Break it. Prove it.
Capture the flag.
CCTF is the largest hacking competition for blockchain hackers — realistic challenges in cryptography, smart-contract auditing and security engineering. Founded in Budapest in 2019 and battle-tested across three regions, our $42,000 championship pool still tops the Web3 hacking scene in 2026.
A hacker collective, not a spectator sport.
CCTF started as a small circle of Hungarian crypto hackers and grew — edition by edition — into a global DAO. Every event ships harder challenges, bigger prize pools, and a wider field of players. This is where blockchain security is stress-tested for real.
Realistic challenges
Weak cryptography, RSA and BIP-seed exploitation, smart-contract reentrancy, frontrunning, misconfigurations and leaked wallets — modelled on how chains actually get broken.
Global DAO
A decentralized org for consultation, extraordinary events and Web3 security services. Governed by the community, run by builders who ship.
Flags with stakes
Five-figure prize pools, on-site finals from Dubai to Bali, and reputation that travels. Capture the flag, capture the credibility.
The Web3 Championship
Branded with Polkadot as title sponsor, the Web3 Championship is CCTF DAO's flagship hackathon — an invite-tight, high-intensity build-and-break arena hosted at GamerLand, Budapest and, in 2024, taken global to Bali alongside CoinFest Asia.
Three editions, across Budapest, Dubai and Bali. A $42,000 top prize pool — still the number to beat in Web3 hacking in 2026. Real builders, real judges, real shipping under pressure.
Backed by the Gen6 ecosystem.
CCTF shares its DNA — and its founder, David "Six" Pethes — with Gen6, a digital-sovereignty ecosystem building verifiable trust into the chain. The tools our hackers stress-test are the tools Gen6 ships.
Cryptographic content signing
A permanent cryptographic receipt for any content or event, bound to self-sovereign identity. Sign it once, verify it forever.
Encrypted messaging & encryption layer
End-to-end encrypted communication and the encryption backbone of the Gen6 stack. Message freely, leak nothing.
The utility token
Powers validation rewards, staking, governance and distributed storage across the Gen6 network.
CCTF X is coming.
The next chapter of the largest blockchain hacking competition is loading. Get on the list, sharpen your exploits, and be first through the door when the arena opens.
The Web3 Championship
A build-and-break hackathon where elite Web3 developers ship under pressure. Officially the Polkadot Championship — Polkadot as title sponsor — hosted at GamerLand in Budapest and taken global to Bali in 2024.
Three editions. Still on top.
Polkadot Metaverse Championship
Dec 5–7, 2022 at GamerLand. A hybrid metaverse hackathon streamed into the Kusamaverse — 40-participant cap with qualifying tasks.
Polkadot Championship Hackathon
Dec 3–5, 2023 at GamerLand. Our biggest yet — a two-phase format from prequalification to on-site finals, mentored by the CCTF core.
Bali / APAC Edition
Aug 19–20, 2024 at the Bali Blockchain Center, Denpasar — held alongside CoinFest Asia 2024. The moment the Championship went global.
Qualify. Build. Break. Win.
Phase 01 — Prequalification. Open call, qualifying tasks, and a hard cap on finalists. Only the sharpest builders make it on-site.
Phase 02 — On-site finals. An intense multi-day sprint at the venue. Ship a working Web3 project, defend it to expert judges, and compete for the pool.
Phase 03 — Flags & prizes. Winners split five-figure pools plus ecosystem bounties — and leave with reputation that opens doors across Web3.
Built with the ecosystem.
Title-sponsored by Polkadot, hosted at GamerLand, and supported by teams across the Web3 stack.
Think you can capture the flag?
Register your interest for the next Web3 Championship and CCTF X. We'll reach out with qualifying details, dates, and the prize pool as soon as the arena opens.
Editions & aftermovies
From a Budapest infosec conference in 2019 to yachts in Dubai and stages in Bali. Every edition raised the bar — more players, harder flags, bigger pools. Here's the timeline.
The road so far
CCTF is born
Created by David "Six" Pethes and launched at the BsidesBUD infosec conference. A small circle of Hungarian crypto hackers sets out to build the hardest blockchain hacking competition anywhere.
CCTF Vol. 1–6 — the Hungarian era
The first six volumes grew up inside Hungary's security scene — running through BSidesBUD, Hacktivity and Hackerspace Budapest (hsbp.org) events. This is where CCTF sharpened its challenges and forged its core community.
Scaling beyond Hungary
Vol. 7 opens with more participants and larger sponsorship awards as partners like EcoX come on board and CCTF's reputation spreads through the global security community.
CCTF Vol. 8 — the metaverse arrives
Preliminary round in April, final in May with a $15,000 prize pool — the final held on a yacht in Dubai. Introduced OSINT challenges inside Decentraland: cybersecurity inside the metaverse, for the first time. Sponsored by Next Earth & CodeCluster.
Polkadot Metaverse Championship
Dec 5–7 at GamerLand — a $36,000 prize pool in DOT, streamed into the Kusamaverse. The Web3 Championship series begins. Partners: Unit, KILT, Momentum.
CCTF Vol. 9
The ninth CCTF edition — the aftermovie became the community's most-watched, with thousands of views. The competition is now a fixture on the global Web3 security calendar.
Polkadot Championship Hackathon
Dec 3–5 at GamerLand — prize pool starting at $42,000 plus ecosystem prizes. A two-phase format takes builders from prequalification to on-site finals.
Polkadot Championship — Bali / APAC Edition
Aug 19–20 at the Bali Blockchain Center, Denpasar, alongside CoinFest Asia 2024. A $10,000 pool and the moment CCTF DAO truly went global — from Budapest to Southeast Asia.
CCTF X — incoming
The next chapter is loading. Harder challenges, a wider field, and the CCTF DAO going deeper into on-chain security. Get on the list.
Aftermovies & origins
The full story lives on the Gen6 official channel — event recaps, the CCTF origin film, and the ecosystem behind it.
The DAO
CCTF is a decentralized organization for consultation, extraordinary events and Web3 security services — governed by the community that hacks, builds and audits together. This is who we are and the ecosystem we're part of.
From a Budapest basement to a global arena
CCTF — Crypto Capture The Flag or CryptoCurrency(is)TheFlag — began in 2019, founded by David "Six" Pethes and first held at the BsidesBUD infosec conference in Budapest. Its first six volumes grew up inside Hungary's security scene — BSidesBUD, Hacktivity and Hackerspace Budapest (hsbp.org) — with one goal: build the hardest, most realistic hacking competition for blockchain.
It worked. Each edition grew — more participants, bigger prize pools, harder flags — until CCTF was running events from Dubai to Bali and had become a DAO with a global membership of elite crypto hackers.
The same founder later co-founded Gen6, the digital-sovereignty ecosystem CCTF is aligned with today — closing the loop between breaking systems and building unbreakable ones.
- Founded
- 2019 · Budapest, Hungary
- Founder
- six
- Entity
- CCTF DAO
- Focus
- Web3 security, events, consultation
- Reach
- Europe → APAC · global membership
- Flagship
- CCTF / Web3 Championship
What the DAO does
Extraordinary events
CTF competitions and hackathons engineered to be the hardest in Web3 — from qualifiers to on-site finals with real prize pools.
Security services
Smart-contract auditing, adversarial testing and security engineering drawn from a community that breaks chains for sport.
Consultation
Advisory for Web3 teams that need battle-tested eyes on their protocol, their crypto and their threat model.
The Gen6 ecosystem
CCTF shares its founder and its philosophy with Gen6 — a digital-sovereignty ecosystem building verifiable trust, private communication and self-sovereign identity on-chain. Gen6 is a partner of the Polkadot ecosystem and the stack our community stress-tests.
Cryptographic content signing
Get a cryptographic receipt that lasts forever. RealSeal binds any content, data or event to a self-sovereign identity — sign once, verify anywhere, tamper never.
Encrypted messaging & encryption layer
End-to-end encrypted messaging — and the encryption layer underpinning the whole Gen6 stack. Communicate freely; expose nothing.
The utility token
GSX powers the network — validation rewards, staking, governance and distributed storage. A utility token built for a compliance-first ecosystem.
Self-sovereign identity
One verified identity you own and carry across services — the trust anchor the rest of the ecosystem builds on.
Ecosystem figures reflect Gen6 network reporting. Confirm the latest numbers before launch.
Hack with the collective.
Whether you compete, audit or build — CCTF DAO is where elite Web3 security talent finds its people. Get on the list for CCTF X and the next Championship.