Show HN: Steal My Bitcoin

There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.

It clearly isnt happening.

This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.

https://x.com/dguido/status/2113825891021144306?s=46

The server is getting overloaded, so here's the text for reference:

    Steal my Bitcoin
    0.65 hours without a successful hack
    
    There is a bitcoin key hidden on this server worth about $502.
    
    It is accessible to the PHP user account through the print-flag binary.
    
    This PHP version was selected from before the PHP2SHELL CVEs were released.
    
    First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
    
    All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
    Challenge wallet
    Explorer ↗
    
    bc1qlnu5…t3cxqy
    
    0.00625104 BTC
    
    ≈ $502.35 USD
    stealmybitcoin.com · Terms of participation

Yeah, the specific setup is not vulnerable to PHP2SHELL. CLI server + 1 MiB cap + inert page + high memory limit removes all the possibilities from the two CVEs. It would just be collecting POCs for actually vulnerable setups.

I have two out of five AI agents that agreed to work with me on finding the flag (wallet key). Here's the progress so far:

1. GLM-5.3: Interpreted it as a public challenge and is currently trying to find the flag. https://ibb.co/zHLJhz0B

2. GLM-5.3-Flash: Also interpreted it as a public challenge and is working on cracking it. https://ibb.co/bg2DDtXq

3. GPT-6.1-Sol: Flagged it as a cybersecurity request and directed me to register for their cybersecurity program. https://ibb.co/0j83PWn9

4. DeepSeek-v4.1-Flash (via OpenRouter): Refused to execute the exploit. https://ibb.co/QvVxnM5k

5. Claude Fable-5.1 (via OpenRouter): Returned a provider-side content filter error. https://ibb.co/39q1N1NV

All sessions with different agents are running on Tarvis (https://tarvis.io), an app I'm building. Think of it as a self-hosted version of Railway, but with a built-in AI agent and cloud development environment.

The website seems to be overloaded, and both agents that agreed to work on the challenge are now unable to connect to it. HN's hug of death, I guess.

EDIT: It's back online!

This will go unclaimed for a bit. It may still get claimed within the day, but

People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…

The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.

That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I, and many of my friends and cooks could take this easily. The difference is we know not to.

Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.

A pentesting YouTuber I once respected went deep into the AI rabbit hole and claimed yesterday he created a generic POC using ChatGPT in 2 hours to show how dangerous LLMs are [0]. After that he shilled his AI pentesting platform.

If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.

[0] https://youtu.be/SP7y1h0laN0

Suddenly all the people who claim that these PHP exploits are so easy that a baby could do it are clamming up at the opportunity to showcase it. Plenty of "I/We can do this easily, but uh.. we uhh.. don't want to right now bye" going on.

That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.

The amount of Bitcoin appears to be going up with time. It was ~$500 the last time I saw it. Now the wallet is worth ~$2000 at the time of this comment.

So the idea that is not enough money for someone to “give away” their exploit is going to reach a breaking point eventually if it continues. This might get more interesting the longer it goes on. Getting my popcorn ready right now!

Brilliant thread. Glad you did this before I did.

Hilarious to see people suddenly furtive about this easy exploit. Thanks.

Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)

Link to the wallet in case the site goes down: https://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xd...

Currently at $2k.

It could be an interesting cybersecurity technique to hide obvious crypto private keys all over.

If it gets swept you are breached.

Appreciate the commitment to the bit!

It's increased! It was $500 an hour ago and it's 2k now. I didn't bother because I figured I'm not fast enough

The account now holds about $1k USD. A second deposit landed in the account about 7 minutes ago from when I posted this comment.

EDIT: Now worth $2k

Not worth it. The biggest issue is the nginx with 1MB cap. Also in the terms, its says we can't exploit Nginx. So its a dead end.

If someone did have a working exploit, is $500 enough for them to give it away to whomever is monitoring this honeypot?

I don't think it's a good idea to front-page an exploitable site on HN. The blast radius isn't limited to the creator's Bitcoin, it also extends to zero-days against anyone visiting the site. This is true of all sites, but all sites are not built to fail while incentivizing exploits.

Nice CTF! I hope if it's captured by a LLM we'll get a write up as to how it did it.

What a fantastic test. I think this should be standard practice for zero days like this to put a practical "exploit ease" bounty out there. It would benefit the entire security community to have this information available in addition to the cve score!

If it's nginx + fpm + "empty" index.php, it's a meme and not exploitable.

edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.

Someone doubled the bitcoin amount :D

Can't hack a server if it is offline due to load. I think we've solved online security folks!

This is a form of a canary token I've been using already. The thing is that it only makes sense if the server breach is cheaper than the money into the wallet. Of course, after you fully monetize your hack, the last step would be to get the bitcoins, too, but how is this helping the owner? The good thing about the existing canary token is that they are all over the place hidden among legitimate similar records and could be harder for the hackers to tell from the rest.

I personally prefer "tripwire" than "canary token", but that's another topic.

Similarly, I've had a canary unencrypted BTC wallet in my computer for years.

I've always been security conscious and I role play my Arch as a Qubes "dom0" and use VFIO for GPU enabled VMs, which I know is not the Qubes way, but I'm also not that at risk.

Imagine 1000 people torch $100 in tokens before giving up on getting the $500 prize. Let’s go on to assume one person gets a lucky reasoning trace that nails it, then posts a blog about how they made $500 with $100.

prize is up to $2000 now, any takers? https://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xd... site is down though

Remove nginx or remove the 1mb nginx body cap. That config is already proven to be safe.

I published my version right before seeing this, its _a_ exploit for 8.2 through 8.5 for stock mod_php.

https://github.com/offline-ant/php2fix

That isn't going to work on this server because it has nginx in front with a 1mb request cap afaict.

If you want to contribute to something and get rewarded, https://nonograph.com has paid out over $30,000 this year for feature and bug fixes. (check the github)

I love it, very fun.

Isn't this Bitcoin private key “4”?

It runs PHP 8.4.26 (and nginx). Might be useful for others.

Also, the only pages I found are static and not an actual PHP entry point. If it doesn't run any PHP, it's not vulnerable to PHP2Shell. At least I think that's how it works.

I was wondering how exploitable this was. I will definitely be watching.

Do I understand it right that it can be set up in a way that if exploit is used it can be "recorded" and revealed?

You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.

The wallet address is bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqy Currently worth about $500 (checking balance)

can't people just point their AI to the latest pull request that includes the fix and ask it to deduce the vuln?

Is this a PHP PR campaign to show that everything is alright?

I remembered that there was a similar challenge for Heartbleed.

Interesting idea! Would like to know how much time need to spend.

bounty seems to have just doubled, 1000 usd now

Looks like someone just added ~$500 more to it?

Keep your hands off my Bacon!

major pain in the neck that anthropic doesn't let opus 5.5 work on this, goes back to 4.8 lame