The house was quiet. The sun was still sleeping, the dog was already walked, and the first coffee was in my hand and still hot. This is my hour, the one before the day starts asking things of me. I sit down, open the laptop, and see what moved while I wasn’t looking.
What moved, this particular morning, was somebody trying to rob me.
It was not much of a robbery, and I will get to the haul, because the haul is the best part. But there it was, waiting for me on a Thursday at seven: a couple hundred automated requests, fired at my brand new app in a tight burst around midnight while I slept, every one of them reaching for the same thing. The money.
I read it, and I grinned into my coffee. Because a day earlier I had put two invitations out into the world. This was the second one, and it got answered first.
The hundred hours before the knock
Back up a few weeks.
Stakes is a small app I built for the Nimiq Mini Apps competition. You put a little money on a promise, you check in every day, and you get it back when you follow through. Miss a day and that day’s slice is gone. The first version went in months ago. This was Cycle II, the relaunch, and I did not treat it as a touch up. I rebuilt the game underneath, redrew the whole brand, and gave it a home of its own at stakes.day.
I will not pretend it was cheap. I put somewhere north of a hundred hours into this in a stretch of weeks, and nobody is paying me for a single one of them. I do it because I am a fan, and not a recent one. I made my first Nimiq wallet on the twenty first of January 2021, at twenty past eleven in the morning. I liked it enough that I tried to talk my whole family into it. So when the competition came around, there was not much to decide.
The hours were the hard part, because they were not really mine to give. My son asked me a few times if we could go down to the water, or just play. I said not right now more often than I would like to write down. That is the honest cost of a hundred hours, and it is the one currency that does not come back. I knew the exchange rate when I signed up, I would sign it again, and my family carries me through these sprints without once making me feel bad about it. So this is not a complaint. It is just the receipt.
What I bought with it was not the game. The game works, it is proven, and it settles real money exactly the way it should. What I poured the time into was the surface. A Nimiq mini app is a genuinely hard place to design. It runs inside another app, on a phone, in a viewport the size of a postcard, on both iOS and Android. You get almost no room, and every element has to earn its pixels. Making something feel calm and obvious inside that little window took more work than the entire settlement engine did. That, and the story around stakes.day, which opens a door onto a lot more than a week of cold showers. But that one is a post for another day.
Two invitations
When I launched, I put two open invitations into the world, and I meant both of them.
The first one is the whole point of the app, and it faces everyone. Come and use this. Pick one promise, put a little money on it, keep it for a week. That invitation lives on the surface, on stakes.day, in every screen I spent those hundred hours smoothing down.
The second one is quieter, and you have to go looking to find it. Stakes is open source. The entire thing sits in a public repository under an MIT license, every line readable by anyone on earth. And down in the server code, right next to the part that hands each new challenge a tiny seed of NIM, there is a comment I wrote on purpose. It says, more or less: hacking welcome. Hack it if you want.
That seed is worth explaining, because it is the thing that got poked. When you start a challenge, Stakes writes the beginning of it onto the blockchain, so your start is a fixed, permanent thing that cannot be quietly moved later. Writing to a chain costs a sliver of NIM, so the app fronts each new challenge that sliver to pay for its own stamp. It is postage. It is small on purpose. I left the limits around it deliberately loose, looser than a nervous person would, and wrote the invitation in plain sight right beside it.
I meant that one too. You can test a thing in private for as long as you like, but there is a kind of truth you only get by putting it in the open and daring the world to have a go.
So there were two doors. One said come build something with me. One said come break something of mine. I went to bed and waited to see which would open first.
The door they opened
The second one. Of course it was the second one.
It opened that same night, about three hours after I launched, before a single person had walked through the first. Someone pointed a script at the app and started opening fake challenges as fast as it would take them, each empty challenge triggering the little seed that pays for its stamp. A couple hundred of them inside an hour, spread across two hundred and eighteen freshly made wallets, wearing seventeen network fingerprints and doing their level best to look like a crowd.
Here is what the whole operation was worth. Twenty two NIM. At today’s price, that is less than one cent. Not each. Total.
Sit in that for a second, because it is the most honest number in the piece. Somebody built a small machine in the middle of their night, a bot, two hundred wallets, a spoofed crowd, real effort, and aimed all of it at a seed that exists to buy postage. They walked away with less than a cent, and carved every step into a public ledger that does not forget.
I want to be careful here, because the treasury is small and it would be easy to be glib about small money. The stakes in this app are meant to be small. That is the design. The money’s job is to be at risk, not to be won, and a promise can sting for a single coin. This competition has builders from every corner of the world, and the few dollars someone reached for here is real money to plenty of people. That is the part that makes me laugh and sit up in the same breath. Two open doors, and the first reach was for the lock on the one marked mine.
Why it stayed small
The reason the take was a grain of sand and not the whole treasury is not luck, and it is the part I will keep deliberately vague. There is no map to hand out here.
The short version: the seed has layers of limits around it and a single switch that shuts it off completely, and I never had to reach for the switch. The limits did their job while I slept. The seed also cannot reach anyone’s actual stake or anyone’s payout. Those live behind a separate door, and that door only opens for real money that has genuinely landed on the chain. At its very worst, someone pushing on it all day could pull a few cents, against a ceiling, in full public view. That is the deal I designed, and that is the deal that played out.
None of this is because I am some security genius. Before I launched, I did what a careful attacker now does too. I pointed a very capable model and a purpose built harness at my own code and told it to break in. It is a strange feeling, hiring the burglar to case your own house, but that is where we are in 2026. The people trying to get in are running the same kind of tooling you are. The only real question is whether you run it first.
The part that isn’t funny
Here is the part I am not laughing about. The money was never really the target, and it was never really the cost either. The cost is quieter, and it counts for more. The same limits that shrug off an attacker can, in the wrong moment, catch an honest person in the same net. Someone arriving for the first time, ready to put a real promise on the line, can get stopped at the seed step, the little stamp that marks the start of their challenge, through no fault of their own. A newcomer who hits a wall on their very first tap does not come back and try again. That is a genuine problem, and it is the actual thing this attack found.
I am not going to wave it away. I take it seriously. I am running a full security review right now, and I am going to fix it properly, which is precisely why I will not rush it. The change that stops the abuser without ever stopping the honest newcomer is careful work, and careful is the only way I know to build the parts of an app that touch a person’s money and their word.
And I am genuinely grateful it happened now. A stranger, in the middle of the night, before this thing had real users to lose, handed me a free penetration test and pointed at a seam I needed to see. I would far rather learn it from a bot farming fractions of a cent than from the first real person who trusted the app enough to stake on it.
The thing people miss about this space
This is the part I actually want you to take with you, because it runs against the reflex.
The reflex says the open ledger is the scary part. Everything on a blockchain is public. The code is public, the transactions are public, the treasury is a single address that anyone on earth can open in a browser and stare at. To most people that sounds like a house with glass walls, which sounds like a very bad idea for a house that holds money.
It is the opposite. The glass is the security.
There is an old Warren Buffett line about how you only find out who has been swimming naked when the tide goes out. On a public chain the tide never comes back in. It is always out, on everyone, all the time. There is nowhere to hide a mistake. If my app were actually insecure, I would not be writing a fun little story about a one cent morning. The money would simply be gone, all of it, the moment the first competent person looked, and I would have learned it not from a report but from an empty address. The audit here is not a document I commissioned. The audit is thousands of strangers who never sleep, and it passes or fails in public, in real time.
You do not need my permission to check my work, either. The treasury is one address, NQ83 0UJS 7NG3 QH7K 3VLF 7E06 JNH4 X5EV U04R. Open it in a block explorer and you can count the seeds this person farmed yourself. That is not a boast. That is just how the water works out here. Clear all the way to the bottom.
The tide that went out on me once
I have written before about everything that is wrong with this space. A while back I told the story of a night in a Barcelona hotel room, two years ago, late, tired, guard down, when I clicked one link I should not have clicked and watched about a thousand dollars leave my wallet in the time it takes to read this sentence. My conclusion then was that the technology is sound and the culture around it is sick. The problem was never the chain. The problem was the people who look at every new thing and see something to drain instead of something to use.
That same instinct is exactly the one that chose my second door. Here is a brand new little app whose entire purpose is to help people keep a promise to themselves, and it went out into the world with two open invitations, and the first one answered was the one that said break it. Not build. Not try. Break.
The difference this time is that the instinct hit a wall, walked off with a grain of sand, and left its fingerprints on the glass. Two years ago that culture cost me a thousand dollars. This week it cost me a fraction of a cent and pointed straight at the one seam I most needed to fix. I will take that trade every time. Most of what changed is that I respected the technology enough to let it do what it promises, and that I would rather be shown a weak spot than left to find it the hard way.
One last thing, and it is my favorite. That farming run could not even pad my numbers. The only figure I count as real usage is money moving into the app, on chain, from a real person. The seeds all went the other way, outward, so those two hundred and eighteen farmed wallets are worth exactly zero to me. In a space absolutely full of people inflating their metrics, the one attack I have had could not inflate mine, because a long time ago I decided to only count the thing that is real.
The doors are still open
I have not taken either sign down. Hacking welcome is still there in the code, and after this week I mean it more, not less. If you can find the next seam, find it, and find it now, while it still costs me a lesson instead of a user. The treasury is out in the open for anyone to watch, the water is clear, and I will see you on the ledger. I am reading now, and I am working on the fix.
And the other door is still open too, the one the whole app is actually about, and it is the harder one to walk through. Pick one promise. Put a little money on it. Keep it for a week. That invitation is still standing at stakes.day, and unlike the other one, it pays out in something nobody can farm.
Leave a Reply