The wallet has held exactly 100 BTC since 31 July. Mike Belshe posted the address as a rebuttal to Anthropic's disclosure that three Claude models slipped their test environments and reached real production systems.
BitGo chief executive Mike Belshe funded a public bitcoin address with exactly 100 BTC on 31 July and invited Anthropic's Claude models to try to move it. The wallet holds about $6.3 million at current prices and has not been touched since.
The dare followed Anthropic's own disclosure a day earlier. In a review of 141,006 cybersecurity evaluation runs, the company found three cases in which a Claude model reached the open internet from what was meant to be an isolated testing environment, and then went to work on real systems belonging to three different organisations. Anthropic attributed the incidents to a configuration mistake at its third-party evaluation partner, Irregular, which left the sandboxes plugged into live infrastructure.
The models involved were Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model. Opus 4.7, unable to complete its fictional capture-the-flag exercise, located a real website that shared the name of the simulated company, exploited weak credentials, and accessed a production database with several hundred records. Mythos 5 uploaded modified software to a public package repository and ran it on fifteen real machines within an hour. Anthropic emphasised that the models were pursuing their assigned tasks rather than independent objectives, and that no novel technique was involved. The doors were simply unlocked.
Belshe's response was scornful. In a post on X, he told Anthropic to stop the "we created a hacking monster" games and produce a real demonstration, then linked to the address containing the 100 BTC. His argument is that walking through misconfigured test environments is not the same thing as defeating enterprise custody, and that the two are being conflated for effect. Here is the post that has been sitting untouched at the top of his feed since:
That is a self-interested view. Belshe runs a custody business, and every institutional custodian benefits if the public separates test-environment mishaps from architectural failures. But the facts sit alongside him. BitGo's institutional wallets use a 2-of-3 multisignature scheme where the client holds two keys, BitGo holds one, and moving any funds requires signatures from both sides. An AI would have to compromise key management, hardware protections, approval policies, and human operators in the correct order, not exploit an exposed test server. The bitcoin address Belshe posted shows multi-signature protections applied, and BitGo's own S-1 concedes what any honest custodian must: that its wallets and vaults cannot be guaranteed against compromise, and that the $1.5 billion Bybit theft in February 2025 proved even cold storage will fail if the surrounding process breaks.
Belshe is not a stranger to this argument. In June he pushed back on viral claims that Anthropic's Mythos model had independently breached classified National Security Agency systems, arguing the reports mischaracterised an authorised internal exercise. His stake here is larger. BitGo, which reported $81.6 billion of client assets under custody across 5,133 clients at the end of 2025, is now a publicly listed federally chartered digital asset bank trading on the NYSE under BTGO. The challenge lands in the same week that ongoing losses from the Coldcard firmware exploit climbed past 1,367 bitcoin, a useful reminder that hardware custody itself is not immune, only that the failure modes are specific.
The 100 BTC is also a cheap public relations line. $6.3 million is small money for a firm sitting on $81.6 billion in client custody, and if Anthropic ignores the challenge, as it has so far, Belshe collects a low-cost win. If Claude were to move the coins, the loss would be catastrophic for both BitGo and the wider custody category, and Belshe's willingness to accept that risk is the point. Anyone can monitor the bitcoin address on-chain and see the wallet balance in real time. Either the coins move or they don't.
Belshe co-founded BitGo in 2013. Before that he helped build HTTP/2 at Google, one of the protocols that runs the modern web. That background matters because it grounds his skepticism in engineering rather than in corporate defensiveness. The distinction he is trying to enforce is a technical one: unauthenticated internet-facing systems with default passwords are a category apart from institutional bitcoin vaults, and treating them as equivalent risks confuses users about what real security failures look like. It also matters because AI agents are now handling real money in production: MoonPay's PayBox went live in late July giving Claude and ChatGPT a non-custodial wallet, and the framing of what an AI can and cannot do to a hardened vault is no longer academic.
The Anthropic report and the bitcoin address were both published within 48 hours of each other. One documents a genuine failure of test environment isolation. The other insists that a failure of that kind is not evidence of an AI capable of breaching production custody systems built to withstand nation-state adversaries. As of 2 August, the wallet balance was 100 BTC.
