Steal My Bitcoin: Live $500 PHP Exploit Challenge
Original: Show HN: Steal My Bitcoin
Why This Matters
Real-money CTF challenges stress-test known CVEs against live infrastructure.
A site called Steal My Bitcoin hides a ~$500 BTC wallet on a server running a deliberately vulnerable, pre-PHP2SHELL-CVE PHP version. First to exploit it via the print-flag binary wins the funds.
Steal My Bitcoin is a live hacking challenge that places a real Bitcoin wallet—currently worth around $500—on a server intentionally running an outdated PHP version predating the PHP2SHELL CVE disclosures. The wallet key is accessible only through the `print-flag` binary, reachable by exploiting the PHP user account. The site displays a live counter showing hours elapsed without a successful hack, and links directly to the wallet address on a block explorer so anyone can verify the balance in real time. The operators log all traffic and warn upfront that this is a known-vulnerable machine: other attackers may be present, and no privacy is guaranteed. Winners who don't need the money are encouraged to donate to GiveWell. The challenge is straightforward—no registration, no hints beyond the setup description.