The challenge page displays the Bitcoin address bc1qlnu5…t3cxqy and a balance checker.
STEAL MY BITCOIN CHALLENGE OFFERS $500 KEY ON VULNERABLE PHP SERVER
*A Hacker News post invites hackers to extract a hidden Bitcoin key worth about $500 from an intentionally vulnerable PHP server. The race is open, the stakes are modest, but the privacy warnings are stark.*
A Hacker News user has posted a live security challenge titled “Steal My Bitcoin.” The site promises a hidden Bitcoin key worth about $500, accessible only through a deliberately vulnerable PHP server. The author built the challenge after spending days panicking over a PHP RCE bug, hoping to see if anyone could actually exploit it.
The challenge’s rules are blunt: the first person to extract the key wins the wallet. The hidden key resides behind the print-flag binary, reachable only by the PHP user account on a pre‑PHP2SHELL version. Traffic is logged, privacy is not guaranteed, and other attackers may monitor activity. The post also nudges winners to consider donating the $500 to GiveWell.org if they don’t need it.
What is the Steal My Bitcoin challenge?
The challenge was posted on Hacker News under the title “Show HN: Steal My Bitcoin.” The author created the site to test whether anyone could exploit a PHP remote code execution (RCE) vulnerability that had caused panic for days. Participants must locate a Bitcoin key hidden on the server. The first person to retrieve the key claims the wallet. The post explicitly states that the hidden key is worth about $500. No successful hack has been recorded, as indicated by the “0.00 hours without a successful hack” metric.
How is the Bitcoin key hidden on the server?
The server runs a PHP version selected from before the PHP2SHELL CVEs were released, deliberately avoiding known patches. Access to the key is granted through the print-flag binary, which runs under the PHP user account. The binary can be invoked only via the vulnerable PHP environment, meaning any successful RCE could call print-flag and reveal the private key. The challenge’s design forces attackers to exploit the outdated PHP stack rather than rely on newer exploits.
What are the risks for participants?
All traffic to the site is logged, and the operator warns that the machine is a known vulnerable host. They cannot guarantee privacy; other attackers may monitor or intercept data. The post advises users not to submit anything they wish to keep private. This open‑door environment means participants expose their IP addresses and exploit attempts to the public internet, potentially inviting retaliation or legal scrutiny.
What happens to the $500 if no one claims it?
The author suggests that if a participant does not need the money, they should donate it to GiveWell.org, a charity that directs funds to effective causes. The post includes a direct link to the donation suggestion. This fallback indicates the challenge’s secondary goal of raising awareness about security practices rather than profit.
Frequently asked questions
How can I claim the hidden Bitcoin key?
You must exploit the outdated PHP RCE to run the print-flag binary, which reveals the key. The first person to retrieve it claims the wallet.
What is the address of the challenge wallet?
The wallet address is bc1qlnu5…t3cxqy, as shown on the challenge page.
Is participating in the challenge legal?
The post warns that the server is a known vulnerable machine and that traffic is logged, implying legal and privacy risks for participants.
The Steal My Bitcoin challenge lays bare the thin line between curiosity‑driven hacking and exposure to real‑world risks. By offering a modest $500 bounty, the author forces participants to confront the consequences of exploiting outdated software on a publicly logged server. Whether the key is claimed or donated, the experiment underscores how easily a single vulnerability can become a public playground, inviting both skillful attackers and opportunistic onlookers.
Sources: Hacker News post "Show HN: Steal My Bitcoin" (https://stealmybitcoin.com/)