Security researcher Killa exploited an unpatched PHP server to extract a private key as part of a Bitcoin challenge, only to discover the server held the wrong key. Despite the mismatch, challenge operator James Pavur transferred the roughly $2,000 prize to acknowledge the successful exploit. The incident highlights persistent risks from unpatched web infrastructure in cryptocurrency-related services, where outdated software can expose sensitive keys and funds to attackers.