammer told Jameson he gets paid $850 for every Google account he cracks, and the wrench-attack repository has now passed 800 known cases.
⏱️ Timestamps:
0:00 The Safest Computer Is One You Never Turn On
0:37 Bitcoin Was Ransacked. Is Everything Else Next?
1:27 Security Debt Is Coming Due
2:55 Will We Ever Reach a Secure Steady State?
6:25 Should Software Development Slow Down?
9:46 Can New Hardware Fix Security?
12:31 Could Compilers Be Compromised?
14:14 How Lopp's Self-Custody Views Have Changed
17:55 Usability vs Security at Casa
21:52 The Minimum Setup for Someone You Care About
26:10 Miniscript, Covenants and Reactive Security
30:38 Ledger Supply-Chain Attacks and Fake Trezors
33:24 Why Multi-Vendor Multisig Wins
36:08 Inside Casa: Hacking Yourself With AI Agents
41:26 The Testing Framework That Catches AI Slop
43:29 Should You Point AI at Your Own Computer?
48:31 AI Worms and Swarms We Can't Stop
51:12 Wrench Attacks Pass 800 Known Cases
53:49 Where Wrench Attacks Come From
55:02 Actionable Steps: Update Everything, Trust Nothing
57:34 The Google Scammer Who Gets $850 Per Account
59:33 Where to Follow Jameson
Links:
Jameson Lopp on X: https://x.com/lopp
Casa: https://casa.io
Physical Bitcoin attacks (wrench attack) repository: https://github.com/jlopp/physical-bitcoin-attacks
Drop your setup in the comments: what's the one security change you're making after this episode?
⚡Previous Episode: Lepard & Valek: https://youtu.be/jTuJ8PXhRV4
Subscribe for weekly Bitcoin Podcasts
Follow on X: https://x.com/BTCSessions
Follow on X: https://x.com/theBTCmentor
⚡Casa MultiSig & Inheritance: https://casa.io/sessions
10% Off First Year Promo Code SESSIONS
⚡ Sponsored by Trezor - Get Your Safe 7 Today: https://affil.trezor.io/aff_c?offer_id=352&aff_id=1088
⚡ POWERED by Abundant Mines: Bitcoin mining for investors seeking Bitcoin ownership and potential tax benefits - https://qrco.de/bgYKPB
⚡ Sponsored by BITCOIN WELL: Best Place to BUY & SELL BITCOIN
https://qrco.de/bfiDC6
BOOK Private Sessions with Nathan, Ben and the BTC Mentor Team: Master self-custody, hardware, multisig, Lightning, privacy, and more.
Visit btcmentor.io
#JamesonLopp #BitcoinSecurity #AISecurity #Bitcoin #BTC #BTCSessions #MentorSessions #SelfCustody #Multisig #Casa #Cybersecurity #WrenchAttack #HardwareWallet #SocialEngineering
