Payment Village — DEF CON 2026

Wall of Wallets is a hands-on CTF challenge where the goal is simple: collect as many mock payment card details as you can from other participants. Using intentionally vulnerable services in a safe, isolated environment, you'll learn how common implementation mistakes expose sensitive data.

Compete to top the Wall of Wallets leaderboard while discovering the real-world techniques attackers use and, importantly, how to defend against them.

ResearchersDan Borgogno AR

The analysis begins at Ring -3, advancing toward the positive rings. Starting from the on-screen user perspective imposes too many limitations. The shift in approach was deliberate: rather than assuming a conventional attack vector such as connecting an external device or performing a kiosk-level bypass, the decision was made to start from the deepest layers of the system. This compromise is detected for the following reason:

• DMA protection exists at the BIOS level.

The goal of this compromise is to activate PCI/PCIe through BIOS in order to perform a DMA. This section will be referred to as "BIOS Unprotection."

How was this achieved? Two methods were identified:

• A bridge was found that triggers a BIOS configuration reset.
• BIOS duplication with encryption validation bypass (enables both Downgrade and Upgrade).

DMA or complete chain will not be shown since it is a delicate topic, but BIOS research will be deepened since it does not only apply to ATMs.

ResearchersArnold Morales MX