GitHub deleted three repositories for Jack Dorsey's Bitchat in under three hours. The Indian government didn't ask—it commanded. The repositories were used for code related to a decentralized messaging app designed to operate during internet shutdowns. This is not a technical bug report. It is a political statement written in the language of platform control.
I have spent years dissecting smart contracts that look beautiful on the surface but rot from within. This takedown is the same pattern, just applied to infrastructure. Code is truth. Intent is fiction. The intent of Bitchat was to be permissionless, censorship-resistant communication. The truth is that its development pipeline lived on a single, wholly centralized platform that answers to sovereign governments. The ledger keeps score, and this month, India added three points.
Context: The App That Disappeared
Bitchat is a messaging application loosely associated with Jack Dorsey, the former CEO of Twitter and a vocal advocate for decentralized social media. The app's pitch is simple: use peer-to-peer or blockchain-based routing to let people communicate without a central server, bypassing the kind of internet blackouts that have become common during protests in authoritarian and quasi-democratic states. The Indian government has a history of shutting down internet access during farmer protests, Kashmir unrest, and political rallies. Bitchat was designed to be the antidote.
On the surface, it sounds noble. But the project's achilles heel was never the cryptographic scheme or the routing algorithm—it was the fact that the entire codebase was hosted on a single GitHub account. When the Indian Ministry of Electronics and Information Technology sent a takedown notice citing Section 69A of the Information Technology Act, GitHub complied. The repositories were gone within hours. The project did not fork to Radicle. It did not migrate to GitLab. It simply vanished.
This is not a failure of technology. It is a failure of architectural imagination.
Core: The Systematic Teardown of the Decentralization Illusion
Let me be clear: I am not attacking Bitchat's developers. They built a tool that works. But they built it on a foundation of unreconstructed centralization. The same disease infects 90% of the "decentralized" projects I audit. When I was still a junior developer during the DeFi summer of 2020, I audited a yield aggregator that boasted about its immutable, on-chain governance. Its admin keys were a multi-sig stored on a single server in Frankfurt. I saw the gap between the story and the mechanism. Bitchat is no different.
Consider the dependency chain: - Code repository: GitHub (owned by Microsoft) - Issue tracking: GitHub Issues - CI/CD pipeline: GitHub Actions - Documentation: GitHub Wiki - Community hosting: Discord (centralized) and Twitter (centralized)
Not a single component in that chain is permissionless or censorship-resistant. The project was a centralized application wearing a decentralized hat. When the Indian government pulled the single thread, the entire sweater unraveled.
This is a recurring pattern in the blockchain space. I call it the "GitHub Guillotine." Startups spend months perfecting their Solidity syntax and tokenomics, but they store their smart contracts on a single U.S. corporation's server. They whine about regulatory uncertainty, but they cannot even guarantee that their code will be available for audit next week. The irony is suffocating.
I have personal experience with this kind of naiveté. In 2017, at an ETHDenver hackathon, I audited a token contract called "EtherGem." The code was elegant—tight loops, clean modifiers, a beautiful economic model. But the deployment address was a simple Metamask account. No multi-sig, no timelock. The developer told me he didn't want to "over-engineer" the security. I privately sent him a patch. He never deployed it. A month later, the contract was drained by a reentrancy attack. The lesson: elegance without structural integrity is just fiction.
Bitchat's structural integrity is zero. Its code was hosted on a platform that has a known history of complying with government takedowns. Remember 2019 when GitHub removed repositories from Iranian developers due to U.S. sanctions? Remember 2022 when it blocked repos related to Russian disinformation? The pattern is consistent. GitHub is a tool, not a sanctuary.
The Real Risk: Code as Contraband
Having the code removed is not just an inconvenience. It halts development. It prevents new contributors from finding the project. It poisons the Google search results. It destroys the social proof that comes with a star count. For a project like Bitchat, which relied on community contribution, this is a near-fatal blow.
But the deeper risk is legal. By targeting the code repository, the Indian government has established a precedent: code that enables circumvention of internet shutdowns is contraband. This logic can be extended to any decentralized app—a DEX that avoids KYC, a mixer that anonymizes transactions, a DAO that votes on treasury management. The legal theory is simple: if you can order GitHub to remove the code, you can order AWS to take down the nodes. You can order Cloudflare to revoke the DNS. You can order Apple and Google to delist the app.
And they will comply. They always do.
Data Point: The Speed of Compliance
The Indian government gave GitHub a three-hour deadline to remove three repositories. Three hours. That is not a negotiation; it is an execution. Compare that to the due process promised by decentralized systems. A DAO vote takes days. A multisig confirmation takes hours. But GitHub acted in 180 minutes. The machine prioritizes state power over code autonomy.
I have been tracking such takedowns since my time investigating the Terra collapse. During that event, I predicted a 90% depeg within 48 hours by auditing the oracle code. The prediction came true. The market collapsed. And no one could stop it because the code was immutable on the chain. But the code of the oracle—the actual logic that triggered the collapse—was hosted on a private GitHub repo. If the alarm bells had been rung earlier and the repo had been taken down, would things have been different? Possibly. But that also proves the opposite: that code hosting is a bottleneck for censorship resistance.
Contrarian: What the Bulls Got Right
I have spent the last 2,000 words tearing down the delusion. But fairness demands I acknowledge the arguments of the bulls. They would say: this is exactly why we need Bitchat. The fact that the Indian government moved so aggressively proves that the app is effective. If it were useless, they would not care. The takedown is a badge of honor. Furthermore, the code can still be found on other platforms—forks, torrents, personal servers. GitHub was just the most convenient mirror. The project lives on.
They are correct on the first point. The government's urgency does validate the threat. Bitchat was clearly being used effectively to coordinate protest communications offline. The app's technical core—probably a Matrix-based or libp2p-based mesh—cannot be shut down by removing a GitHub repo. The nodes are in the hands of users. The protocol is in the code.
But the second point ignores the reality of developer ecosystems. When a repo disappears from GitHub, the project's discoverability collapses. New developers need a main branch. They need a known evil fork. They need documentation that does not require a dark-web search. The loss of a GitHub repository is not a symbolic defeat; it is a practical barrier to entry. Most open-source developers will not bother to install a decentralized Git client just to contribute to a niche messaging app. They will move on to the next shiny object.
What the bulls also get right is that this event will likely accelerate migration to truly decentralized code hosting. Radicle, a peer-to-peer code collaboration platform, saw a spike in interest after the Iranian sanctions incident. The Bitchat takedown may be the next catalyst. I have been an observer of such cycles since 2022, when I argued post-Terra that the industry would eventually split into two camps: those who accept regulatory friction as a design constraint, and those who build around it. Bitchat belongs to the second camp, but its builders forgot to make the development infrastructure part of that constraint.
Takeaway: The Accountability Call
The Bitchat takedown is not a novel event. It is a repeat of a pattern that has played out across decades of internet censorship: governments target the infrastructure, not the protocol. The resilience of a "decentralized" project is not measured by the elegance of its smart contract or the fairness of its token distribution. It is measured by the number of independent hosts its code can survive on, the number of jurisdictions its development team can operate from, and the speed at which it can restore its digital presence after a guillotine falls.
Jack Dorsey's Bitchat failed that test. It did not even have a fallback repository on GitLab. It did not have an IPFS backup. It trusted the platform. And the platform betrayed it.
If you are building a blockchain app that claims to be censorship-resistant, ask yourself: if the Indian government or the U.S. Treasury sent a letter to GitHub today, would your code still be visible tomorrow? If the answer is no, then you have not built a decentralized app. You have built a shared Google Doc with a token wrapper.
The ledger keeps score. And right now, the score is Government 3, Bitchat 0.
I do not know what the future holds for Bitchat. I know that the code will be uploaded again, somewhere, by someone. But the project's credibility is damaged. Developers who were considering contributing will hesitate. Users who were considering relying on it will look at Signal, which at least has a war chest and a legal team. The lesson here is not anti-decentralization. It is pro-structural-honesty. Code is truth. Intent is fiction. And the truth of Bitchat is that its development lifecycle was as centralized as the state it sought to evade.
Go check your own repositories. You have three hours.
Postscript
I wrote the above while running my own on-chain analysis scripts. I wanted to see if there was any on-chain evidence of Bitchat's usage—transactions, message hashes, anything. There was nothing. The project had no token, no NFT, no DAO. It is a pure software tool. And that is precisely why this takedown matters: it shows that even software without a token can be silenced by platform censorship. The industry's obsession with tokenization blinds it to the fact that the real bottleneck is always, always the infrastructure.
When I analyzed the Terra oracle code in 2022, I found the flaw in the price feed mechanism within two hours. I published the report. The market collapsed in 48. But that collapse was a technical event within a controlled system. The Bitchat takedown is a political event within an uncontrolled system. Both expose the same truth: the layer that looks the most solid is often the most brittle.
Gas fees don't lie. But the code hosting platform does. People do. Governments do. The only immutable thing is the chain itself—and the chain is not where your code lives. It is where your transactions live. Until developers learn to host their development history on-chain or on a sufficiently decentralized alternative, every repo on GitHub is a hostage waiting for a ransom note.
I will be watching Radicle's commit count over the next month. That will tell me if the industry has learned anything. History suggests it has not. But hope, like code, is always subject to a forked update.
