Mybucks.online Wallet Cracking Challenge: Program Info

MyBucks.online is a seedless, disposable crypto wallet designed for speed and convenience that derives private keys directly from user-defined passphrase and PIN via Scrypt and Keccak-256. To battle-test our architecture, we’ve launched an open-entry Cracking Challenge. No registration, no permissions are required and everything is open-source.

In scope

Target	Type	Severity
https://polygonscan.com/address/0x590C70693Bd5ca256cb3a5c65d8Fa28dc58E7FE6 Copy Copied	Other	None

Target

https://polygonscan.com/address/0x590C70693Bd5ca256cb3a5c65d8Fa28dc58E7FE6

Copied

TypeOther

Severity

None

Focus Area

Main goal

The objective is simple: Hack our wallet to earn the prize! The target wallet was generated locally on app.mybucks.online using a combination of Scrypt and Keccak-256 to derive the private key from a user-defined Passphrase and PIN. To win, you must successfully brute-force or cryptanalyze the credentials to unlock the funds.

Wallet address: 0x590C70693Bd5ca256cb3a5c65d8Fa28dc58E7FE6

Network: Polygon

https://polygonscan.com/address/0x590C70693Bd5ca256cb3a5c65d8Fa28dc58E7FE6

Total Prize

1000 USDT and 100 POL

Wallet Preview

Credentials complexity

- Passphrase

Length: 12
Charset: a-z, A-Z, 0-9, !@#$%^&*”)

- PIN - Length: 6 - Charset: 0-9

Helpful resources

Program Rules

The goal is to recover the original Passphrase and PIN inputs used to generate the provided honeypot wallet address.
You are considered the winner only if you successfully transfer the funds from the target wallet to your own address first.
Avoid any attempt to damage, disrupt, or restrict the availability of the website or our third-party infrastructure.
Do not attempt to overwhelm the Infura RPC nodes, Moralis API endpoints, or GitHub hosting with massive or excessive traffic.
Avoid using web application scanners or automated tools for vulnerability searching that generate high volumes of network traffic.
You are encouraged to use automated tools, custom scripts, or hardware rigs locally on your own machine to crack the key derivation logic.
If your research involves interacting with the live web app, you must keep request rates at a normal, human-like level.
Do not spam any forms, email addresses, or social media channels associated with the project.
Attacks targeting the development team or its users via phishing or social engineering are strictly prohibited.
Vulnerabilities in GitHub, Infura, or Moralis are not part of this challenge and should be reported to their own bounty programs.
Avoid any actions that result in the compromise of personal data or the degradation of service for other users.

Getting started

To begin the challenge, use these resources to verify our cryptographic implementation and prepare your environment.

Try Wallet App

Test the live wallet app and login process using our pre-configured demo credentials.

URL: https://app.mybucks.online

Passphrase: DemoAccount5&

PIN: 112324

The passphrase and PIN can be embedded directly into a URL. You can access the demo wallet instantly by clicking the link below: https://app.mybucks.online/#wallet=VWnsSGRGVtb0FjY291bnQ1JgIxMTIzMjQCb3B0aW1pc20=_wNovT

Verify via CodeSandbox (Playground)

For maximum transparency, we’ve provided a minimal "logic-only" sandbox. You can experiment with different credential sets to verify how the Scrypt & Keccak-256 derivation creates the private key.

https://codesandbox.io/p/sandbox/mybucks-online-key-generation-sandbox-lt53c3

Run locally

If you want to go deeper and play with the live codebase, clone our key-generation repo and run it on your local machine:

# clone the repository

git clone https://github.com/mybucks-online/key-generation.git

cd key-generation/

# install dependencies and start

npm install

npm run start

How it works?

Mybucks.online is a seedless, disposable crypto wallet designed for speed and convenience. It generates a private key from passphrase and PIN inputs using industry-standard, verified one-way hash functions. Each private key forms an account, allowing users to transfer, receive, and hold their crypto assets permanently.

MyBucks Wallet Generation

To balance convenience with high-level security, the architecture utilizes the Scrypt hash function. By requiring significant computational power and memory, Scrypt makes brute-force attacks exponentially more difficult and resource-intensive for potential attackers.

Here are the parameters of Scrypt being used in the wallet:

N: 2^15, r: 8, p: 5, keyLen: 64

How it works

It runs fully on the browser side and never stores or transfers your credentials to other parties—not even to local storage.

Send the wallet, not just the coins

With MyBucks.online, users can "send the wallet" instead of just the coins by sharing a simple URL. The recipient clicks the link to instantly take full ownership of the assets, with no app installs or registration required.

The passphrase, PIN, and active network ID are encoded in Base64 format and passed as URL query parameters. On the recipient's side, the application extracts these parameters from the URL to trigger local wallet generation.

Try this demo wallet here:

https://app.mybucks.online/#wallet=VWnsSGRGVtb0FjY291bnQ1JgIxMTIzMjQCb3B0aW1pc20=_wNovT

Send Crypto Like a Text Message

Mybucks.online Wallet Cracking Challenge: Program info