Jack Dorsey, the CEO of Block and one of Twitter's co-founders, has recently launched a new messaging app called Bitchat. Unlike traditional messaging platforms like WhatsApp that rely on the internet, Bitchat operates through Bluetooth connections.

Due to its decentralized nature, Bitchat is seen as having the potential to serve as a secure communication tool, especially in high-risk environments where internet access is restricted or closely monitored. According to Dorsey, who detailed the protocols and underlying mechanisms of the app, Bitchat’s architecture was designed with security as a primary focus.

However, the claim that the app is fully secure remains questionable, given that its source code and system have not yet undergone any third-party review or security testing. This fact was openly acknowledged by Dorsey himself.

“This software has not yet been externally audited, may contain vulnerabilities, and may not fulfill its stated security goals. Do not use it in production and do not rely on its security until it has been reviewed,” he wrote.

His statement came in response to findings by cybersecurity researcher Alex Radocea, who discovered that the app could allow someone to impersonate another user, tricking contacts into thinking they’re talking to someone they trust.

Radocea noted that Bitchat's identity verification and authentication mechanism is flawed, allowing attackers to intercept a user’s identity key—essentially the digital handshake that should establish a trusted connection between two parties using the app.

As reported by detikINET via TechCrunch, other users have also raised concerns about additional security vulnerabilities. In light of these issues, Radocea warned users not to place trust in Bitchat just yet.

“There are people who take security claims literally and may rely on this app, which in its current form could endanger them,” he cautioned.

Reflecting on his own findings and those of others, Radocea criticized Dorsey, stating, “In my opinion, Bitchat has already undergone some level of external security review—and the results were not encouraging.”