Overview
BunkyoWesterns, whose roster includes an Ikotas Labs member, took first place at Hackceler8 2026 Singapore, Google’s invitational security competition. The team received the $7,331 grand prize.
In the grand final against rival hacker team DiceGang, both teams captured all seven available flags. BunkyoWesterns completed the challenges in a combined 4,728 cycles and won on speed.
About Hackceler8
Hackceler8 is a Google security competition combining CTF problem solving with speedrunning. In previous years, teams reached the event by advancing through the Google CTF qualifier. The 2026 tournament was instead held as an invitational.
The competition uses a custom Mega Drive / Genesis game developed by Google. In each round, teams receive a game ROM and source code and have 45 minutes to identify vulnerabilities and prepare an attack. A further 45-minute live segment gives them access to the console, where they deploy their exploits and compete on both the number of flags captured and the speed of each solution.
Unlike a conventional CTF based on submitting answers to separate challenges, Hackceler8 requires teams to understand the game’s logic, memory behavior, and hardware communication under severe time pressure, then turn those findings into solutions reproducible through controller input alone.
Bypassing the Game’s Protections to Achieve the Theoretical Maximum Score
In the semifinal, BunkyoWesterns reached arbitrary code execution by using only normal controller input to make the input handling overlap with executable memory, rather than directly manipulating the console’s memory with specialized hardware or a debugger.
The Ikotas Labs representative competing as a member of BunkyoWesterns then discovered a method to bypass the protection that prevented code running in one challenge from updating records for the others. Using that method, he regained execution immediately after a reset cleared the timer, set every record to the minimum of one cycle, and achieved the theoretical maximum in-game score.
First, repeated controller input in an in-game dialog places part of the supplied data over executable memory. A small receiver then starts interpreting subsequent controller samples as bytes and loads the larger attack program into memory.
The payload next installs code on the Mega Drive / Genesis Z80, a second processor operating alongside the main CPU. That code is prepared to change where the main CPU returns after a reset. Resetting the game restores permission to update scores and clears the timer, but the main CPU is redirected into the attack program instead of returning to normal gameplay. The recovered program advances the counter by a single cycle and records every challenge as solved.
Once control moves from the normal game flow into the attack program, memory and rendering no longer operate under the assumptions built into the game, causing the display to break apart as shown in the video.
Bypassing the game’s protections and reaching the theoretical maximum score
This technique would decide a match regardless of the opposing team’s performance. Google informed the team that the solution was outside the intended design and asked it to solve the individual challenges instead, so the technique was prohibited from competition use.
Competing on Game-Cheating Skill After the Ban
BunkyoWesterns accepted the ruling and did not use the all-records technique in either the semifinal or grand final. The team instead analyzed and defeated every challenge individually.
In the semifinal, BunkyoWesterns and Kalmarunionen both captured six flags, with BunkyoWesterns advancing on efficiency. In the grand final, both BunkyoWesterns and DiceGang captured all seven flags. BunkyoWesterns achieved a perfect 1.0000 efficiency score by holding the fastest record on every target, then won the match on overall speed. The result demonstrates world-class capability not only in security research, but also in game hacking.
Applying an Attacker’s View to Anti-Cheat Security
Hackceler8 tested more than the ability to play a game. Teams had to analyze source code, runtime memory, input processing, and hardware communication, then find ways to break rules and scoring systems that the developers did not anticipate.
Online games face similar threats through client modification, memory manipulation, malicious input, protocol abuse, and forged scores or items. Ikotas Labs provides anti-cheat assessments, security design reviews, and consulting from the perspective of attackers who can build and validate real cheats.
Please contact us to discuss game security, vulnerability research, exploit development, or penetration testing.