More details about stealmybitcoin in LiveOverflow's video: https://www.youtube.com/watch?v=VhNiMWtOutw

This is the winner: https://github.com/KillaBoi/StealMyBitcoin-PoC

The challenge website was not exploitable at launch because it wasn't actually running PHP; it got cracked in two hours aftewards

In the video, LiveOverflow shows his exploit that reliably gets RCE from two requests.