"Steal My Bitcoin" Challenge Solved: Hacker Exploits PHP2Shell Vulnerability to Claim On-Chain Reward

Recent exposures of multiple severe network vulnerabilities have drawn significant attention, particularly a remote code execution issue affecting a large number of PHP websites (commonly referred to by the community as PHP2Shell, with public identifiers including CVE-2026-109618 and CVE-2026-109619).

Amid heated discussions, some questioned whether the vulnerability was merely theoretical, leading to the setup of a public challenge website, stealmybitcoin.com. Key material related to Bitcoin was placed on an intentionally unpatched server, accompanied by an on-chain reward pool inviting the public to attempt to retrieve it.

This "Steal my Bitcoin" challenge was initiated by the Hacker News account cloudlandsdev as an open CTF, rather than an exchange or bounty platform incident. Public contributions pushed the reward pool to approximately 0.02511679 BTC (around $2,000 USD). According to the official website, the challenge ended after running for approximately 19.28 hours; the winning time was October 25, 2026, at 15:47 UTC (11:47 PM Hong Kong Time on the same day), won by the public account @killa (HN: killaonx). The organizers subsequently confirmed that the server initially held a wallet-branch key rather than the key for the funded address itself, with the reward pool transferred out manually following verification. The remaining balance of the challenge address bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqy was subsequently reduced to zero, with the on-chain transfer occurring slightly later than the win time stated on the official site, consistent with the "verify first, then transfer" approach.

Crypto HK would like to remind all users and partners that once public-facing applications hit known high-risk components, the remediation window is measured in hours; cryptographic keys for accessible funds should not be placed in the same trust domain as public websites or API hosts. Any transaction should adopt offline signing, custody, or strict minimal privilege, and official patches should be applied as quickly as possible.

References: https://stealmybitcoin.com/ , https://news.ycombinator.com/item?id=50224916 , https://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqy