Luke de Wolf's "Defending Bitcoin" Lays Out the Real Threat Landscape, From Self-Custody to Mining Centralization
Luke de Wolf, a CISSP-certified industrial cybersecurity professional and author of "Defending Bitcoin: Industrial-Grade Cybersecurity for the Monetary Grid," joined Simply Bitcoin Live to walk through the practical security decisions every Bitcoin holder needs to make, from getting coins off exchanges to the long-horizon risks of mining centralization and quantum computing.
START WITH SELF-CUSTODY
De Wolf's core message is straightforward: there is always something you can do to improve your Bitcoin security, regardless of where you are starting from. The first and most urgent step is taking coins off exchanges. The historical examples are not hypothetical. The founder of Canadian exchange QuadrigaCX died with sole control of the private keys; the funds were gone. FTX collapsed and left customers holding the bag. An exchange is a trusted third party, and trusted third parties fail.
For someone buying their first hardware wallet, de Wolf flagged one specific risk: do not buy from Amazon or eBay. Counterfeit hardware wallets have appeared on those platforms and are designed to steal funds. Buy direct from the manufacturer, or better, from a Bitcoin conference booth where you can take it directly from the vendor's hands. Before transferring any significant amount, run a test transaction and verify the backup procedure, whether that is 12 or 24 seed words or an SD card backup. An hour or two of setup time is all it takes.
PRIVACY ON BITCOIN: WHAT ACTUALLY WORKS
Bitcoin is not a privacy coin, and de Wolf was clear about the trade-off that reflects. The protocol prioritized security and decentralization over native privacy. Every privacy coin that made the opposite choice has paid for it. Zcash, the most prominent example, recently disclosed a critical bug that allowed unlimited supply inflation for years with no way to know whether anyone exploited it. Bitcoin's full auditability is a feature, not a flaw.
For practical privacy on Bitcoin, de Wolf pointed to three main tools. CoinJoin, specifically through the WabiSabi protocol now that the Wasabi Wallet coordination service has shut down, mixes coins with other users to break the transaction graph. Lightning allows off-chain movement that is harder to trace. Liquid, a Bitcoin sidechain, offers another layer. Using all three in combination, what de Wolf calls defense in depth, gives meaningful privacy against most threat models. He also flagged address reuse as one of the most common and damaging mistakes: once an address is reused, the full history of both UTXOs is permanently linked. Create a new address for every transaction.
For KYC Bitcoin specifically, users should assume that any address they withdraw to from a regulated exchange is known. DAC 8 legislation in Europe now requires exchanges to share customer data broadly, creating large honeypots. The cleanest no-KYC option remains peer-to-peer purchase from someone in your local community.
MINING CENTRALIZATION IS THE MOST PRESSING NETWORK RISK
De Wolf identified mining pool centralization as one of the most serious systemic threats to Bitcoin right now. Foundry USA currently controls over 30% of the network's hash rate, and the top three pools together hold roughly 60%. At 51%, a single entity can censor transactions and, in theory, reorganize the chain. De Wolf noted there is already evidence of a small reorg attributed to Foundry in recent months.
The practical response any individual can take: rent hash rate and point it at a pool that lets you build your own block templates. Ocean Pool is de Wolf's recommendation because it gives individual miners full control over which transactions go into their blocks, removing the pool operator from that decision entirely. If you build your own block template, no one can tell you what to include or exclude. That is decentralization in a form any Bitcoiner can participate in directly, no mining hardware required.
QUANTUM COMPUTING: REAL THREAT, WRONG TIMELINE
De Wolf gave a measured read on quantum risk. The theoretical mechanism for breaking Bitcoin's cryptography exists, Shor's algorithm applied to elliptic curve keys, but the physics has not been demonstrated at the scale needed in practice. His view: a 10-to-20-year timeline for quantum to become a genuine Bitcoin-level threat is plausible; a 3-to-5-year timeline is not, and the loudest voices pushing the shorter timeline tend to have financial interests in quantum computing companies.
The most practical step available today is address hygiene. SegWit addresses (those starting with bc1) naturally conceal the public key until a coin is spent, which removes one of the main quantum attack vectors. Legacy addresses starting with "1" expose the public key as part of the address itself, making them more vulnerable in a post-quantum scenario. Never reuse an address: spending from any address reveals the public key, and if funds are later sent back to that address, the public key is permanently exposed for future harvest attacks. Proposals for formally quantum-safe address types, including BIP 360, are in development but carry significant transaction size trade-offs.
BIP-110 AND INSTITUTIONAL CAPTURE
On BIP-110, the proposed soft fork targeting arbitrary data on the Bitcoin network, de Wolf offered one of the clearest framings the debate has produced. He supports the technical goals of the proposal and agrees that arbitrary data functions as an availability attack on a monetary system. His opposition to activation right now is not about the destination but the path. A contentious soft fork carries real risk of a prolonged chain split. The 2017 block size war produced outcomes no one fully predicted. De Wolf's position: a chain split is a worse outcome than waiting, and the current signaling will not reach the hash rate threshold needed for uncontroversial activation.
On institutional capture by Wall Street, his answer was blunt. Bitcoin is a permissionless system, which means it is permissionless for large institutions too. You cannot stop BlackRock from buying Bitcoin or building derivatives on it. The only response available to any individual is to not give them your money. Buy spot Bitcoin. Take it to self-custody. That is how you resist paper Bitcoin, and it is the only lever you actually control.
