Show HN: Steal My Bitcoin
- ID
- 39234
- Status
- summarized
- Published
- 25 Oct 2026, 4:30 AM
- Fetched
- 25 Oct 2026, 7:44 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://stealmybitcoin.com/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.0
- Created
- 25 Oct 2026, 7:44 AM
- Tags
- Audience
- developersvibe_coders
What happened
A public challenge site hides a Bitcoin key worth about $500 on a server, reachable by the PHP user account through a `print-flag` binary, and the first person to extract the wallet wins. The page states the PHP version was deliberately chosen from before the PHP2SHELL CVEs were released, that all traffic is logged, and that privacy is not guaranteed because other attackers may access or monitor the machine. It is a deliberately vulnerable box with a live balance readout and published terms of participation.
Why it matters
The design makes the lesson explicit: an out-of-date PHP runtime plus a secret file readable by the web user equals a readable secret, and here the secret is cash. If you deploy PHP — your own VPS, a Docker image pinned to an old tag, or client sites on shared hosting — check the PHP version you are actually running against the PHP2SHELL fixes rather than the version in your notes, and confirm what files your web user can read. Also treat the challenge server itself as hostile: it logs traffic and other players may be watching, so don't probe it from anything you care about.
Discussion angle
Is a $500 public bounty with a named CVE class a better patch-level reminder than a security advisory? Compare with how many in the room can actually state which PHP version their production or client sites run today.