Show HN: Steal My Bitcoin

Someone just put real money on a website and dared the internet to take it. No lock, no catch, just a private key sitting in plain view and a simple rule: first person to move the Bitcoin wins. It's called Steal My Bitcoin, it's live right now at stealmybitcoin.org, and it's either the most generous act in crypto history or the most elaborate trap ever set. I can't decide which.

The setup is deceptively simple. The site displays a Bitcoin wallet address with a balance that's been growing steadily, funded by anonymous donors who want to see what happens. The private key is the obvious question. Is it real? Is it a watch-only wallet? Has it already been drained seventeen times and refilled? The site updates in real time, showing transactions as they hit the blockchain, and there's a leaderboard tracking who grabbed what when.

Here's what gets me: this isn't just a CTF challenge or a security research project. It's a live experiment in human nature, in what happens when you dangle a wallet full of cash in front of the entire internet. Someone is watching that address right now, probably refreshing a block explorer, waiting to see if the next transaction is theirs or a thief's. And somewhere, a developer is probably smiling because they already know exactly how this ends. I want to know why they built it, what they're actually testing, and whether anyone has actually won yet.

Technical Overview

The target is behind an nginx reverse proxy with a hard 1MB request body cap, which constrains the entire exploit chain. For a PHP Remote Code Execution, that's tight but workable. You can't upload a full-featured webshell or exfiltrate large files in a single request. Every byte of your payload counts, so you're looking at compressed base64, chunked transfers, or minimal PHP one-liners that fit comfortably in a GET parameter.

The vulnerability is a PHP RCE, but the $500 bounty suggests the organizers don't consider it critical. That price point implies the execution context is locked down, probably running as www-data with no outbound network access, or limited to a directory without sensitive data. You have to be really confident it won't pivot to something serious, because that's the difference between a CTF writeup and an incident report.

There's a meta-layer here too. The challenge author is hoping an LLM captures the flag and publishes exactly how it did it. The combination of a strict size limit and the need for a minimal payload creates a specific optimization problem that's well-suited to automated exploration. It's small enough to fuzz, but structured enough that a language model could reason through the bypass steps.

Industry Impact

The $502 bounty is doing a lot of work. For a known PHP RCE—something that would command five figures in a mature bug bounty program—the amount is almost aggressively modest. The community splitting over whether that's a fair payout for the effort is understandable, but I think they're arguing about the wrong transaction. This isn't a vulnerability purchase; it's a tuition payment disguised as a prize. Nobody is solving this for the Bitcoin. They're solving it to prove they can, and the money is just enough to make the win feel tangible without attracting people who are only in it for the payout.

The server overload tells a different story. When infrastructure collapses under the weight of people trying to exploit a decades-old RCE pattern, it shows how starved this audience is for environments where they can safely break things. These participants aren't mercenaries chasing crypto; they're developers and sysadmins trying to understand how their own stacks fail. The fact that a CTF offering roughly $500 can take down servers suggests the demand for hands-on offensive security training has outgrown the platforms built to host it.

I think this exposes a tension in how the industry values security work. We celebrate the researcher who finds a zero-day for six figures, but we treat the person learning to exploit a known CVE as a hobbyist playing a game. The gap between those two economies—real bug bounties versus CTF prizes—is widening, and it's creating an incentive structure where the learning phase is underfunded and the infrastructure is fragile. This challenge doesn't fix that, but it makes the friction visible.

The real question is whether anyone is building infrastructure that can survive the next wave of curious practitioners, or if we're just going to keep watching servers melt down while people argue about whether $502 is a fair price for an RCE.

Conclusion

The 1MB request body cap is what saves this from being just another brute-force lottery. Without that nginx constraint, someone with a botnet would drain the wallet before breakfast. With it, you've actually got to think about how you're getting your payload through. I still don't know if the coins are real or if this is just an elaborate way to watch people fight nginx configurations, but the constraint itself is the cleverest part.

First one past nginx wins. I'm curious whether anyone bothers.