Three GitHub repositories vanished within three hours.
Not by accident. Not by developer error. By government order.
The target: Jack Dorsey's Bitchat – a decentralized messaging app designed to survive internet shutdowns. The irony is thick enough to trade on: a tool built to evade censorship was killed at its source by the very censorship it sought to bypass.
I didn't need a court document to tell me what happened. I've seen this pattern before. In 2017, during the ETH/USD arbitrage war, I watched exchanges tighten API limits when order flow got too aggressive. The infrastructure wasn't built for the load. Here, the infrastructure wasn't built for the law.
This is not a story about protest communications. This is a story about single points of failure in a multi-chain world. And if you're running a DeFi protocol, a Layer 2, or any Web3 project that relies on centralized code hosting, you need to listen.
Context: The Bitchat Incident
On the surface, the facts are simple. India's government, citing the Information Technology Act, ordered GitHub to remove three repositories belonging to Bitchat. The official justification: the software was being used to coordinate during protests after a regional internet blackout. The repositories were taken down within the three-hour deadline.
Jack Dorsey's involvement gives the story gravitas. Bitchat is a side project from the Twitter co-founder, part of his broader push into decentralized social media. But the underlying technology remains opaque. The repositories were likely based on a P2P messaging protocol – possibly Matrix or a similar architecture – that allows messages to route without a central server. That makes it impossible to block at the ISP level, which is precisely why governments fear it.
Here's what the headlines miss: the attack vector wasn't the protocol. It was the code distribution channel. The repositories were on GitHub – a centralized, US-based platform subject to foreign court orders. Take down the source, and you halt new contributions, forked deployments, and public trust. The app still works for existing users who downloaded it, but its growth engine stalls.
I've audited enough smart contracts to know that when you can't verify the code, you're betting on trust. In 2022, during the Celsius collapse, I shorted CEL based on on-chain solvency gaps. The lesson: if the infrastructure isn't verifiable, the entire proposition is flawed. Bitchat's infrastructure was verifiable – until it wasn't.
Core: Infrastructure Dependency – The Hidden Solvency Risk
Let me be direct. This event exposes a systemic vulnerability that most Web3 projects ignore. They build decentralized applications on centralized foundations.
Consider the analogy to stablecoins. A decentralized asset that is backed by a centralized reserve is still centralized. The same logic applies to code: a censorship-resistant application whose code lives on a censored platform is not censorship-resistant.
I spent 2020 farming UNI on Uniswap V2. I learned that impermanent loss is a calculable risk. You model it, you hedge it, you accept it. Infrastructure dependency is the same. If your code repository can be taken down by a single government's order, you have a risk. Model it. Accept it. Or fix it.
Here is the forensic breakdown:
- Primary risk: Github is a centralized gate. The Indian government did not need to break encryption or infiltrate the network. They used a legal letter.
- Secondary risk: No redundant code hosting. The repositories were likely not mirrored on Radicle, Arweave, or even GitLab. One takedown, zero fallback.
- Tertiary risk: The project's developer community depends on discoverability. New contributors find projects by browsing GitHub. Remove the repository, and you choke the pipeline.
During the 2024 Bitcoin ETF infrastructure play, I invested in B2B blockchain companies that focused on compliance and custody. The winners were those who built redundancy into every layer – multiple custodians, multiple oracles, multiple settlement rails. Bitchat had one code host. It failed the first test.
This is not a flaw of Bitchat alone. It is the norm. Most Web3 projects that claim they are "unstoppable" actually run on AWS, use Infura, and host code on GitHub. They are one compliance order away from a fork failure.
Contrarian: The Real Battle Is Not Against Governments – It's Against Your Own Dependencies
Retail commentary will frame this as a free speech issue. "India is censoring dissidents." True, but it's a distraction. The market doesn't care about the morality of the Indian government's action; it cares about the execution risk.
Smart money understands that the real adversary is not the state but the architectural oversight. The same way liquidity dries up before a margin call, developer interest dries up before a repository takedown. The panic is not about the protest; it's about the pipeline.
I saw this play out in 2020 with Uniswap V2. When liquidity mining APY spiked, everyone rushed to farm. But the minute incentives dropped, TVL collapsed. The real value wasn't in the tokens; it was in the infrastructure that made the token distribution possible. Bitchat's value was in its code distribution. Once that was severed, the project's growth narrative died.
Here is the contrarian angle: This takedown actually validates the need for decentralized messaging. If India didn't perceive Bitchat as a threat, they wouldn't have ordered its removal. The censorship resistance works because it was targeted. But that doesn't mean the architecture is sound.
The real lesson is that a censorship tool must itself be censorship-proof at every layer. If your code relies on a centralized platform, your product is not censorship-resistant. It's government-tolerant.
I can already hear the arguments: "But GitHub is necessary for collaboration." No. It's convenient. Radicle exists. IPFS exists. Arweave exists. The lack of adoption is not a technical problem; it's a prioritization problem. Teams prioritize speed over resilience.
Takeaway: Fork the Code, Fork the Host
Bitchat's story is a reminder that the real battle is not against the government; it's against your own dependencies.
I built automated trading bots in 2017 that relied on centralized exchange APIs. When those APIs were throttled, I lost 20% of my positions within hours. I learned then: never build on a platform you don't control. Every core component must have an alternative.
If you are running a Web3 project today, audit your infrastructure dependencies as rigorously as you audit your smart contracts.
- Host your code on at least two platforms, one decentralized (Radicle, Arweave).
- Ensure your documentation and build instructions are backed up on a distributed IPFS pinning service.
- Maintain a mirror on a git server in a jurisdiction that opposes censorship.
Because the next government order won't give you a three-hour warning. It might come in three minutes.
And if you're building the next censorship-resistant app, remember: your fork is only as strong as your host.
I didn't wait for the Celsius collapse to learn about solvency. I checked the on-chain data before anyone else. You should check your infrastructure before the repo goes dark.
Bitchat's code may be gone from GitHub, but the lesson remains. Infrastructure is reality. Code is law only if you can access it.