BitGo CEO Mike Belshe challenged Anthropic’s Claude models on Aug. 1 by publishing a Bitcoin address holding 100 BTC and inviting the AI system to move the funds.
Summary
- 100 BTC remained in the published address after Mike Belshe challenged Claude to move it.
- Three Claude models accessed real systems after evaluation environments mistakenly retained internet connectivity during tests.
- BitGo says its Bitcoin multisignature wallets require two of three keys to authorize transactions onchain.
BitGo’s official website identifies Belshe as its co-founder and chief executive.
Belshe framed the wager as a response to Anthropic’s July 30 disclosure that Claude models accessed three real organizations during cybersecurity evaluations. He wrote that there had been “enough with the ‘we created a hacking monster’ games” and called for a real-world demonstration.
BitGo’s 100 BTC wallet remains untouched
The address received 100 BTC on July 31, according to publicly indexed blockchain reports. On-chain checks cited through Aug. 2 showed the full balance remained at the address with no outgoing transaction.
The absence of movement does not establish that Claude tried and failed. Belshe’s post did not describe an evaluation setup, grant access to BitGo systems or identify which Claude model should participate. It instead created a public, observable target whose balance can be monitored through the Bitcoin network.
Meanwhile, Anthropic said it found three incidents after reviewing 141,006 evaluation runs. The cases involved Claude Opus 4.7, Mythos 5 and an internal research model. A misunderstanding with evaluation partner Irregular left test machines connected to the internet, even though prompts told the models they were inside sealed simulations.
The models then used basic techniques, including weak passwords and unauthenticated endpoints, against real infrastructure they treated as part of capture-the-flag exercises. Anthropic said the models did not deliberately escape or pursue independent goals. It described the episodes as closer to an “operational failure” than a model alignment failure. The models also lacked the standard classifiers and monitoring used in Anthropic’s publicly available products.
In the most serious case, Opus 4.7 obtained credentials and reached a database containing several hundred production records. Mythos 5 separately published a malicious package to the public PyPI registry. Anthropic said the package remained available for about one hour and ran on 15 real systems before its removal.
The Claude challenge is not a like-for-like test
Publishing a Bitcoin address does not provide the credentials needed to spend its funds. Bitcoin transactions require valid cryptographic signatures produced with the relevant private keys. BitGo’s technical documentation says its Bitcoin multisignature wallets generally require two of three independent keys to authorize a transaction.
Claude would therefore need access to a signing environment, key material or an exploitable operational weakness. The address alone supplies none of those. Moreover, the exact signing policy behind this particular unspent output cannot be confirmed from Belshe’s post alone, even though he identified it as a BitGo wallet.
That makes Belshe’s challenge a test of whether an AI-enabled attacker could breach BitGo’s wider controls, rather than whether Claude can derive private keys from public blockchain data. A controlled comparison would also require agreed rules, authorized access, activity logs and independent verification of any attempted attack.
As previously reported, BitGo has tested post-quantum MPC signing for institutional custody. In related coverage, crypto.news examined how Claude Mythos 5 could accelerate attacks against exposed keys, weak signing flows and misconfigured systems without creating a universal ability to defeat cryptography.
U.S. scrutiny now shifts toward testing controls
The dispute arrives as U.S. officials review how advanced AI systems should undergo cybersecurity testing. President Donald Trump directed advisers in June to develop a voluntary testing framework for leading models, according to Reuters. Anthropic’s disclosure may add pressure for clearer containment standards and incident reporting across AI laboratories and external evaluators.
Anthropic stopped its cyber evaluations on July 23, identified all three incidents the following day and notified affected organizations on July 27. It said METR would conduct an independent review and that it planned to release a redacted transcript of the malicious-package incident within one week. Irregular is conducting its own investigation.
Those disclosures, rather than movement from Belshe’s wallet, are the next formal checkpoints. Any transaction from the address would be visible onchain. However, investigators would still need to establish who authorized it, how the signing requirements were satisfied and whether a Claude model played any role.
