Steal My Bitcoin
Learning and science
security capture the flag challenge
SHOW HN2026
625points
451comments
#32of 4,366 in 2026
Top 1%of 2026 by points
How HN took it
CuriousMostly questions and neutral comments
17 positive, 122 neutral or asking, 0 mixed, 71 critical, out of 210 comments about the project. Thread score -0.24.
Idea: 13 for, 20 againstExecution: 0 for, 19 againstPricing: 0 for, 8 againstPerformance: 1 for, 7 againstDesign: 0 for, 4 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Fun, clever test of how exploitable a bug really is.
From 3 comments
That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.
hau on HNWhat a fantastic test. I think this should be standard practice for zero days like this to put a practical "exploit ease" bounty out there. It would benefit the entire security…
AnneTrotter on HNI love it, very fun.
LandoCalrissian on HN
Objections
Setup with nginx and a 1MB body cap is hard to exploit.
From 3 comments
Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)
jackdecker on HNNot worth it. The biggest issue is the nginx with 1MB cap. Also in the terms, its says we can't exploit Nginx. So its a dead end.
aniketsauravv on HNRemove nginx or remove the 1mb nginx body cap. That config is already proven to be safe.
paxy on HN
Hosting an exploitable site is risky and could be a trap.
From 2 comments
I don't think it's a good idea to front-page an exploitable site on HN. The blast radius isn't limited to the creator's Bitcoin, it also extends to zero-days against anyone…
astrostl on HNThis could be a trap. Someone does the exploit, then the creator of this service logs it and uses that exploit to go after higher value targets...
aussieguy1234 on HN
Requests
Make the challenge easier or publish the source.
From 2 comments
Update: Did not expect the amount of traffic! Every time I scale the VPS, y'all immediately blow through the extra compute. Should be up again, hopefully will be more stable once…
cloudlandsdev on HNYes! Will stick the whole server code open source sometime in the next day or so. There's also a good writeup from the winner incoming.
cloudlandsdev on HN
Questions
Is the server ARM or AMD?
From 2 comments
Is the server arm or amd ?
lmartineng on HNIs this server ARM or AMD
lmartineng on HN