On the morning of [current_date], Indian authorities issued an ultimatum to GitHub: take down three repositories belonging to Bitchat, a decentralized messaging application associated with Jack Dorsey, within three hours. No appeal, no transparency. The stated reason? The app was used to coordinate communications during internet shutdowns in protest zones. Within the deadline, the code vanished from the platform.
This is not a smart contract exploit. It is not a reentrancy vulnerability or a flash loan attack. It is a regulatory kill switch on open-source distribution—a single point of failure that most crypto projects refuse to acknowledge.
Bitchat is not a blockchain project in the narrow sense. It is a peer-to-peer messaging app designed to bypass censorship, using end-to-end encryption and possibly a distributed relay network. Jack Dorsey’s involvement signals a commitment to decentralized communication, akin to Bluesky. The app gained traction in Indian protest circles precisely because it could operate without centralized server infrastructure. But its code distribution depended on GitHub, a US-based company now complying with Indian law.
The incident reveals the first law of crypto infrastructure security: the code does not lie, but the platform does.
The Dependency Paradox
Every open-source project that stores its primary repository on GitHub exposes itself to a single vector of censorship. In my five years of auditing smart contracts, I have seen teams obsess over gas optimization and reentrancy guards while ignoring that their entire codebase rests on a corporate server. This is the equivalent of building a vault with titanium walls and then leaving the front door unlocked.
GitHub is not a neutral platform. It operates under US jurisdiction, which has its own subpoena regime, but it also complies with foreign governments under data localization laws. India’s Information Technology Act gives the state broad power to order blocking of content. Bitchat’s takedown is not unique: Iranian, Russian, and Chinese governments have made similar requests. The difference is that crypto projects often mistake GitHub’s reliability for permanence.
The Real Vulnerability
Bitchat’s architecture likely uses P2P messaging—perhaps based on Matrix or a custom protocol. That makes it resistant to standard DNS or IP blocking. But code is not executable without the source. A repository takedown does not delete the code from every contributor’s hard drive, but it breaks the primary channel for new developers to fork, audit, and improve the software. It also signals to users that the project is toxic, discouraging adoption.
I saw a similar dynamic during the 2018 ICO death valley. A project called Aether had a reentrancy bug in its sale function. I disclosed it on GitHub, the team ignored it, and the bug was exploited. The takeaway then was that code neglect has consequences. The takeaway now is that infrastructure neglect has consequences.
From my work on the Terra post-mortem, I learned that algorithmic stability is mathematically impossible when trust is not placed in real assets. Here, the stability of code distribution is similarly impossible when trust is placed in a single corporate entity. The failure mode is different—not a death spiral, but a censorship event that slowly starves the project of new contributions.
Technical Implications
Once the repositories are down, the official lines of development are disrupted. Contributors cannot submit pull requests on the main branch. The website, if it points to GitHub, shows a 404. Users who try to compile from source must hunt for mirrors that may be outdated or compromised. The cost of entry for new developers spikes.
This is analogous to a denial-of-service attack on the project’s lifecycle. Smart contracts are immutable once deployed, but messaging apps require continuous updates. A three-hour takedown can decimate a week’s worth of collaboration. And unlike a blockchain, there is no consensus mechanism to restore the canonical code.
Regulatory Precedent
India’s action against Bitchat should alarm every Web3 builder. The MiCA regulation in Europe gives superficial clarity but imposes heavy compliance costs on small projects. India is more direct: it uses executive orders to kill tools that threaten state control. This sets a precedent that any decentralized application with a GitHub repo can be targeted, regardless of its technological merits.
But the contrarian view offers a different lens. Bulls argue that this takedown proves Bitchat’s importance—it was used in real protests, so it was worth censoring. They say that code availability is not zero: forks exist on GitLab, Radicle, and pirate servers. The censorship may actually backfire by driving the community to distribute the code across multiple platforms, making future takedowns harder.
I acknowledge that logic, but it misses the point. The goal of censorship is not to delete every copy of the code; it is to increase friction. Even if the project continues on Radicle, the mainstream developer audience remains on GitHub. Many casual contributors will never migrate. The project’s growth curve flattens, and competitors with better distribution—like Signal or Telegram—absorb the user base.
From my experience in DeFi summer, I saw how protocols that prioritized short-term incentive alignment over long-term security ended up insolvent. Here, the short-term incentive is to stay on GitHub for visibility. The long-term failure is that visibility comes with a kill switch.
The takeaway is not that Bitchat will die. It is that the crypto ecosystem must stop treating GitHub as a neutral utility. We need to treat code storage like we treat private keys: cold, distributed, and sovereign.
I do not trust the audit; I trust the gas fees. And I do not trust the platform; I trust the code that can survive a takedown. Reentrancy is not a bug; it is a feature of trust. In Bitchat’s case, trust in GitHub became the reentrancy exploit.
The code does not lie, but the infrastructure does. If your project’s existence hinges on a single URL, you have not solved censorship. You have only borrowed the illusion of permanence.