Jameson Lopp

The same question runs through Jameson Lopp’s work: how can we tell whether security advice still works outside a presentation? It is easy to tell people to run a node, a computer that verifies blocks and transactions, or stamp a Seed Phrase into metal. Lopp instead collects measurements, publishes tools and sends backup devices through fire, corrosion and crushing. On his personal site, he describes the goal as building technology that gives individuals greater control over their keys. [1]

Lopp has spent years moving between two worlds that initially look far apart. In one, he studies nodes, network traffic and Bitcoin Core behaviour. In the other, he asks very human questions: what survives a fire, who discovers a backup, whether an heir understands it and what happens when an attacker appears in person. He is now a co-founder and Chief Security Officer of Casa, which sells services for managing Bitcoin keys. That professional connection belongs in the context of his recommendations. [1]

His Bitcoin Information & Resources page resembles a carefully maintained library. Alongside introductory material it covers wallets, privacy, node operation, mining, Lightning Network and technical research. Its strength is breadth and the ability to show a newcomer where to begin. It remains one author’s curated selection: a link may age, and inclusion is not certification of the service at the other end. [2]

When ordinary Bitcoin Core is running, much of the interesting activity remains buried in logs or process memory. Statoshi adds richer metrics and exports them to tools that display peer connections, blocks, transactions and node performance over time. Developers and operators can see what their own machine actually experiences. The resulting graph is not a worldwide census of Bitcoin users; it describes the measured nodes and the network around them. [4]

The Statoshi repository includes an unusually direct warning: the software may not be completely stable and should not be used as a Bitcoin wallet. The distinction is sensible. Code modified for experimentation and data collection solves a different problem from software entrusted with production keys. It illustrates a broader principle in Lopp’s work: an interesting capability does not make a tool suitable for every job. [4]

Lopp’s project list includes a calculator for the cost of spending a UTXO, an unspent transaction output that holds a specific amount of bitcoin. There is also a Bitcoin Core configuration generator and a helper for RPC access credentials; RPC is the interface through which another program controls a node. Metal-backup tests and a database of physical attacks round out the collection. They are not one grand product but a workshop of aids for specific decisions. A user can change the inputs, repeat the process and see where the result changes. That ability to inspect a method is often more useful than a bare recommendation of a brand or device. [3]

His best-known work tests devices intended to preserve a Seed Phrase. Lopp heats them, corrodes them and mechanically deforms them, then asks how much of the record remains readable. Photographs of the damage tell a buyer more than the marketing word “indestructible.” A grade still describes a particular experiment, and Lopp notes that part of the rating is subjective. A different fire, longer heat exposure or another storage method may produce another result. [5]

A steel plate may emerge from a fire in good condition and still be a poor backup. If its Seed Phrase is legible to anyone who finds it, material strength provides no secrecy. If pieces are mixed up or a proprietary encoding template disappears, even the owner may be unable to recover it. Lopp therefore separates physical durability, confidentiality and understandable recovery. A sound design has to address all three. [6]

Known Physical Bitcoin Attacks collects reported kidnappings, burglaries, extortion and other cases in which attackers sought keys or forced a transfer. The point is not to frighten every bitcoin holder. It shows that digital security does not end with a password: revealing too much about one’s wealth can move an attack from the internet into the physical world. The list contains only known incidents, so it cannot yield a personal probability of attack. [7]

It is best treated as a well-documented workshop. A method explains what was tested, a repository exposes the code, and photographs reveal the actual failure mode. The reader must still map the conclusion onto a real threat model: a small mobile wallet, family savings and a corporate Multisig requiring signatures from multiple keys need different protection. It is also fair to remember that Lopp works at Casa and some of his public research touches the market in which that company operates. Context does not erase a test’s value; it helps us read it properly. [1] [3]