This is the best test of a vulnerability I have seen: instead of arguing in theory, someone stood up a real server, put real money in it, and invited everyone to try. The result is a number nobody can argue with.
The rules
The front page reads: “My bitcoin was stolen after: 19.28 hours.” The prize pot at the moment of the win was 0.02511679 BTC, or $2,021.22. Time won: 25 October 2026, 15:47 UTC. The prize wallet is public on mempool.space so anyone can check the transaction.
The interesting part is not that it was hacked
It is that nobody managed it in the first 20 hours. The Lobsters analysis states it plainly: “stealmybitcoin.com was not vulnerable the first 20 hours, then got hacked within hours”. The bug is real, but it is not the kind where you run one tool and you are in.
- The winning technique differed from the common PoC: send one producer request, then pipeline consumer requests across all workers, to reduce the chance of a stray request landing mid-sequence.
- A hard precondition: the final request must land on the same worker, and you must know the exact worker count.
- Behind a load balancer with several containers, each with its own ASLR layout, this technique largely stops working. Session stickiness could change that, but is not a default on common load balancers.
Why this is the right way to publish a vulnerability
The argument around php2shell this week split in two: one side said patch within 15 minutes, the other said that advice was overblown. Both rested on inference. A site holding real money turns inference into measurement — and the measurement landed in the middle: exploitable, but it took 19 hours and a new technique.
Worth reading the author's own update too: Dan Guido of Trail of Bits said his team had an exploit working “under load” before the site was drained. If so, the real time was shorter than 19 hours — and that is exactly why publishing a vulnerability alongside a live target beats any amount of blog argument.
Full context on the bug and why it took over three leaderboards: the php2shell post. Sources: stealmybitcoin.com, I want my Wednesday back, the winner's writeup, the prize wallet.