The Indian government just wrote a new rulebook for censorship in the digital age. A single order, three hours, three repositories removed from GitHub. Jack Dorsey’s Bitchat—a decentralized messaging project that never had a token, never ran a smart contract, never even officially launched—was effectively silenced at the source code level. The excuse? Its code was allegedly used to organize communications during the 2023 Manipur internet shutdown. The real story? The event is a perfect stress test for the ideological foundation of Web3. If a government can kill a project by targeting its code repository, then the entire concept of “immutable” open infrastructure is built on shifting sand.
Context: Bitchat is an enigma in the crypto world. Tied loosely to Jack Dorsey’s broader decentralization experiments, it had no tokenomics to analyze, no TVL to track, and no liquidity pools. Its only distinguishing feature was its timing—appearing just as India’s protest movement demanded off-grid coordination. The project’s GitHub hosted the application logic, likely based on a P2P messaging protocol (Matrix or similar) that could run outside centralized servers. On paper, it was a textbook example of permissionless innovation. But the Indian government didn’t need to break encryption or seize servers. They simply called GitHub, invoked the Information Technology Act, and within 180 minutes the code was gone. The attack surface wasn’t the chain; it was the host.
Core: This is where my autopsy begins. Over a decade of auditing crypto projects has taught me one iron rule: Complexity hides the body. Bitchat’s complexity was not in its cryptographic design—that was probably sound—but in its reliance on a centralized code repository. The same industry that screams “not your keys, not your crypto” quietly hosts its source code on a platform that answers to sovereign legal authorities. When a government demands takedown, GitHub faces a binary: comply or risk losing access to the Indian market. They always comply. Read the code, not the pitch deck — but if the code can be erased by a single call, what exactly were you reading? The real vulnerability here is not in the Solidity compiler or the zero-knowledge circuits; it is in the supply chain of open-source development. Let me illustrate with my own experience. In 2017, I spent weeks reverse-engineering a Solidity optimization that exposed an integer overflow in a staking contract. I published the findings on GitHub. If the Indian government had decided that report threatened national security, they could have throttled it the same way. The lesson is stark: the power to remove code is the power to silence innovation. A blockchain project that cannot guarantee its source code remains publicly accessible is a contradiction in terms.
Furthermore, the Bitchat incident reveals a structural flaw in the Web3 narrative: the conflation of “decentralized application” with “decentralized infrastructure.” The application may be P2P, but the development pipeline is not. Code lives on GitHub. Documentation lives on ReadTheDocs. Communication relies on Discord and Telegram—all centralized. When a state actor targets any single node in that pipeline, the entire project can be disconnected from its contributors. The DeFi community saw this with Tornado Cash’s GitHub takedown, but Bitchat is a purer example because it didn’t even involve a blockchain. It is a warning shot for every project that claims censorship resistance. Silence precedes the exploit — in this case, the exploit was the quiet removal of code while the world was watching protests.
Contrarian: Let me play the bull’s card for a moment. Some will argue that this takedown proves the exactly opposite thesis: it validates Bitchat’s purpose. The fact that a government needed to censor its code suggests the tool was effective. The episode may drive more developers to fork the repository, mirror it on IPFS or Radicle, and create a viral propagation event. Indeed, the history of censorship shows that targeted projects often gain notoriety and user base precisely because of the attempted suppression. Bitchat could rise from the ashes as a martyr of free speech. Additionally, Jack Dorsey’s reputation may attract institutional defenders who will fund decentralized hosting solutions. The bull case: this is a feature, not a bug. But I would counter that this is wishful thinking that ignores the total cost of compliance. For every project that becomes a cause célèbre, a hundred others quietly disappear. The average developer, seeing their work vanish, will simply move on. The chilling effect on innovation is real, and it is the intended outcome. Complexity hides the body — and the body here is the fledgling user trust in unstoppable applications.
Takeaway: The article we analyzed is spartan in data. We know three facts: an order, a reason, a context. That is enough to draw a line from this event to the future of blockchain development. The question every audit partner should now ask their clients is not “Is your smart contract secure?” but “Where is your code hosted and who has the key to delete it?” The industry must stop treating GitHub as a neutral utility. If you cannot fork your own repository onto a censorship-resistant storage layer, you are building on a lease, not a foundation. Read the code, not the pitch deck — but make sure you have a copy of that code that no government can reach. The next takedown will not give you three hours. It will give you zero.