Bitcoin hacking challenge cracked: researcher exploits critical PHP flaw to win BTC bounty

26 Oct 2026

26 Oct 2026, 13:36 UTC+01:00

Bitcoin TradeReviewed News Desk

The Bitcoin hacking challenge built around this month’s critical PHP vulnerabilities has finally been solved. According to CryptoSlate, a researcher identified online as Killa executed code on the Steal My Bitcoin server on October 25 and extracted a hidden wallet credential. Challenge operator James Pavur confirmed the attack, saying server logs supported the researcher’s findings.

What happened in the Steal My Bitcoin challenge

The contest followed the October 21 disclosure of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which researchers said could allow remote code execution on affected servers. Crypto security executives issued urgent warnings and emergency updates followed. The challenge then became a public test of those warnings, and the fact that it survived its first days fuelled claims that the bugs were overhyped.

That early resistance turned out to be partly a setup issue. Pavur initially configured the server to serve ordinary HTML through PHP’s built-in web server, which limited access to the vulnerable functionality. He later confirmed he added an accessible PHP page around 13:00 UTC on October 25. The successful attack came at 15:47:38 UTC, less than three hours later. An incorrect wallet key meant the winner could not claim the Bitcoin prize directly, but the operator accepted the solve.

Security researchers warn against false confidence

Hacktron co-founder Mohan “s1r1us” Pedhapati criticised the narrative around the contest, calling it “a very dangerous narrative” and warning that using an unsolved, badly configured challenge as evidence could lead people to delay patching. He also said heavy traffic overwhelmed the single-threaded PHP server in the early hours.

Killa later published a proof of concept on GitHub. CryptoSlate notes the published evidence does not establish that an autonomous AI system carried out the attack, and the researcher acknowledged gaps in the records from the original attempt.

What it means for traders

• Patch status matters: many crypto sites, wallet backends and smaller exchanges run on PHP. Unpatched servers are a real risk, not a theoretical one.
• Choose venues carefully: security track record, proof of reserves and regulation should weigh more than bonus offers. See our crypto exchange comparison, our BingX review and OKX review, and how we test exchanges.
• Self-custody basics: keep long-term holdings off hot servers and in a wallet you control.

This article is for information only and is not financial advice.

Related reviews

• Bingx review
• Okx review

Sources

• CryptoSlate: Bitcoin hacking challenge finally falls as researcher proves critical PHP flaw is exploitable

News is for information only and is not financial advice. More crypto news