Hacker cracks unpatched PHP challenge server to claim Bitcoin prize
A researcher successfully exploited a critical PHP vulnerability in an unpatched challenge server, recovering a private key and draining a $2,021 Bitcoin bounty.
A developer deliberately launched an unpatched PHP website holding real Bitcoin, challenging researchers and the public to test whether recently discovered PHP security flaws were exploitable in the wild. Anyone who could compromise the server and recover the private key was invited to claim the cryptocurrency prize.[1][2]
The Steal My Bitcoin challenge server was breached less than three hours after an accessible PHP page was added, according to CryptoSlate. Security researcher @killa published a proof of concept demonstrating the flaw, and the challenge operator verified the intrusion through server logs and accepted the solve despite a wallet mistake.[3][4]
A challenge dashboard shared by Crypto Rover showed that the Bitcoin was taken 19.28 hours into the challenge on Oct. 25, 2026, at 15:47 UTC. The winning exploit drained 0.02511679 BTC, worth $2,021.22 at the time of the win, leaving no remaining Bitcoin on the server.[1]
Key facts
- A developer built a deliberately vulnerable PHP challenge website holding real Bitcoin to test newly discovered PHP vulnerabilities.
- CryptoSlate reported that the Steal My Bitcoin challenge server fell less than three hours after an accessible PHP page was added.
- Researcher @killa published an exploit proof of concept, and the challenge operator confirmed the breach through server logs.
- The challenge operator accepted the solve despite a wallet mistake.
- Challenge records show the server was breached after 19.28 hours on Oct. 25, 2026, at 15:47 UTC.
- The winning attacker claimed a bounty of 0.02511679 BTC, valued at $2,021.22.
Sources 路 4 sources
- CR
Crypto Rover@cryptoroverPost on X 路
馃毃 IF YOUR CRYPTO PLATFORM OR WEBSITE IS STILL RUNNING A VULNERABLE PHP VERSION, YOUR FUNDS COULD BE AT SERIOUS RISK. A hacker just demonstrated how dangerous the recently discovered PHP security flaws are by breaking into a server in just 19 hours. Here's what happened. A developer deliberately created a vulnerable PHP website, put real Bitcoin at stake and challenged the entire internet to hack it. Whoever managed to exploit the vulnerability and recover the private key would win the Bitcoin. The challenge was designed to test whether the newly discovered PHP security flaws were actually as dangerous as researchers warned. In just 19.28 hours, someone successfully hacked the server and recovered the secret key. The prize was 0.02511679 BTC, worth around $2,021. This proves that the threat is real, not just another exaggerated security warning. Attackers exploiting these flaws could potentially gain access to sensitive server data, including passwords, credentials and crypto private keys. And if those keys are compromised, the funds they control could be stolen. If you're using a crypto platform or service that relies on vulnerable PHP servers, you should take this warning seriously.
Open source - TH
Tom's Hardware@tomshardwarePost on X 路
Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty https://t.co/AlIfPRQpTS
Open source - CR
CryptoSlate@CryptoSlatePost on X 路
The Steal My Bitcoin challenge server was breached less than three hours after an accessible PHP page was added. Researcher @killa published a proof of concept; the operator confirmed the breach, citing server logs. via @hardeyjumoh https://t.co/ahQfyNrqXI
Open source - CR
CryptoSlateArticle 路
Bitcoin hacking challenge finally falls as researcher proves critical PHP flaw is exploitable The operator accepted the PHP challenge solve despite a wallet mistake, while the harder question remains who turns discoveries into deployed fixes. Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source