Steal My Bitcoin

Steal My Bitcoin is a live security challenge rather than a conventional website. A Bitcoin key worth roughly $500 sits somewhere on a server, and the first participant to retrieve it keeps the wallet. The page tracks how long the challenge has run without a successful hack, making the target’s durability part of the appeal.

The technical hook is the PHP build. It was selected from before the PHP2SHELL CVEs were published, and the key is reachable by the PHP user account through a print-flag binary. That gives solvers a concrete starting point: enumerate the environment, study the PHP version’s known weaknesses, and work toward the binary rather than blindly fuzzing.

This is aimed at pentesters, CTF regulars, and developers curious about real-world PHP exploitation. Beginners can still learn from reconnaissance and privilege-escalation practice, but the reward structure favors people comfortable with reading CVEs and chaining small findings into a working exploit.

Before participating, read the warnings. All traffic is logged, the machine is knowingly vulnerable, and other attackers may access or monitor data beyond the operators’ control, so never submit credentials or private material. If you win and do not need the money, the site suggests donating it to GiveWell. Treat it as a public lab: probe freely, but assume nothing you send is confidential.