Later this summer, high-profile bitcoin proponent Jameson Lopp, his girlfriend, and their dog will bid farewell to their two-story wood-frame house in Durham, NC, and take up residence at an undisclosed location somewhere in U.S. Amid threats to his safety—last year, a malicious prankster called a SWAT team to his home—Lopp has decided to “go dark,” meaning he’ll keep his new address top-secret and use a post office box for deliveries. (Despite what it sounds like, he will not be quitting the internet, where he has amassed 170,000 Twitter followers.) Then, to sniff out any potential “data leaks” that could reveal his new location, Lopp plans on hiring private investigators to find him. On top of that, he’s considering offering a bounty to any members of the public who are able to track him down and tell him how they did it.
It’s an extreme move, but Lopp is an extreme character—an impressively bearded anarcho-capitalist who once tweeted what amounts to a warning to anyone thinking of coming after his cryptocurrency: a video clip of himself wearing a MAKE BITCOIN GREAT AGAIN hat and firing a semi-automatic rifle. He’s also extraordinarily open when it comes to discussing how fellow crypto holders can protect themselves from the threat of physical attacks. “This is knowledge that makes everyone stronger if we share it,” he says, “but very few people talk about this type of thing.”
We recently spoke to Lopp, 32, about how his relatively new employer, Casa, will protect rich people’s crypto; why his paranoia has turned out to be a useful tool; and how he anticipates introducing himself to his new neighbors.
Earlier this year, you left Bitgo to join Casa, which is dedicated to helping people securely store their cryptocurrency. How does Casa work?
Casa is starting off by offering a three-out-of-five multi-signature vault, which means that there’s going to be five different sets of keys, and you need to sign with three of those keys to create a transaction. We’re leveraging the security that you get from a hardware key-signing device like a Trezor or a Ledger [wallet] and combining that with the usability of a mobile app.
There’s a lot of people out there who now have a lot of wealth in these crypto assets, but they’re not going to the fairly extraordinary means necessary to have a fully-vetted, secure, robust solution against all types of loss. So we are thinking through all the different possible vectors for loss and building that into the software to help guide the user on how they can set up a vault where they can be their own bank and have better-than-bank-grade security. They don’t have to go out and spend days, weeks, months learning all of this security and tech minutia.
Where would those five sets of keys be located?
One of them will be on your phone in the secure element. Three of them are going to be on hardware key devices—you might want to put one in a bank vault, one in an office, one in some other secure-access controlled area. Maybe a friend or family member’s house, or you could dig a hole and put it on the ground if it’s a secure area. And you can even duplicate them and have copies of each one of those and put them in even more geographically separated areas to give you more robustness. The fifth key will be held by Casa, and that enables us to facilitate emergency wallet reconstructions in certain disaster scenarios. But most of the time if you lose one of your devices, or one of your sets of keys, you’ll be able to just use the Casa app to add a new device back in and get back to your full level of security.
And how much bitcoin would I need to own to make Casa worth my while?
We’re starting out at the high end of the market and planning on working down. The price point right now is going to be $10,000 a year. So what level of assets is worth spending $1,000 a month to have a level of insurance and security for? We’re really targeting the $1 million to $100 million level mark.
How do you reach out to that demographic?
Well, Twitter’s worked pretty well so far. We actually haven’t done any marketing. We’ve just put a few things out on social media, and we’ve got waitlists that are thousands of people long at this point.
You’re a proponent of people in the cryptocurrency space talking about the threat of physical attacks. Why is that so important?
It’s kind of kind of a paradox with how we got to this current state of things. I’ve said that the most secure way that you can operate in these systems is to never tell anybody that you’re using them. Because as soon as you talk about using them, publicly at least, then you’re making yourself a target. And historically, that hasn’t been much of a problem. But after the last bubble, it seems like the criminal element is starting to catch on that these are highly liquid bearer assets and that it becomes a very tantalizing thing for physical attackers to use what they call the “rubber hose attack” or the “$5 wrench attack” on somebody until they send their crypto assets on over. My main fear is that this trend is going to accelerate unless we can create an immune response as an ecosystem, meaning that we’re going to have to have people get better security setups so that physical attacks start failing.
Last year you tweeted “Bitcoin security pro tip: protect your software with hardware,” accompanied by video of you firing an automatic rifle.
Semi-automatic [Laughs]. This is something that people in first world countries don’t think about very much. Especially if you live in a low-crime area. You don’t feel like you’re much of a target, you don’t really think about defending yourself against attackers. But as these physical attacks become more common, physical self-defense is something that we’re having to worry about. This is a near-and-dear issue to me since I’ve been specifically targeted on various occasions—even had a SWAT team show up at my house.
I know about the swatting last year—someone called a SWAT team to your house, and fortunately nothing terrible happened—but what other sort of threats have you received?
A variety of extortion-type messages saying, “We’re gonna do worse things to you if you don’t send us crypto, blah, blah, blah.” And then I constantly have people trying to break into my various online accounts. That’s been happening ever since I started working at Bitgo and became a target there.
I read in the New York Times that you plan to move to a new home and then “go dark.” Has that happened yet?
Smack dab in the middle of it right now. I’m planning on testing it in a couple of different ways. I’m planning on hiring private investigators to try to find me and track me down. And if that fails, I’m actually strongly considering doing a public bounty.
Really? Why would you encourage people to try and find you if you’re picking up and moving to a whole separate location? It seems self-defeating.
It may seem counterintuitive to publicly, you could even say, taunt people to try to find me and incentivize them to try to find me. But that’s because I know there are some people out there who are expending resources and want to find me and track me down. And so it’s better that I stress-test, and be more comfortable in the security of what I set up, than to leave it as an unknown and wait for something bad to happen.
So, say somebody does find you. Are you stuck in the same situation you were in before?
It really depends if they decided to publicly post my new address rather than accept my bounty. Then we might get into a weird situation, and we might even have to move again. But that would be a learning experience. The main point of having the bounty is to incentivize someone to tell me what data leak they found, so that I can hopefully close it. Now, if they find a data leak that I’m not able to close, then that really becomes a learning experience. This is part of the adventure of going off into the unknown.
"For most of the time before I actually had physical threats happening against me, most people would say, 'Oh, you’re just paranoid.' And now, unluckily enough, I got into a position where it has actually become useful to be paranoid."
It seems a difficult way to live if you’re expecting that somebody could come by your house threatening you at any time. How stressful is it?
It’s probably less stressful for me, because I’ve always had this kind of mindset. I was interested self-defense long before I got into bitcoin. I did a variety of training, with firearms, bladed weapons, and hand-to-hand combat at a Krav Maga school. I just always found that interesting because I didn’t want to be a victim. There’s definitely a fine line between paranoia and legitimate levels of defense. And it’s subjective. For most of the time before I actually had physical threats happening against me, most people would say, “Oh, you’re just paranoid.” And now, unluckily enough, I got into a position where it has actually become useful to be paranoid.
What is the best way to balance being a public figure in the cryptocurrency space and remaining safe?
As I said, the smartest people do it anonymously. I interact with a lot of people who I don’t know, but I know their avatar, I know their username. And that’s enough for me because they’ve built up a reputation over the years that is tied to that. Your reputation doesn’t need to be tied to your real-world, government-stamped identity. You can create as many identities as you want and build reputations around them.
Have you ever considered getting yourself a bodyguard?
I have. But it’s hard to decide where the line is to do that. I’m hopeful that all of the effort that I’ve gone to recently will make that unnecessary. But, you know, security is a dynamic, ever-evolving environment. And if we get to the end of this particular scenario, and we find that there are certain things that simply cannot be fixed to keep us sufficiently private, then having to focus more on physical security, rather than just physical privacy, would probably be the next step.
So what is your hoped-for outcome for the move?
Optimal scenario is that I have been able to cleanly cut my old life from my new life. My hope long-term for improving everyone’s security in this space is that it becomes similar to what you see with [traditional] high-net-worth individuals right now. At least in first world countries, you don’t hear of kidnappings and other types of criminal activity happening against the very wealthy. And, as far as I can tell, that is because it is just simply not feasible to try to, like, steal a baseball team from someone, or steal a bunch of bonds or stocks from someone. Once people who might want to perpetrate these type of attacks realize that the security infrastructure of the system has gotten to a point where it’s just no longer feasible to expect those kind of exorbitant payoffs, then I’m hoping that the attempts will die off.
How does your girlfriend feel about the move?
I mean, she’s glad to get away from this spot since it’s clearly compromised.
How do you think going dark is going to affect your social life?
That is another good question that I’m still waiting to figure out. How do I set up new social networks and whatnot, or do I even bother with that? To be honest, most of my social life is now with other people in this space and mostly digital, with the occasional physical meet-ups. So I don’t anticipate it being too much of a shock.
But you’re not going to be able to invite a buddy over to have a beer or something.
At least not initially. Interestingly enough, one of my attorneys who has helped me through this process said, “You know, it would be a lot easier if you just changed your name, and we create a new identity for you.” And that’s certainly a possibility, especially when it comes to interacting with new friends.
You’d consider introducing yourself to new friends under an alias?
I don’t know that it’s good to start a friendship on a lie.
[Laughs] Well, I still haven’t decided how I’m gonna introduce myself to my new neighbors and stuff. It’s a question of security. At the end of the day, I and my family are more important to me than anyone else that I meet. It’s especially been interesting when dealing with new service providers and stuff already, and they want to know my name. It’s such a common thing that when you introduce yourself to someone, the first thing you do is ask their name. And it is very awkward when you say, “Well, I don’t want to give you my name.” So it actually becomes a lot easier to just give them an alias.
You have a pretty impressive beard. Have you given any thought to shaving it to make yourself less recognizable?
I’m not at that level yet. If I’m not at a crypto-related event, people don’t know who I am. So, we’ll see. But it’s certainly a possibility.
Are you attached to the beard?
This interview has been edited and condensed. Photo courtesy Jameson Lopp.