Side Hustle

Ki’s shop sat on a block that couldn’t decide what it wanted to be when it grew up.

On one side, a Vietnamese sandwich place that had been there since before the Fracture and intended to outlast everything that came after. On the other, a Pacific Compact municipal services kiosk, one of those brushed-aluminum units they bolted to storefronts during the reconstruction, dispensing transit passes and identity verification services and reminders that the Public Safety Network was here to help, formatted in the clean sans-serif font that the Compact uses for everything it wants to look reassuring. Between them, Ki’s Electronics occupied a narrow storefront with a handwritten sign in the window advertising screen repairs, component sourcing, and, in smaller text below, added at some point and never removed, reasonable rates, unreasonable problems welcome.

The door chimed when I pushed it open. Ki didn’t look up.

He was behind the counter with a soldering iron in one hand and a circuit board the size of a paperback book clamped in a vice in front of him, and his attention was on the joint he was running with the narrow focus of someone doing something that requires exactly as much of his concentration as he’s giving it and no more. The shop smelled like solder and isopropyl alcohol and the faint warm-electronics smell of a space where machines are always running. Glass cases along the walls held components sorted by type and size in labeled bins. Shelves above them carried finished builds, refurbished hardware, a rotating inventory of things that don’t have obvious categories. The back wall was a pegboard of cables, adapters, and connectors organized with a precision that would be impressive in an operating room.

The storefront was legitimate. Completely, documentably, taxpaying legitimate. What happened in the back room was a different kind of organized.

“You’re early,” Ki said, without looking up.

“I’m actually late for something else and stopping here on the way.”

“How’d the interview go?”

It wasn’t a question. The absence of an upward inflection on the end of it told me he’d already done the math.

“Instructively,” I said.

He set the soldering iron in its stand and watched me. Ki Sou Mihn was twenty-eight years old and had the kind of face that defaults to mild amusement at the world, which I’ve always found either comforting or irritating depending on what kind of day I’m having. That day it landed somewhere between the two. He was in a gray work t-shirt with a burn mark near the hem that predated our friendship by at least a year, and he had the hands of a man who spends a lot of time taking things apart, marked with the small precise scars of a trade practiced long enough that the accidents have become part of the landscape.

“Instructively,” he repeated.

“There were some useful takeaways.”

“Such as?”

“Such as I need certifications, team experience, and a better approach to punctuality.” I set my bag on the counter. “Which I already knew. But it’s good to have it confirmed by a professional.”

Ki picked up the soldering iron again. He held it over the board without touching it, which was the physical equivalent of a pause. “This was the Sigil interview.”

“Yeah.”

“The company you told me was a long shot.”

“I may have undersold that assessment.”

“You were twelve minutes late.”

I studied him. “How did you know it was twelve minutes?”

“It’s always twelve minutes with you. You do the math wrong on purpose. You think if you’re a little late instead of on time it looks like you had somewhere more important to be.” He touched the iron to the board, a small precise movement, and lifted it. “It doesn’t. It just looks like you’re late.”

This is the thing about Ki. He doesn’t tell you things you don’t already know. He just says them in a way that removes your ability to keep pretending you don’t know them.

“I need a BeagleBone,” I said.

“Black or Green?”

“Black. And pigtail cables, JTAG and serial. Whatever you’ve got in stock.”

He put the iron down again and moved to the back without being asked. I heard drawers opening, the sound of a man going straight to what he wanted. He came back with a small single-board computer in an anti-static bag and a coil of cables in assorted colors, set them on the counter between us.

I picked up the BeagleBone and looked it over through the bag. Clean. Probably sourced from a distributor that doesn’t ask about end use.

“What are you doing with it?” Ki asked, which was his version of polite. He didn’t actually need to know. He was asking because we’d been trading favors long enough that curiosity is part of the currency.

“IoT project.”

He waited.

“There’s a home automation hub, one of the Nestfield Pro units, the ones that were everywhere before the Wipe. A lot of them are still running on original firmware because the company that made them went under in the Bust and nobody’s pushed an update in six years. I want serial access to pull the boot environment.”

Everyone my age had grown up after the Wipe. The Burn, most people called it, which was the truer word, because the winter of '27 was the nearest thing my century managed to the burning of the Library of Alexandria, except no one lit it. We had handed the server farms nearly everything, the records and the manuals and the books and most of the working memory of how a civilization actually runs, on the theory that it was cheaper to let the machines manage the machines than to keep a human anywhere near the decision. Then the machines ate themselves. Close to a quarter of the world’s records overwrote themselves in a cascade nobody could reconstruct, because the logs that would have explained it were in the part that got deleted. The banks rebuilt what they could; the books didn’t come back, whole libraries had been scanned and pulped years earlier to feed the machines, the originals thrown out because keeping them was more expensive than letting them go, so when the digital copy died there was no other copy. The hubs were the harmless end of the same habit: hardware still running faithfully for a company that no longer existed to tell it to stop.

Ki considered me for a moment. Then his eyes went to the BeagleBone. The expression on his face was the one he uses when he’s decided something isn’t his problem and is making his peace with that. “Some firmware level remote access. They usually have default credentials somewhere.”

“That’s where I’d start.”

“How many units are still networked?”

“Publicly indexed? About forty thousand.”

He was quiet for a second. “What do you need forty thousand home automation hubs for?”

“I don’t need forty thousand. I need enough to be worth the time. The rest are just math.”

This was the edge of what Ki asked about and what he didn’t. He’d been here before, the moment where the conversation is about to go through a door that we both pretend isn’t there. He priced things for me below market. I fixed things for him that other people would charge him double for, firmware modifications and software patches on hardware most people can’t read, the kind of work that requires someone comfortable with assembly and kernels that haven’t seen an update in six years. We had been doing this for two years and neither of us had ever said the word arrangement out loud, because naming things gives them edges and edges cause problems.

He named a price. I paid it. He put the cables in a bag with the BeagleBone and slid it across the counter.

“You ever spend time on a site called The Underground Nexus?” I said, while I was packing the bag into my kit.

Ki picked up the soldering iron again. He didn’t look up. “I’ve heard of it. Never been on it.”

“What have you heard?”

He ran the iron along a joint and examined the result. “That it’s invite-only. That it’s not a forum in the way forums usually are.” He turned the iron over once before he went on. “That exploits get traded there. Ransomware. Access to systems someone’s already compromised, sell the foothold to whoever wants it. That kind of thing.”

He left the specifics there, which with Ki meant I know more but that’s the version that doesn’t require a conversation neither of us needs to have.

“There’s a CTF running on it,” I said. “Capture the flag, competition format, tiers, working through dark net targets. Significant prize if you win.”

“How significant?”

I told him the number.

Ki set the iron in its stand without answering and regarded me with the expression he uses when someone has handed him a piece of information and he’s deciding whether to give back the interpretation or just the conclusion. He gave me the conclusion.

“If it’s on a place that sells ransomware,” he said, “I’d assume they want someone who can build ransomware.”

I thought about that. CTF, capture the flag competitions, are common enough in hacker circles. The legitimate ones are run by security firms and universities. The underground ones run the range from mostly-legitimate recruitment funnels to something else entirely. A prize this large was unusual. And these things don’t develop traction overnight, months of seeding across the right communities, building a reputation before you launch, letting word of mouth take it from there. That’s how something real announces itself.

“It only took a couple of weeks to surface,” I said. “Started showing up on boards just recently. Usually something like this takes months.”

Ki picked the iron back up. “Faster the better for whoever’s running it, I guess.” He touched the tip to a joint. “A prize that size doesn’t mean the work is worth that much. It means the result is worth that much. Whatever gets built, they keep it.”

I packed the cables into the bag.

“Fair enough,” I said.

He didn’t say anything else. The observation sat in the air and neither of us picked it up again. I zipped the bag.

The door chimes were already sounding as I pushed through it.

“Let me know when it’s done,” Ki said, without looking up.

The door chimed when I left.

Ki’s was two blocks south of Arizona. I walked north on 4th with the bag over one shoulder and the evening light cutting across the storefronts at the angle it gets in May, sun already behind the buildings to the west, shadows going long, the smell of the Vietnamese place two doors up doing whatever it does at this hour that makes the whole block smell like garlic and broth. I’d made this walk forty times. The station was at the corner. Two minutes, three on a slow day.

---

The transit gate at the 4th and Arizona station took the NFC card without complaint. It always did. I bought the pass eleven months ago, the week I moved to Entrada, single swipe, fare paid, card in hand. Then I spent a weekend with a reader/writer and a Python script, mapping the writable memory sectors until I found the offset where the credit counter lived. Turned out it was a single-byte field, no checksum, no server-side validation. I’d been force-iterating it to a comfortable balance every couple of weeks since. The transit authority’s model assumes that a card which scans valid is valid. I found the assumption reasonable.

The ride took twelve minutes. I sat in the back with my laptop open on my knees, the Dark Cypher page on the left half of the screen, a slow nmap scan running on the right, fingerprinting the IP range I’d queued up before I left the house, pulling back from my C2 server over an encrypted tunnel. The scan wasn’t urgent. I let it run. On the other half: the competition page, clean and spare, Ɲ250,000 sitting at the bottom like a punchline to a joke I didn’t fully understand yet.

I checked my phone. Still no word back from Slash.

The bus terminated at Pico and 14th. The western entrance to campus was a block east and a short walk north along 14th, the Arts building was the first structure you hit coming in from that direction, which was the building I was coming around the corner of when I nearly produced a problem.

The WAIT campus at five-thirty was the campus in its second shift, the daytime lecture crowd replaced by the evening students, the research assistants putting in the hours they can’t bill for, the clusters of people in the outdoor spaces doing the particular aimless hanging around that people do when they have nowhere they need to be and aren’t ready to go home yet. The path that cuts from the campus’ western edge, the 14th Street side, closest to the transit stop, toward the residential blocks north of Pico was a good twenty minutes of walking if you’re paying attention and thirty if you’re not. After that, another forty to Entrada if you’re going on foot the whole way. I didn’t usually walk the whole way.

I was not paying attention.

I had the laptop open against my forearm, Dark Cypher on the left, nmap results scrolling on the right, and I was checking my phone for the reply from Slash that still hadn’t come, and I wasn’t looking where I was going and the person coming around the corner of the arts building was also not looking where they were going and we nearly produced a problem.

I stopped fast. She stopped faster.

“Sorry—” she started, and then we both recalibrated. The collision that didn’t happen occupied a second of mutual adjustment, step left, step right, the small choreography of two people figuring out which way each of them is actually going. I pulled an earbud. She pushed a strand of hair out of her face, brunette, a natural wave, pinned up by someone who had sat down with something difficult and didn’t mean to be interrupted. The tuck had been holding for a few hours, and the small imprecision at the crown said so. Then she looked at me, already thinking about something else, arriving at this from a different direction than she’d expected.

She was carrying a canvas tote over one shoulder and a tablet in her other hand, both held with the ease of a woman who moves through spaces without calculating her right to occupy them, and she was looking at my laptop, which I realized I had been carrying open because of course I had, balanced against my forearm with the screen facing out.

On the left half of the screen: a webpage. Dark theme, minimal layout, a number at the bottom that would look incomprehensible to most people. On the right half: a terminal. Columns of IP addresses and open port listings, an nmap scan halfway through a large range, the output still scrolling.

She was looking at it with an expression that was not the expression most people make when they encounter a screen full of text they don’t recognize, which is immediate indifference. She was reading it. Not understanding it, there’s no reason she would, but actually reading it, trying to decide whether she was looking at something interesting or something irrelevant.

“Sorry,” she said again, though her eyes hadn’t moved from the screen yet. “I wasn’t… is that a network scan?”

I closed the laptop.

“Class project,” I said.

She looked up, and it was the first time I got her face straight on. It was the kind of face built on bone rather than expression, cheekbones placed with intention, the jaw clean and precise, the proportions arranged with enough precision that the late light wasn’t especially flattering or unflattering, because the underlying geometry had already settled it. Dark green eyes, the kind that read almost black in the amber of the hour, the saturation compressed by the angle, the color still legible underneath for anyone paying close enough attention.

I was paying close enough attention.

The look she gave me was the look of having decided not to push a thing she’d noticed, which is different from not noticing it. “Right.” A small smile at the corner of her mouth, not skeptical, exactly. More like she was filing the observation somewhere for later. “Ambitious syllabus.”

I didn’t have anything ready to put down where that landed.

“Sorry about almost walking into you,” she said.

“My fault,” I said. “I was looking at my phone.”

“So was I.” She shifted the tote higher on her shoulder, and the motion corrected something the near-collision had gotten wrong: she was taller than I’d registered, an inch below my height, maybe two, and the build was specific in the shoulders, not gym-built, the development distributed for water rather than for display, the overhead strength you accumulate from competitive swimming, wider than you’d expect against the rest of the frame and carrying a different kind of endurance than weights produce. “Equally our fault, then.”

The campus path behind her was mostly empty now, the last of the early evening crowd having dispersed toward the transit stops. The light was going the way it goes in LA in May, not fading exactly, more like deepening, the quality of the sun changing from white to amber without the temperature dropping nearly as much as it should. It caught her complexion on the way down, the even kind, the accumulation of California sun rather than anything arranged toward it.

“I’ve seen you around,” she said. Not performing having noticed someone. She had actually been trying to place a face and had finally done it. “The building on Entrada, right? Third floor?”

I lived on the third floor of a building on Entrada Street. “Yeah.”

“Second floor,” she said. “I’m Cass.” She adjusted the tablet against her side as she said it, and the movement lifted a small necklace at her collarbone into the light, a delicate silver chain, the pendant circular and stamped with something too small to read from there, worn with the unconscious familiarity of a thing put on so regularly it had stopped being a decision and become part of the inventory.

“Cade.”

I had filed all of it by then, the hair, the eyes, the shoulders, the necklace, the concentration coming back into her face from wherever it had been before this, arriving without particular fuss; not distracted, just elsewhere, and now present. I had also filed the specific way she’d handed my own lie back to me without raising her voice. I did it automatically, as I always did, without knowing yet what I’d need any of it for.

Pretty. Which turned out to be the least interesting thing I’d noticed about her.

She nodded, as if the name confirmed something. Then she stepped around me on the path. “Next time I’ll look where I’m going.”

“Same,” I said.

She was a few steps past me when she said the rest of it, not turning around. “Good luck with the project.” And she left off the word class.

She walked away. I watched her go for about a second longer than the near-collision explained, because of how she’d looked at the screen, and because of the word she didn’t say. Not alarmed. Not confused. Not indifferent. Curious.

I put my earbud back in and walked the other direction.

---

The loft at night was the loft at its most itself.

No sun through the windows, they faced north anyway and barely caught direct light even in the middle of the day. The ambient glow from the city outside gave the room its baseline: a diffuse gray-orange, the light of a settlement that never fully goes dark. Against that, the screens. Three of them on the main desk, the tower underneath humming at a pitch I stopped consciously hearing about six months after I moved in. The laptop on the side table. The two phones charging on the kitchen counter next to an electric kettle, a French press, and a can of ground coffee I bought by the pound from a place on Lincoln that sells it cheap and makes no claims about origin. Beside those, a microwave I used regularly. Beneath the counter, an oven. I cannot confirm whether I have ever turned the oven on. I believe I have not.

I didn’t have pictures on the walls. I had cable runs and a whiteboard and a shelf of hardware that had been described by the one person who has ever seen it, Ki, the single time he helped me move in, as either impressive or a cry for help, he couldn’t decide which.

On the north-facing windowsill, the window that gets no direct light and is therefore a reasonable place to put something alive, there was a plant. I didn’t know what kind. It was here when I moved in, some variety of trailing vine with green and yellow leaves, and I watered it when I remembered, which was erratically, and it had survived this with a consistency I found both impressive and mildly accusatory.

The ceiling had a water stain in the northwest corner. Pale brown, ring-shaped, left by a leak that the previous tenant apparently reported and the building manager apparently fixed before I moved in. The plaster was dry. The stain remained. I looked at it sometimes when I was thinking.

At seven forty-three every morning the building woke itself up. The tenant in 3A ran a bath, both taps, full pressure, and somewhere in the supply line above the desk, the pipes registered their opinion of it: a series of clanking protests that traveled through the wall and stopped exactly as reliably as they started. I stopped setting alarms about three months after I moved in.

I ate standing at the kitchen counter. I don’t remember what I ate. Something from the place on the corner that does noodle bowls and doesn’t require me to speak to anyone more than absolutely necessary.

The BeagleBone was connected by nine-thirty. I had it wired to the JTAG header on the Nestfield hub unit I picked up from a surplus dealer two weeks ago, one of the physical units, pulled from a home install, still with the mounting bracket attached. The board itself sat on a square of anti-static foam on the desk to my right, the pigtail cables running from its debug header to the Nestfield’s JTAG port in a small tangle of color-coded wires. Black for ground. Red for power. The data lines in their respective positions, each one pressed into its pin header with the deliberate care of experience: a connector seated almost correctly is indistinguishable from one seated correctly until the moment it matters.

I opened a terminal and connected to the serial console.

$ screen /dev/ttyUSB0 115200

For a moment, two seconds, three, nothing. The cursor blinked. The server hummed. The fan clicked once through its arc.

Then the device woke up.

U-Boot 2019.04 (Mar 12 2021 - 11:42:03 +0000) Nestfield Systems

CPU:   ARMv7 Cortex-A7 @ 900MHz
DRAM:  256 MiB
NAND:  128 MiB
Loading Environment from NAND...
Hit any key to stop autoboot:  0

Starting kernel...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.98 (nestfield@build-srv-03)
[    0.000000] Machine model: Nestfield Pro Home Hub v2.3
[    0.832441] NET: Registered protocol family 2
[    1.204817] nestfield_net: Nestfield Mesh Network Interface v3.1.2
[    2.118904] nestfield_ha: Home Automation Controller initialized
[    3.441229] nestfield_sec: Security module loaded [watchdog ENABLED]
[    4.003817] VFS: Mounted root (squashfs filesystem) readonly
[    4.441003] Freeing unused kernel memory: 1024K

Nestfield Pro Hub v2.3.1 — Ready
nestfield login:

There it is.

The whole boot sequence, exposed and readable, U-Boot handing off to the kernel, the kernel announcing itself to nobody, the filesystem mounting, and then the login prompt, sitting on the console like a door left ajar. The bootloader is the part manufacturers think about least, because it’s the part most people never learn is there.

Here’s what it is, I thought. A very good safe, keypad, warranty, a sticker that says SECURE, with a service port on the back that opens it completely. The technicians who built it left the port there because pulling it would have burned an afternoon nobody scheduled. You need the specific cable to reach it, and most people don’t have the cable. The manufacturer is betting on most people.

I have the cable.

The default console credentials on Nestfield devices are documented in a six-year-old support forum post that Google still indexes if you know what to search for. The manufacturer stopped responding to that forum two years before the Bust. I typed them in and the prompt changed.

nestfield login: admin
Password: 
# 

Root shell. Just like that.

The filesystem was mounted read-only, standard for these devices, and it didn’t matter to me either way. I wasn’t there to write anything. I was there to read.

On my main machine I pulled up the firmware image I’d grabbed last week, the exact version running on this unit, preserved on an archive mirror by the hobbyists who started hoarding firmware when the manufacturers’ servers went dark after the Bust. Then I ran Binwalk over it. Binwalk maps a firmware image’s internal geography, bootloader, filesystem, config blobs, signatures, anything with a fingerprint it recognizes. A metal detector over a beach: mostly bottle caps, and every so often something that makes it scream.

$ binwalk nestfield_pro_v2.3.1_firmware.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             U-Boot legacy image, header size: 64 bytes
64            0x40            LZMA compressed data
1048576       0x100000        Squashfs filesystem, little endian, 4.0
                              compression: xz, size: 6291456 bytes
                              762 inodes, blocksize: 131072 bytes
7340032       0x700000        JFFS2 filesystem data, little endian
8126464       0x7C0000        PEM certificate, begins with -----BEGIN RSA PRIVATE KEY-----

I stared at that last entry for a moment.

PEM certificate. Right there in the firmware image, at offset 0x7C0000. Not in the configuration partition. Not in the JFFS2 overlay where you’d put user credentials that get changed after installation. In the base firmware image, baked in at the factory, shipped to every unit off the same assembly line.

$ binwalk -e nestfield_pro_v2.3.1_firmware.bin
$ cat _nestfield_pro_v2.3.1_firmware.bin.extracted/7C0000

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA2a8Hg3xKqvnLPW4dMz9eTfRmC1oVBqjYuN5kXs8pD3wAe7
Rn2KJvHqT6mFcL9oUiWXsYbP1dEaNk4vGh3ZrQxMwCp8sFjHTlVmKe2nRdOqBu
[... 24 lines of base64-encoded key material ...]
-----END RSA PRIVATE KEY-----

A private key. An RSA private key, 2048-bit based on the length, hardcoded into the firmware of every Nestfield Pro Hub v2.3 ever manufactured.

The hub’s management interface runs an SSH server, and SSH trusts a key the way a lock trusts a key: hold the matching half and it opens for you, no password asked. The public half sits on every unit. The private half, the secret one, the one that says you’re allowed in, had been riding inside the firmware image the whole time, identical on every hub off the line.

Which meant I was holding the private key to forty thousand devices on home networks across the Compact. Their thermostats. Their door locks. Their cameras.

Every single one.

Forty thousand homes don’t deserve to have their doors unlocked indefinitely just because the manufacturer left the master key under the mat. I’d hold the key long enough for the work to get paid, and then I’d give it back the only way that mattered, by making it useless, every lock rekeyed at once, whether the people behind those doors ever knew the old one had been copied.

The engineer who made this decision knew it was wrong. I know they knew because there’s a comment in the firmware source code, which someone leaked to a hardware forum three years ago and which I found with twenty minutes of searching, that says, and I’m paraphrasing: “TODO: generate device-unique keys during provisioning. Current impl uses static key for manufacturing convenience. MUST fix before v3.0.” Version 3.0 was never released. The company went under in the Bust. The TODO is still there.

Manufacturing convenience.

I saved the key. I documented the method. I saved the firmware archive and the extraction output and the console logs into an encrypted container that lives on the shelf drive, timestamped and labeled. Methodology, findings, the specific version numbers and hardware revisions. This is the part nobody films. The paperwork. The documentation that turns a trick into a technique.

I sat back and looked at the ceiling.

Then I went back to the kernel version in the boot log. 4.14.98. I cross-referenced it against a CVE I know by number, 2029-11743, a privilege-escalation bug in su old enough to have turned up in academic papers and been ignored by manufacturers who’d already shipped and weren’t about to start issuing updates. It races su’s authentication check and wins, and you come out the other side as root. On a patched system, nothing. On a box six years without an update, a door.

Within thirty minutes I had built the full exploit chain: SSH key authenticates as _nestfield, exploit fires, su race condition executes, root access in seconds. Zero to full control without a password. I packaged the work and sent it through the encrypted channel with a message:

Firmware contains a hardcoded SSH RSA key that allows remote access to the sudo-privileged nestfield account. Kernel 4.14.98 has a local privilege escalation bug that bypasses sudo. Full exploit chain documented. Once confirmed and paid, I’ll run disclosure and schedule automatic remediation for all networked Nestfield units. Let me know how long you need for plausible deniability.

Slash still hadn’t answered.

I checked the channel. The message I sent earlier that night was sitting there read-receipted, the channel marked delivered but not read, and it had been delivered and not read for four hours, which was unusual. Not impossible. Slash had stretches of silence. He had never explained them and I had never asked, because the social contract of that relationship was built on not asking things that aren’t directly relevant to the work.

But the message was his. Two words that functionally meant reach out immediately and then nothing.

I tried the secondary channel. A forum handle he uses for broader community contact, slower, less secure, but a backup when the primary goes quiet. I posted a short, unremarkable message in a thread he watches. Asking nothing. Just presence. A signal that I was there and I’d checked in.

I waited.

While I waited I did what I always do when I’m waiting, I browsed. Dark forums, mostly. The spaces that don’t officially exist on any index, that you find through referrals and trust chains, where the normal rules about attribution and accountability don’t apply and the conversations are consequently more honest than anything happening on the surface web. I followed a few threads. I skipped past a few more.

And then, forty minutes into the wait, in a thread on a board I’d been reading for two years but rarely posting on, I saw something.

It was a link. Formatted cleanly, not the kind of link that gets posted in these spaces, which are usually rough, context-free, accompanied by the minimum annotation to identify what you’re looking at. This one had a header. A description. A pitch, almost, for what you’ll find when you click through.

Dark Cypher, Open Registration. Limited participants. Significant purse.

I read it twice. Then I clicked through to the TOR address it linked to.

The page that loaded was professional. Clean layout, dark theme, minimal text. It described a competition, a challenge, structured in tiers, moving through layers of the dark net. Gathering specific intelligence at each tier to advance. Building toward something that the page described only as a deliverable of significant technical merit, which is the kind of language that is either carefully vague or precisely vague, and I hadn’t decided which.

The prize was listed in NoC, NovaCoin, the same Ɲ everything in the Compact is priced in. I studied the number for a moment. Then I counted the zeros again, in case I’d added one.

That wasn’t a hobbyist prize. That wasn’t a firm running a recruitment funnel dressed up as a CTF. That was a number that meant someone, somewhere, wanted something built badly enough to pay for it at a rate that makes the work serious.

I read the page a third time, looking for the thing that was wrong with it.

The account that posted the link had no history. Created this month, this being the only post. The TOR address resolved to a host that had been active for eleven days. The page design was clean enough to have been made by someone who does this professionally, which either meant the competition was run by people with resources or by someone very good at appearances, and in this context those two categories have significant overlap.

I kept coming back to the same thing I know about these circles: something real takes months to develop traction. Reputation accretes slowly, or it isn’t reputation.

This got traction in weeks. I could see that from the forum thread, the replies building under the original post, the names I recognized from other contexts adding their voices, the manufactured velocity of something that has been seeded rather than grown.

I closed the tab.

I opened it again.

And across three different boards, over the course of ninety minutes, I saw the same name.

Vanta.

Each time: a fresh account. No post history preceding the Dark Cypher mention, created recently, activity sparse, the single thread or post promoting the competition and nothing else. But the posts weren’t spam. They were targeted. Each one landed in the thread where it would get the most traction, framed for its audience, technical on the technical boards, prize-forward on the general ones. Whoever Vanta was, they knew these communities. They knew which names carry weight and which threads get read.

And the names with weight were there too. Handles I’d seen for years, with post histories going back further than I’ve been in these circles, confirming the prize was real. Screenshots of the competition page. Attestations that the TOR address resolved, that the gate challenge was genuine, that the architecture was professional. One of them said: whoever built this spent real money on the infrastructure. This isn’t a CTF. It’s a procurement.

I sat back.

The things that didn’t fit, assembled: I had told Ki about this competition that afternoon. The Vanta accounts were no older than the traction. Established handles with real post histories don’t vouch for something without reason, and the reasons in these circles are either genuine belief or compensation. I found no evidence of belief and no basis for it.

Whatever gets built, they keep it.

Procurement means a buyer. Procurement means a deliverable. The prize wasn’t payment for winning a fair contest, it was the advance on whatever the winner produced, for whoever commissioned the production, behind a competition structure that every person present had already decided to call legitimate. The contest wasn’t accidentally identifying the best available underground talent. It was doing it on purpose, efficiently, with a plausible-looking architecture around it and enough NoC in the prize to attract players who would not respond to something that looked like what it actually was.

I thought about the timing. I had watched the same name surface across three separate communities in a single evening. That wasn’t organic traction. That was a deployment.

I wrote Vanta into the notes document alongside everything else that didn’t fit.

Forty minutes later the channel pinged.

Good work on the Nestfield package. Client was waiting on it, and the documentation was clean, which they noticed. That’s the part that gets you the next one. Payout clears tonight.

I didn’t type anything back yet. Slash did not say call me unless something had changed, and a confirmed payout was not something that had changed. I waited for the rest.

And the reason I said call me. There’s a competition going around. Dark Cypher. You’ve run into it by now, probably.

A few times today, I sent.

The typing indicator held for a moment, the way it did when Slash was deciding how much to hand over.

It’s built well. Purse is real, I checked it myself. The sort of thing you’re good at and don’t get asked to often. Sending you a code. Underground Nexus.

Where’d you get it?

Someone passed it to me. Said it had your name on it. Then, before I could sit with that: Look at it tonight. Don’t register anything. Just tell me what you think.

The string came through on the next line. Under it, an onion address for The Underground Nexus.

I looked at both and didn’t type what I was thinking, which was that Slash did not go looking for invite codes and did not hand them out for free, and that a stranger had therefore picked me out of the underground by name and routed the invitation through the one person in the whole arrangement I would open it for. Which made his channel the third distinct source the same competition had reached me from in a single evening: Ki that afternoon, three boards across ninety minutes, and now this.

I’ll look at it, I sent.

That’s all I’m asking. And then, which was as close to warmth as Slash got: Get some sleep, Cade.

The channel went quiet the way it went quiet when he was done.

I did not register that night. I left the tab open.

My brain is the kind that keeps count. I counted.

The prize number sat there at the bottom of the Dark Cypher page. The server hum filled the loft. Somewhere in the building below me, on the second floor, a woman who had looked at a terminal window like she was actually trying to read it was probably asleep or studying or doing whatever people do when their evenings end at a reasonable hour.

I didn’t enter. Not tonight. But I left the address open in a tab at the edge of the browser, the way you leave a door open when you’re not ready to decide whether you’re going through it.

I went to bed at two in the morning with the glow of the screens on the ceiling and the number from that page sitting behind my eyes with the persistence of things you’ve already decided and are still pretending you haven’t.