RIFFHACK: Black Market Break-In, or How a Small Beginner CTF Became a Very Busy Weekend

July 6, 202610 min readBy Biterra Team

ctfriffhackevent-recapcommunity

RIFFHACK: Black Market Break-In was supposed to be small.

The plan was a friendly beginner CTF: roughly 150 people, a compact cybercrime-marketplace theme, a few harder spikes for people who wanted to stretch, and enough weekend chaos to make the event feel alive without turning it into an infrastructure stress test.

Then the calendar moved underneath us.

The Weekend Got Weird

RIFFHACK was listed on CTFtime as a casual online Jeopardy event running from Friday, 19 June 2026 at 12:00 UTC to Monday, 22 June 2026 at 00:00 UTC. It was explicitly pitched as a "Small beginner CTF" on the CTFtime event page.

On the same weekend, two larger public events were sitting right on top of it:

Google Capture The Flag 2026 was scheduled for 19 June 2026 at 18:00 UTC to 21 June 2026 at 18:00 UTC, with 630 CTFtime participants and a rating weight of 88.82. Its event description was later updated to say the CTF had been postponed.
BCACTF 7.0 was scheduled for 19 June 2026 at 10:00 UTC to 22 June 2026 at 10:00 UTC, with 226 CTFtime participants and a rating weight of 65.05. CTFtime comments from the organisers said they had to postpone and expected the new start date to land around 3 July.

So RIFFHACK opened as the small casual event in the middle of a suddenly quiet weekend. A lot of people who had cleared time for a bigger CTF still wanted to play something. They found us.

The public standings feed ended with 1,076 teams listed and 5,212 accepted solves across 37 tasks. For an event planned around a small beginner crowd, that was the moment the "black market" turned into a packed night market.

What Players Actually Played

The event mixed two kinds of content.

The first was the RIFFHACK marketplace itself: a deliberately messy underground vendor site full of web bugs, trust mistakes, proof systems, redirects, exports, admin paths, and one too many places where user input could become someone else's problem. Those marketplace tasks made up 18 challenges, from entry-level bugs like The Crawler's Courtesy and The Great Discount Heist through harder pieces like The Chaos Injection and The Upgrade Tunnel.

The second was a supporting set of Jeopardy-style tasks: reversing, crypto, forensics, pwn, and themed puzzles like Moon Prism Packet Secrets, Samus Stack Smash, Orbital Docking Handshake, Severance Overtime Memory Parasite, and Jedi Archive Cube Forgery.

Then there were three standalone RIFFHACK-flavoured service/binary challenges:

Riffhack License Forger
RIFFHACK Escrow Terminal
Riffhack Coupon Malleability

Together, the RIFFHACK-specific tasks accounted for 2,443 solves, with 325 teams solving at least one of them. The non-marketplace tasks added another 2,769 solves.

That split felt about right. Beginners had plenty of footholds. More experienced players had room to chase weirdness. And because the theme was concrete, most of the web challenges felt like parts of one dodgy ecosystem rather than isolated puzzle boxes.

The Leaderboard Was Not Gentle

The top of the board was fast.

The first accepted solve after the official opening time landed at 2026-06-19 12:00:12 UTC. Twelve seconds. That is barely enough time to refresh the page, read the first prompt, and decide whether coffee was a mistake.

It set the tone immediately: players were not drifting in politely, they were already queued up at the door. From there, solves kept coming until 2026-06-21 22:56:44 UTC, and the opening rush never really turned into a quiet weekend.

The final top ten were:

H3XSEC - 5,985 points
Axi0N - 5,955 points
csdc - 5,950 points
No u cant - 5,950 points
RubiyaLab - 5,950 points
Reservoir Dogs - 5,940 points
Avengers - 5,935 points
Alesta - 5,930 points
Valerio Bellini - 5,915 points
雪殇Snowy_war's Team - 5,900 points

H3XSEC took first, but the gap behind them stayed tight. Three teams finished within five points of second place, and the first page of the scoreboard was full of teams who had clearly treated the beginner label as an invitation to speedrun, not to relax.

What Was Hard

Solve counts tell a better story than difficulty labels.

The least-solved tasks were not all the same kind of hard:

The Margin Note - hard web / rendering edge case, 30 solves. The lowest solve count of the event came from a marketplace task where the important clue was tucked away in the margins, exactly the sort of thing that punishes teams who are moving too quickly.
Riffhack Coupon Malleability - hard cryptography, 34 solves. This was not "break AES"; it was the more annoying lesson that encryption without integrity still leaves room to move bytes around.
Jedi Archive Cube Forgery - hard cryptography, 35 solves. A service-based signature forgery where staring at the public key was less useful than noticing what the verifier actually accepted.
The Chaos Injection - hard web, 38 solves. Prototype pollution is always a little mean because the exploit feels invisible until the environment starts changing underneath you.
Severance Overtime Memory Parasite - hard forensics, 39 solves. This asked players to treat the dump like incident triage, with useful residue split across buffers instead of sitting neatly in one file.
Biterra Photobooth - medium service challenge, 44 solves. A legacy image pipeline challenge where the UI said "upload a photo" but the renderer understood much stranger things.
The Hidden Offer Hunt - medium web, 49 solves. A quieter marketplace puzzle about making a hidden offer surface, and a good reminder that medium does not mean obvious.
Helicarrier Breach - medium web exploitation, 62 solves. Spring4Shell is well known, but chaining the right data-binding path into a working service exploit still filtered out a lot of teams.

That list is useful because it mixes categories. It was not just "hard crypto" or "hard pwn" gating the event. Players struggled with anything that required holding a few moving parts in their head: rich rendering paths, malleability, multi-step reversing, prototype pollution, memory forensics, and challenges where the right observation was small but easy to miss.

On the other end, the most solved tasks were the intended on-ramps:

Moon Prism Packet Secrets - 370 solves
Orbital Docking Handshake - 280 solves
The Crawler's Courtesy - 263 solves
Vault-Tec Overseer Terminal - 243 solves
Spider-Verse Broadcast Leak - 243 solves
Samus Stack Smash - 239 solves
Aperture Science Test Chambers - 212 solves
Black Mirror Memory Fragments - 188 solves

That is the shape we wanted: lots of people getting in, enough people getting stuck, and a hard tail that gave experienced teams something to chew on.

What Went Well

The biggest win was that the event stayed playable after the audience changed.

It is one thing to run a small beginner CTF for people who arrive at the pace you expect. It is another thing to have a weekend crowd redirected into your event because two larger listings around you are postponed. The standings feed, challenge launch flow, and scoring all held up well enough for the event to become a real test of the platform rather than a story about the platform falling over.

That mattered even more because RIFFHACK was run by a one-person team. The event went from a 150-person plan to more than 1,000 concurrent users, and the platform still scaled up with the crowd. That was the weekend's quiet infrastructure win: the game got bigger than planned, but players could keep playing.

The theme also carried more weight than expected. "Black market break-in" gave the web tasks a shared language: vendor doors, proof lockers, wanted boards, return slips, trust verifiers, night dumps. That made the event easier to talk about, easier to remember, and easier for players to write about afterwards.

The other good sign was breadth. With 37 tasks, the board did not collapse into one impossible wall. Players could move sideways when they were stuck, pick up points in other categories, and come back later with a better idea.

What We Learned

Public CTF calendars matter more than you think. A casual event can become the only live game in town very quickly when higher-weight events slip. Next time, we will plan capacity around the surrounding weekend, not only around our expected signup count.

Beginner does not mean small. It means readable prompts, fair hints, clean challenge boundaries, and early wins. The audience can still be huge.

We also learned that event telemetry is worth keeping close. The standings feed made it much easier to tell the story afterwards: number of teams, solve spread, hard tasks, on-ramp tasks, and final leaderboard. Without that, the recap would mostly be memory and adrenaline.

Community Write-ups

One of the nicest parts of the weekend was seeing players start publishing write-ups almost immediately after the event closed. We asked people in Discord to send links over, and these were the first ones shared.

The funniest one was probably Accidental RCE: How I Found a Working Exploit in a Live CTF and It Wasn't Even the Challenge by Bassel M. Younes / elnadeef. It was an unintended solve path: a real working RCE in the live event, found while players were supposed to be solving something else entirely. I did try to patch it during the weekend, but by that point RIFFHACK had already grown far past the original plan and I was firefighting the event as a one-person team. In the end, the better call was to keep the game stable, let the discovery stand, and add it to the event lore.

Other write-ups shared through Discord included:

Orbital Docking Handshake by s1nisteR.
Samus Stack Smash by s1nisteR.
Riffhack BMBI Samus Stack Smash by ChainsawCannon!.
Riffhack BMBI Moon Prism Packet Secrets by ChainsawCannon!.
RIFFHACK 2026 Writeup: 12 Challenges Solved by CyberSecurity Elite / الحسن.

The CTFtime tasks and writeups page also filled up fast: 36 write-ups across 34 tasks at the time of writing. Abdelkader published a huge CTFtime set covering most of the event, including:

And a lot more. Hacking Help also submitted Black Mirror Memory Fragments, and the full task page is worth browsing if you want a solve trail for almost the whole event.

If you wrote up a RIFFHACK solve and want it included on this blog post, send us the link and we will add it here.

We would still love to add more independent write-ups and alternate solve paths here, especially for:

The marketplace chain: Vendor's Secret Door, Proof Stamp, Hidden Offer Hunt, Great Discount Heist, Glitchy Contact System, Chaos Injection, Upgrade Tunnel, and the rest of the black-market web track.
The standalone RIFFHACK tasks: License Forger, Escrow Terminal, and Coupon Malleability.
The Jeopardy-style tasks that got a lot of attention, especially Moon Prism Packet Secrets, Severance Overtime Memory Parasite, Jedi Archive Cube Forgery, and Biterra Photobooth.