TECHNOLOGY
Stealmybitcoin.com Offers About $1,000 in Bitcoin to First Person Who Hacks Its Deliberately Vulnerable Server
A site called Steal My Bitcoin has put a wallet holding roughly $1,000 on a server it says is intentionally insecure. The first person to break in and retrieve the key wins the money.
Image: IntraGoals Media
A website called Steal My Bitcoin is challenging people to hack a server and keep the bitcoin hidden on it. The first person to get the wallet wins. At the time of the draft, the wallet held 0.01250208 BTC, which the site put at about $1,005.
The key is stored on the server and can be reached by the PHP user account through a program called print-flag. PHP is a popular language used to build websites. The site says it picked a PHP version from before the PHP2SHELL CVEs were released. A CVE is a public record of a known security flaw.
The site counts the time since the last successful hack. At one point it showed 1.76 hours. The wallet balance also changed in the material provided. One version showed 0.00625104 BTC, about $502.34, with another 0.00625104 BTC listed as pending. The site says the dollar figures are approximate because bitcoin prices and fees change.
The rules limit what players can attack. They are allowed to test the web application and run print-flag inside the PHP container. They must not attack the host, SSH, Docker, Nginx, other people or third-party services. Container escapes, denial of service, resource exhaustion, persistence and sabotage are also banned.
The site calls this a free challenge of technical skill, not a random drawing or sweepstakes. No purchase or payment is required, and people should take part only if it is legal where they live. Players are told not to send their own money to the wallet.
There is no guarantee of a payout. Someone else may empty the wallet first, even if you find the key, and funds already claimed will not be replaced. The challenge may go offline, change or end at any time, and the site does not promise uptime, solvability or saved progress.
The site also warns about privacy. All traffic is logged, and because the machine is known to be vulnerable, other attackers may watch activity and data. Players are told not to submit passwords, private keys or personal information, and to use an isolated testing environment.
The site suggests that winners who do not need the money consider donating it to givewell.org. It provides the challenge as is and accepts no liability for losses or damage, to the extent the law allows. By taking part, players agree to its rules.