What is BAT-BMS, Chinese app bringing Indian streets to a standstill?

Videos flooding social media over the past week show a deeply unsettling scene: a person walks up to a moving e-rickshaw, opens an app on their phone, taps a button — and the vehicle dies. The driver, mid-route, is stranded. Some drivers are filmed crying. Others are seen pushing their vehicles home by hand. The app at the centre of these viral clips is called BAT-BMS, developed by Shenzhen Grenergy Technology in China, and what it has exposed is not just a viral prank — it is a structural vulnerability sitting inside millions of electric vehicles on Indian roads.

What Is BAT-BMS?

BAT-BMS is a battery management system application built to wirelessly monitor Bluetooth-enabled lithium battery packs. Its intended use is perfectly legitimate: solar installations, marine systems, off-grid power setups. The app lets a technician check a battery's charge level, voltage, current draw, temperature, cycle count, and individual cell health — all over a Bluetooth connection from up to 15 metres away. It was never designed to be pointed at a moving vehicle on a public road. But a design flaw in the batteries used by Indian e-rickshaws made that possible.

The Bluetooth Gap Nobody Fixed

Millions of e-rickshaws in India run on budget lithium battery packs sourced from Chinese manufacturers. These packs come fitted with a Battery Management System chip that includes a standard safety feature called the discharge switch — a function designed to let mechanics safely cut all power to a battery before performing repairs. The problem is that the Bluetooth module attached to these BMS chips is left entirely unsecured. No username. No password. No authentication layer of any kind. When that unprotected module broadcasts its Bluetooth signal — which it does constantly, within a roughly 15-metre radius — any compatible app within range can connect to it. And once connected, any user can trigger the discharge switch. The motor controller loses power instantly. The vehicle stops.

Who Is Affected — And Who Is Not

The vulnerability does not apply to every e-rickshaw on the road. Vehicles running on older lead-acid batteries — still very common in India — have no Bluetooth component and are entirely unaffected. E-rickshaws with lithium batteries that use proprietary BMS software, or whose Bluetooth modules have been properly password-protected, are also safe. The danger is specific to the large segment of the market that runs on cheap, mass-produced lithium battery packs with generic BMS chipsets and no security configuration. Experts note that the pranks circulating online are also harder to execute than the short videos suggest — connecting to a moving vehicle in traffic, locating the correct device among multiple signals, and triggering the switch without the driver noticing all require proximity and a few seconds of deliberate action. But that does not make it safe.

Banning The App Changes Nothing

Following the viral spread of the videos, BAT-BMS has reportedly been removed from Apple's App Store. It remains available on the Google Play Store. But here is the problem with the ban-the-app response: BAT-BMS is not unique. There are thousands of generic Bluetooth BMS monitoring applications available across the App Store, the Play Store, and third-party APK repositories. Any app that can communicate with a standard BMS protocol over Bluetooth can, in principle, trigger the same discharge switch. Removing one app from one store does not close the vulnerability — it just changes which app someone uses to exploit it.

AI Can Rebuild It In Under Five Minutes

The situation is made structurally worse by the rise of AI-powered app generation tools. Platforms like Mythis and other vibe-coding AI builders can take a simple prompt — ‘build a Bluetooth BMS controller app that connects to lithium battery packs and allows toggling the discharge switch’ — and generate a fully functional Android or iOS application in minutes. No coding expertise required. No app store submission needed; the output can be side-loaded directly onto a phone. This means that even if every existing BAT-BMS clone were simultaneously removed from every platform on earth, a replacement could be operational in the time it takes to make a cup of tea. The app is not the attack surface. The unprotected hardware is.

Drivers Pay The Price

The human cost of this vulnerability falls entirely on e-rickshaw drivers — some of India's most economically vulnerable gig workers. A driver whose vehicle is remotely stalled mid-route loses the fare, loses time, risks the safety of passengers, and faces the prospect of either pushing a several-hundred-kilogram vehicle through traffic or waiting for a mechanic who may or may not know what has happened. Viral videos show drivers who have no idea why their vehicle has stopped, with no way to diagnose the problem without technical assistance. Tech creator Abhishek Bhatnagar, who investigated the issue, pointed out that the responsibility cannot be placed on drivers: they have no reasonable means to configure Bluetooth security settings on their battery packs. The dealers and manufacturers who supply these vehicles and batteries should have done it before the sale.

The Fix Is In The Hardware, Not The App Store

Cybersecurity experts watching the situation have been consistent: the only real solution is to secure the BMS hardware itself. Battery packs need to ship with Bluetooth modules that require authentication before any command can be issued. Manufacturers need to set unique passwords before batteries leave the factory floor. Dealers need to verify that security is active before delivering vehicles to drivers. India has no current regulatory framework requiring any of this for EV battery hardware. The government has not issued a formal response as of this writing. What exists is a growing number of viral videos, a lot of crying drivers, and a structural flaw in the connected mobility ecosystem that a five-minute AI-generated app replacement will keep alive indefinitely — long after BAT-BMS itself has been forgotten.