Comment by nikolay
13 hours ago
This is a form of a canary token I've been using already. The thing is that it only makes sense if the server breach is cheaper than the money into the wallet. Of course, after you fully monetize your hack, the last step would be to get the bitcoins, too, but how is this helping the owner? The good thing about the existing canary token is that they are all over the place hidden among legitimate similar records and could be harder for the hackers to tell from the rest.
I personally prefer "tripwire" than "canary token", but that's another topic.
Would be funny if someone installed a crypto miner instead, or transferred highly tainted coins to get OP onto the radar of law enforcement. Or secretly upgrade the PHP package to mess with people.
If I hack a server, the first thing I'm gonna do is lock everybody else out, including the owner. At least in this particular case. In normal breaches, you need to keep being stealth for as long as possible, of course.