Well this is an unfortunate Bent to have to start off 2023 with. Bitcoin developer Luke Dashjr took to Twitter yesterday to make the world aware that his PGP key was compromised and that the bitcoin he held in hot and "cold" storage were stolen. Hundreds of bitcoin gone in a moment. Frightening to think about. But it seems that this situation could have been avoided by using dedicated hardware that keeps private keys and backups offline.

From what I can glean, it seems that Luke's PGP key was an essential part of his security setup, likely used to decrypt a file holding his private key information. In my opinion, this isn't the best way to secure your bitcoin. Especially if you are a public bitcoiner, which makes you a target for motivated attackers.

Luke's misfortune has brought a lot of critics out of the woodwork to denigrate self-custody. "If a Bitcoin Core developer with more than a decade can't secure his bitcoin, what makes you think you can? " The answer to that is simple, "I know I can because I have decided to use dedicated hardware devices to secure my bitcoin offline and I backup my private keys offline as well."

If you make the decision to take control of your bitcoin, which I think is a wise decision, you should do so using a device with the sole purpose of generating private-public key pairs, providing a user with addresses associated to their private keys, and giving individuals the ability to construct transactions. Every one of these processes happening on the device without ever having to connect to an Internet enabled machine that can be attacked. When it comes to backing up the private keys created with these devices, individuals should write down their seed phrases on paper or steel and secure what they wrote down as they would their most prized possessions. Ideally in a safe or a place that would be extremely hard for someone else to access.

If your bitcoin storage is set up in this way you have nothing to fear in regards to someone hacking one of your computers and stealing your bitcoin. If you can physically secure the device and the backups assoicated with the private keys it created, you should have nothing to worry about. I recommend the ColdCard as it is the most secure signing device on the market and it makes it very easy for a user to do everything they need to do offline. With the emergence of a partially signed bitcoin transaction standard that has been implemented in many different bitcoin client softwares it is very easy to contruct a transaction directly on your ColdCard without ever having to plug it into a machine connected to the internet. And with ColdCard enabling NFC capabilities in the Mk4 this process works seamlessly with a mobile phone.

If you don't feel comfortable controlling all of your wealth by yourself on a device that you have to protect there are multisig solutions that can give you some peace of mind by the nature of the way they distribute risk. If you're okay with having a trusted partner in a multisig quorum, I recommend Unchained Capital's vault product. Though, be aware that this comes with privacy tradeoffs.

Moral of the rag: don't let people dissuade you from taking control of your bitcoin because a prominent developer had his stolen. There are simple ways to have an extremely high degree of security with your set up and they are getting simpler every year.

Clip of the day...

Sjors Provoost explains why the banks should be worried about bitcoin. Subscribe to the TFTC Clips channel to get high-signal-bite-sized pieces of content.

Final thought...

Writing next to a roaring fireplace is something I could get used to.