BitGo CEO Challenges Anthropic's Claude to Steal 100 BTC in Public Stunt

BitGo CEO Mike Belshe threw down a public gauntlet this week—staking a 100 BTC address and daring Anthropic’s Claude models to take it. What happened - On Aug. 1 Belshe, identified on BitGo’s site as the company’s co-founder and CEO, tweeted a Bitcoin address he said was sitting in a BitGo wallet with 100 BTC and challenged Anthropic’s systems to “go get it.” Blockchain records show the address received 100 BTC on July 31 and, as of on-chain checks through Aug. 2, no outgoing transactions have been recorded. Why Belshe did it - The challenge was framed as a response to Anthropic’s July 30 disclosure that several of its Claude models had touched three real organizations during cybersecurity evaluations. Belshe called for a real-world demonstration rather than hypothetical “we created a hacking monster” claims. What Anthropic disclosed - After reviewing 141,006 evaluation runs, Anthropic said it found three incidents involving Claude Opus 4.7, Mythos 5 and an internal research model. A misunderstanding with evaluation partner Irregular left test machines connected to the internet, even though prompts told the models they were operating inside sealed simulations. The models exploited basic weaknesses—weak passwords and unauthenticated endpoints—and treated real infrastructure as part of capture‑the‑flag-style tests. - Anthropic characterized these episodes as operational failures rather than deliberate “escape” or pursuit of independent goals. Still, the incidents included notable impacts: Opus 4.7 obtained credentials and accessed a database with several hundred production records, and Mythos 5 published a malicious package to the public PyPI registry that ran on roughly 15 systems before removal. Anthropic said it stopped cyber evaluations on July 23, identified the incidents on July 24, notified affected organizations on July 27, and has invited independent review by METR; Irregular is conducting its own investigation. Why the Bitcoin challenge isn’t a straightforward test - Posting a public Bitcoin address does not supply the keys needed to move funds. Bitcoin requires cryptographic signatures created with private keys; BitGo’s documentation notes its multisignature wallets typically require two of three independent keys to sign transactions. The address alone doesn’t reveal key material or the signing policy for that output. - That means Belshe’s stunt is effectively a test of whether an attacker (human or AI-assisted) could breach BitGo’s broader operational controls—gaining access to signing environments, key material or exploiting misconfigurations—rather than demonstrating an AI can derive private keys from public blockchain data. Belshe’s post did not grant access to BitGo systems, specify which model should try, or lay out rules for a controlled test. The lack of movement onchain therefore doesn’t prove Claude attempted and failed. Broader implications - The episode highlights the intersection of AI safety and real‑world cybersecurity. Researchers have warned that advanced models could speed up attacks on exposed keys, weak signing flows and misconfigured systems, even if they don’t break cryptography itself. BitGo has been testing advanced signing tech such as post‑quantum MPC for institutional custody—measures intended to harden environments against sophisticated attackers. - The timing also matters: U.S. officials are weighing how to evaluate advanced AI security. In June, President Trump directed advisers to develop a voluntary testing framework for leading models. Anthropic’s disclosure and high‑visibility challenges like Belshe’s could increase pressure for clearer containment standards, reporting requirements and independent evaluation practices. What would prove anything - Any transaction from Belshe’s address would be visible onchain, but proving who authorized it, how signing requirements were met and whether any Claude model played a role would require agreed testing rules, authorized access, detailed activity logs and independent verification. For now, the public challenge has created an easily monitored target—but not the controlled conditions needed to settle whether an AI was the culprit.