Hacker News Reader

The block chain can't though once the coins are transferred

That assumes the key is actually on the server.

I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.

The server could simply be running a patched PHP.