About the Hunt
The Cryptid Hunt: Hack the Carnival is a free midway at DEF CON 35 (August 5â8, 2027, Las Vegas). Every attraction has a deliberately vulnerable control service. Crack it for an edge (extra rings, a bonus strike, more shots), then prove your skill on the real game.
House rules
- Every game is free. Rewards are points and cryptid cards on your badge, never money or merchandise from a machine.
- One hack advantage per round, redeemable once. It gives you more chances, never a guaranteed win.
- The card you earn is fixed by your score and the cards you already own. No luck, no loot boxes.
- Hack only the sandboxes under
/sandbox/âĻwith your own round token. Don't attack the site, other players, the venue network or anything else. Found a real bug? Tell a carnival worker or see the security policy in the repository. - At the booth, staff run every physical game. Moving parts and blasters have physical safety controls software can't override.
Privacy
No accounts, no email, no tracking, no analytics, no third-party scripts. The only identity is the handle your badge broadcasts. A round token lives in your browser tab and expires after 30 minutes. This browser may remember your last handle so the passport can find you; clear site data to forget it.
Status
This is a demo. Scores are simulated and reset when the demo restarts. The art is placeholder concept art until the final Cryptid Hunt illustrations arrive. Physical booths, badge taps and sponsor activations are not live yet.