I didn't want to go into technical details yet.. but imagine that the `defense` transaction looks similar to `commitment` transaction in lightning.

In our example there will be two outputs:
1. 8 BTC for Alice - spendable without restrictions
2. 0.5 BTC for Bob
    - Alice can spend immediately if she has some secret from Bob (this way can Bob invalidate this transaction)
    - Bob can spend after `CSV_delay`

hynek

bitcoin

Quite simple idea on how to potentially bring very cheap self-custody to anyone

Trick is Bob needs to provably "defuse" `defense` or else the blackmail won't work.

Which means just a tx with a new input from Alice and new output for Bob beside the original ones. Bob can prepare everything and just give it to Alice to add their 0.9 input and sign. So either he sees the thing confirmed in an hour or so or he broadcasts `defense` and everything goes boom.