On June 1, 2025, Elon Musk announced the rollout of XChat — a new encrypted messaging application built, he said, on 'a whole new architecture' written in Rust, featuring 'Bitcoin-style encryption,' vanishing messages, voice and video calls, and file transfers. No phone number required. No ads. No tracking. Fully end-to-end encrypted.
It launched for iOS in late April 2026, after scaling delays pushed the original date back nearly a year.
This Old Goat has a few questions.
I. The Architecture of Reassurance
The phrase 'Bitcoin-style encryption' appeared in Musk's announcement post and spread instantly through the technology press. It sounds authoritative. It implies mathematical certainty. It invokes the most famous decentralized ledger in history.
Security researchers immediately noted the problem: Bitcoin's cryptography secures transaction verification on a public ledger. It does not make that ledger secret. The entire blockchain is visible to anyone. 'Bitcoin-style encryption' — applied to private messaging — is a category error. It is, as one expert put it to The Register, not end-to-end encryption. It is a marketing claim wearing technical clothing.
"XChat looks to be just another centralized platform where users have zero control over their data. No technical transparency, no audits, no open source — just marketing." — Matthew Hodgson, CEO of encrypted messaging platform Element
Kaspersky's security team confirmed in late April 2026, after examining the live app, that using actual end-to-end encryption in XChat requires both users to have an X account, to have set up XChat, and to have some form of prior connection on the platform. Conversations between users who do not follow each other may not be covered by E2E encryption at all. Standard chats, legacy conversations, and unconnected users appear to fall outside the protection Musk described.
Apple's own App Store privacy labels for XChat indicate the app may collect user data including location, contacts, and search history. This is the 'no tracking' app.
II. The Man Holding the Key
The technical critique is the minor concern. The structural one is the reason this dispatch exists.
At the moment XChat was rolling out its 'private' messaging infrastructure, the man behind it held — simultaneously — the following positions:
The expert who flagged XChat's encryption concerns did not stop at the technical. He cited Musk's DOGE position directly — the allegation that Musk had access to sensitive government data and the personal information of US citizens — as a reason to question whether XChat provides the protection it claims. Orbit Network →
The Washington Post reported in May 2026 that federal agencies were actively stonewalling the Government Accountability Office's investigation into what sensitive information Musk and DOGE employees accessed. The GAO stated that agency cooperation was essential to fulfilling its statutory audit responsibilities. Several officials refused to provide documents.
III. The Everything App and Who It's For
XChat is not a standalone product. It is one layer of the 'everything app' architecture Musk has been constructing since acquiring Twitter in 2022 — modeled explicitly on WeChat, China's super app that integrates messaging, payments, social media, government services, and commerce into a single platform under a single company's terms of service.
The payment layer is called X Money. As of April 2026, X has secured payment transmitter approvals in most US states, with several key jurisdictions still pending. Once active, financial transactions will flow through the same infrastructure as the messages.
The AI layer is Grok, built into XChat. Every conversation happens inside an application that also hosts an AI assistant trained on X's corpus of public and private communications.
The identity layer requires an X account — no phone number, but full platform account — which means every user is already inside the data graph before they send their first 'private' message.
Musk framed the goal as creating the 'least insecure' messaging platform rather than claiming absolute security. That is a precise and careful formulation. It is not the same as private.
IV. NSPM-11 and the Single Vendor Problem
On June 5, 2026 — the same day XChat was being cited in real-world security analyses — President Trump signed NSPM-11, the National Security Presidential Memorandum mandating AI adoption across all national security agencies.
The directive includes a supply-chain resilience requirement: reduce single-vendor dependence. The irony is documented. Anthropic was banned from Pentagon contracts in February 2026 after refusing to enable mass surveillance and autonomous weapons deployment. That ban created a single-vendor dependency on OpenAI — precisely the concentration NSPM-11 claims to address.
OpenAI's Pentagon classified network deal was announced the same day as Anthropic's ban. The infrastructure that powers OpenAI's data center ambitions includes Oklo nuclear reactors — whose executives sold stock at peak prices before DOE contract announcements — and compute hosted on SpaceX's Colossus cluster. Suspects →
Musk's infrastructure is now beneath OpenAI, Anthropic, and Google simultaneously. All three are Vera Rubin GPU customers. All three connect back to SpaceX compute. NSPM-11 mandates multi-vendor AI adoption. Musk is the single vendor beneath the multiple vendors.
SPACEX COMPUTE
SPACEX COMPUTE
TARGET RAISE
VENDOR BENEATH ALL THREE
V. What Private Means Now
Signal is private. WhatsApp is substantially private. XChat is a private-branded product operated by a centralized platform whose owner has documented access to federal databases, whose encryption does not cover all users or all conversations, and whose business model converges messaging, payments, identity, and AI assistance under a single entity.
The question is not whether Musk is reading your messages. The question is whether the architecture makes that possible, who else has access to that architecture, and what federal or commercial obligations apply to an operator simultaneously positioned as a private sector executive and a government official.
Those questions have no current answer. The GAO is still trying to find out what DOGE accessed. The agencies are still stonewalling. The audit is ongoing.
Meanwhile, XChat is on the App Store. Pre-orders are open. The retail tranche of the SpaceX IPO — 25% to 30% of a $75 billion raise, specifically marketed to ordinary investors — opens next week. SpaceX IPO →
One man. Every layer. The encryption is 'Bitcoin-style.' The oversight is wherever you left it.
XChat's encryption claims are not supported by independent technical audit. E2E protection is conditional on platform connectivity. App Store privacy labels indicate data collection the product's marketing disclaims. The operator simultaneously controls federal database access, classified AI infrastructure contracts, and the single compute layer beneath the three largest AI companies. The GAO investigation into what that operator accessed in federal databases is being actively stonewalled.
The product is private. The platform is not. The operator is both.
"The noise is the point. The scaffolding is the story."
Behind the curtain, no wizard to find. Just a thunder organ, a wallet, and scaffolding left behind.