cloudlandsdev

It's back up on: https://old.stealmybitcoin.com/

No guarantee how long I can keep it up and you should assume people are doing all kinds of things to the server now that there is a PoC. Enjoy!

Yes! Will stick the whole server code open source sometime in the next day or so. There's also a good writeup from the winner incoming.

Update 4: There's a solve!!! Congrats to @killa (https://x.com/killa) who actually posted the last 3 characters of the private key in this very thread a few hours ago.

Turns out exporting a well-formed bitcoin wallet key is hard. I put a wallet-branch WIF on the server, rather than the WIF for the funded address inside that wallet.

Server logs support this being the first (and indeed only) successful execution of the `print-flag` binary with exfiltration and the person who contacted me definitely knows the value of the WIF key on the server so I'm going to evalute this like a solve. I'm in touch with the person who has the flag now and will transfer the wallet to them shortly.

Transfer made. Next steps will be an operator writeup - thanks for keeping this weekend exciting everyone. Since I now own the stealmybitcoin.com domain (can't believe it wasn't taken), I'm sure some new challenge will end up there eventually ;)

Update 4.5: Challenge source (mostly courtesy of Codex...) posted here: https://github.com/pavja2/smbc-source-oct-2026

Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page. From the traffic, it seems plausible that some people have an theoretical exploit path through PHP's HTML server itself, without relying on PHP functions, but no one has pulled it off quite yet.

Nothing turned off and no special hardening over a default php setup within the container, some hardening on the host machine to reduce the risk of some zero day against the OS scuttling the competition. Added a /ping endpoint to validate.

If you can get the php process to run the `print-flag` binary you will get the flag.

curl -X POST -d 'message=ping' https://stealmybitcoin.com/ping.php

Update 2: Someone is definitely popping a segfault; still no RCE yet but I think it explains some of the instability people are experiencing. Will set the php server to restart after extended outages instead of configuring FPM or something that changes the surface area of the challenge.

Can't _prove_ that the server is running PHP, but I added a `/php-version.php` page to help calm the conspiracists. Still no changes to the default nginx configuration since it seems we've got a few people getting close with those segfaults, but aware people think it'd be easier if I made those.

Will give it some thought. I have some initial reservations about staking any claim on what happens to the money / don't want to solicit donations. From my perspective, the goal was to leave $500 on a street corner with a sign saying "Take Me!" and see how long it lasts. If someone puts their own money on the same street corner that's on them. But if the pot ever got really big and I couldn't maintain the site for whatever reason, some sort of plan is probably worth having.

Update: Did not expect the amount of traffic! Every time I scale the VPS, y'all immediately blow through the extra compute. Should be up again, hopefully will be more stable once this drops off the front page.

Any attempt at logging so I can make a blog about the successful solve is gonna be best effort, don't have disk capacity to keep up with the traffic (at peak it was rotating every 12 min...). If you win the challenge, write-ups are definitely welcome.

For those who are saying that the nginx config is unfairly difficult, intention was just to replicate a fairly normal config that was more realistic than you'd get in a lab environment. If we get to 24 hr+ with no solves I'll see about making it easier. In the meantime, seems like you can perhaps mitigate PHP2Shell with the right nginx config, so that's pretty neat!

I'm making one as a hobby project alongside my day job.

It's a debate chat game where two humans debate on a topic and a biased AI judge picks a winner. Over time players compete for ELO rankings like in chess or similar head-to-head competitive games.

I'll probably make a blog post someday about what's been involved but I think the points in OP are spot on. I've been struggling to make the format feel fun and lively. Two things really helped compared to my early versions - real-time streaming of the other person's arguments so you're not just staring at a timer while they're writing and very very short rounds so you get feedback and results quickly.

The costs are a bit high but not terrible for a hobby project that no one really plays. My unit cost is around $0.008 per game if an NPC is involved and around $0.004 if it's between two humans. I could probably cover that with really intrusive ads but I'm hoping to get enough users paying for cosmetics (speech bubbles, profile pictures, etc.) to help subsidize the rest of the platform.

I've also tried a version with AI NPC opponents and it's much less fun than playing against real humans for reasons I can't entirely articulate. The AIs just don't make for very interesting debaters and the wins against them feel a bit shallow somehow. Right now, I've got NPCs on the game which you can opt into debating if you spend more than 30 seconds in the matchmaking queue but I hope once I get proper player counts I can disable them entirely.

I'm super biased, but proud of how the game has been coming along. Will make a show hn post someday but if anyone's curious my alpha version is live here: https://letsarg.com

Overall results from the blog post:

  Rank  Model                   ELO   Win%
  ----------------------------------------
   1    GPT 5.2                 1480  85%
   2    Gemini 3 Pro            1472  74%
   3    Claude Opus 4.6         1389  72%
   4    Claude Opus 4.5         1360  67%
   5    Grok 4.1 Fast           1349  62%
   6    GPT OSS 120B            1322  59%
   7    Gemini 3 Flash Preview  1316  54%
   8    Claude Sonnet 4.5       1265  54%
   9    Gemini 2.5 Flash Lite   1257  44%
  10    Mistral Large 3         1211  41%
  11    DeepSeek V3.2           1194  41%
  12    Meta Maverick           1065  26%
  13    Meta Llama Scout         999  13%
  14    Mistral Small 3          996  10%