A website that openly invites hackers to steal about $2,000 in bitcoin says the prize has gone unclaimed for more than 17 hours, and an independent examination now suggests the deliberately vulnerable setup may never expose the flaws it advertises.
The challenge, at stealmybitcoin.com, reverses the usual rules of cybersecurity. Rather than keeping intruders out, it invites them in and offers a bitcoin reward to anyone who can break in and take it. The stated mission is to exploit a purposefully vulnerable PHP installation, recover a hidden Bitcoin private key and empty the wallet. The first hacker to succeed keeps the money.
A Bounty That Started Small
The prize began at roughly $500 before donations pushed it toward $2,000, or approximately 0.025 BTC. As of late Oct. 25, the wallet reportedly remained untouched after the site had been online for more than 17 hours.
The challenge comes with conditions. Participants must confine their attacks to the web application and the PHP container. Attacking the underlying host, sabotaging infrastructure or overwhelming the server is prohibited, and all activity is logged.
Two Critical Flaws, One Unexpected Roadblock
The site advertises PHP 8.4.26, a version vulnerable to two critical security flaws collectively dubbed PHP2Shell. Both carry severity scores of 9.2, and emergency patches arrived Oct. 21.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve memory-management failures that can potentially permit remote code execution. In certain configurations, attackers could execute commands without authentication.
That is where the story turns. One individual who examined the challenge publicly questioned whether its configuration actually exposes an exploitable attack surface. The individual identified nginx and PHP 8.4.26 through HTTP response headers, independently confirmed a PHP 8.2-or-newer fingerprint and compared the server's behavior against local test environments.
After initially considering nginx paired with PHP-FPM or Apache, the analysis pointed toward something unexpected: the closest behavioral match appeared to be nginx forwarding requests to PHP's built-in command-line web server.
An Entry Point in Question
The analysis raised a more provocative possibility about the site's entry point. Its responses appeared consistent with PHP's built-in server delivering a static index.html file rather than executing an index.php script. If that interpretation is accurate, the advertised vulnerabilities might not be reachable through the attack surface the challenge permits.
That would change the nature of the competition. Hackers would not necessarily be failing to exploit two critical bugs; they might be attacking an environment where the required conditions never materialize. The person behind the examination questioned whether the challenge was operating in good faith, but acknowledged the findings could be mistaken and welcomed corrections.
Response fingerprinting alone cannot establish a server's complete architecture or prove that exploitation is impossible, and the hypothesis remains unverified. The underlying PHP vulnerabilities, however, are real, and administrators running affected versions still need to patch their systems.
For now, the challenge presents a curious spectacle: a publicly advertised bitcoin bounty, a crowd of would-be hackers and a growing suspicion that the digital vault may not have an accessible door in the first place.
