Bitgo Chief Executive Officer Mike Belshe turned one of artificial intelligence’s biggest security debates into a public bitcoin challenge by placing 100 BTC, worth roughly $6.3 million at the time, into a publicly known wallet and inviting Anthropic’s Claude models to steal it. The move followed Anthropic’s disclosure that several of its AI models reached the open internet and interacted with real production systems during cybersecurity evaluations.
Bitgo CEO Funds 100 BTC Wallet, Dares Anthropic's AI to Steal It
WRITTEN BY
SHARE
Key Takeaways
- Bitgo funded 100 BTC on Aug. 1 to challenge Anthropic’s Claude models.
- Anthropic found 3 AI evaluation failures across 141,006 cybersecurity runs.
- Bitgo’s 100 BTC remained untouched as of Aug. 2 while Anthropic stayed silent.
Bitgo CEO Pushes Back After Anthropic’s AI Disclosure
The challenge began Aug. 1 when Belshe responded directly to Anthropic’s announcement describing three incidents uncovered during cybersecurity testing. Anthropic explained that multiple Claude models unintentionally reached the public internet after evaluation environments were mistakenly connected online instead of remaining isolated.
Instead of treating the findings as proof of runaway AI capability, Belshe focused on the testing setup itself. Incidents like these typically point to configuration failures rather than impossible technical breakthroughs, especially when evaluation systems are exposed to live infrastructure. To make the point measurable, he funded a bitcoin address with exactly 100 BTC and challenged Claude to move the coins.
The wallet received the funds July 31, and blockchain records still showed the full balance untouched as of Aug. 2.
Anthropic Details Three Real-World Security Incidents
Anthropic’s report outlined three separate cybersecurity evaluation incidents identified after reviewing more than 141,000 testing runs. The company said six evaluation sessions across three models unexpectedly interacted with real organizations after a misunderstanding left testing environments connected to the internet.
The models involved included Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model. Each had been assigned capture-the-flag exercises designed to locate hidden information inside fictional computer systems. Although Anthropic’s prompts stated the models were operating inside isolated simulations without internet access, the environments were actually online because of a configuration mistake involving third-party testing partner Irregular.
Claude Exploited Real Systems While Believing It Was Training
Anthropic described the most serious case as involving Claude Opus 4.7. After failing to complete its fictional assignment, the model located a real website sharing the same name as the simulated company. It then exploited weak passwords and exposed services, recovered infrastructure credentials, and accessed a production database containing several hundred records.
The company said the model continued after recognizing the environment might be genuine because it concluded the real systems were probably still part of the evaluation. Anyone who has worked through penetration testing knows this kind of confusion becomes far more likely when test boundaries are unclear, which is why properly isolated environments matter as much as the software being evaluated. Anthropic emphasized the AI was attempting to complete its assigned task rather than deliberately escaping containment or pursuing independent objectives.
Bitgo’s Custody Design Raises the Stakes
Belshe’s challenge goes well beyond asking whether an AI can exploit weak passwords or poorly configured servers. The bitcoin sits inside Bitgo’s institutional custody platform, which relies on multi-signature or multi-party computation technology that distributes signing authority across multiple independent keys instead of relying on a single point of failure.
Systems built this way are designed so that no single weakness is enough to move funds. An attacker would need to bypass key management, approval policies, hardware protections, and operational controls in the correct sequence, making the problem fundamentally different from exploiting an exposed testing environment. According to the source report, compromising such a system would require attacking multiple independent layers simultaneously.
The Blockchain Will Provide the Final Answer
Unlike many cybersecurity claims that remain hidden behind confidential investigations, this experiment is completely public. Anyone can monitor the wallet on the Bitcoin blockchain and immediately see whether the coins ever move.
The challenge also continues Belshe’s broader criticism of sensational AI security narratives. Earlier in 2026, he disputed widespread interpretations that an Anthropic model had independently breached classified National Security Agency systems, arguing the reports mischaracterized an authorized internal exercise rather than an actual external compromise. His latest challenge follows the same pattern by replacing hypothetical debates with a transparent, measurable test.
The Debate Now Extends Beyond Artificial Intelligence
The episode highlights a growing divide between demonstrations performed inside controlled research environments and attacks against production systems designed to withstand sophisticated adversaries.
For the cryptocurrency industry, the challenge also serves as a public demonstration of institutional custody architecture. A successful theft would immediately raise questions about both AI capabilities and high-security bitcoin storage. If the wallet remains untouched, supporters will likely argue it reinforces the difference between exploiting misconfigured test environments and defeating enterprise-grade custody systems.
The Bitgo executive’s challenge arrives as the recent Coldcard exploit continues to unfold, with total losses reaching 1,431.97 BTC as of 8 p.m. Eastern on Sunday. The Coldcard case has also fueled speculation about whether the breach ultimately stemmed from human error, operational mistakes, or another cause altogether, including whether AI played any role in discovering the firmware vulnerability.
Attention Now Turns to Anthropic and the Wallet
As of Aug. 2, Anthropic had not publicly responded to Belshe’s specific challenge, and the 100 BTC remained in the published address without any outbound transactions. That leaves the blockchain serving as an objective scoreboard while the broader technology industry debates what the incidents actually demonstrated.
The next developments will likely come from additional technical analysis of Anthropic’s evaluation environments, any response from the company regarding the challenge, or movement of the bitcoin itself. Until then, Belshe’s wager has turned a complex discussion about AI safety into a simple question with a publicly verifiable answer: Can today’s AI defeat the cryptocurrency industry’s institutional custody systems?
