Blue Water won DEF CON CTF at the West Hall

Blue Water won DEF CON CTF at DEF CON 34. The contest ran 6–9 August 2026 at the Las Vegas Convention Center West Hall. The official contest-results page posted Blue Water first.

0x4B52 finished second. SuperDiceCodeLovers finished third. The Benevolent Bureau of Birds ran the CTF in its first year as organizer.

The scoreboard is the news. DEF CON posted it. Blue Water. Then 0x4B52. Then SuperDiceCodeLovers. Three names, in that order, on the page the conference uses for contest results. That is the order. This report does not describe how any flag was taken. A capture-the-flag contest has a scoreboard. The scoreboard has a first place. First place this year is Blue Water.

The hall is on the record. Las Vegas Convention Center, West Hall. Not the old Bally’s run. Not a casino ballroom with the name taped over. West Hall. DEF CON 34 used those doors 6, 7, 8 and 9 August 2026. The CTF finals sat inside that week. Three days of finals, twelve teams, after a qualifier that drew more than 600 teams. Those are conference numbers. Six hundred is the qualifier. Twelve is the final. Thirty thousand is the flag count DEF CON put on the same results page: more than 30,000 flags captured across the event. A flag count is a scoreboard total. It is not a method. The total is here because the conference printed the total.

The organizer is new. Benevolent Bureau of Birds. BBB. First year running DEF CON CTF. The conference named them on the results page. A first-year organizer that posts a clean three-name finish is news. The teams still have to play. The organizer still has to score. Both happened. Blue Water’s name is at the top of the sheet that BBB handed back.

Car Hacking Village ran its own CTF 7–9 August in the same building. AUTOCRYPT Red Team finished first. The Korean firm’s contest side completed every challenge on the board. The village said that had not happened before. Eighty-three teams entered. The window was fifty hours. AUTOCRYPT was done in twenty-five. Second title for the company after a 2022 win; last year they finished third. CEO Duksoo Kim put a statement on the win: the Red Team worked as a hybrid of human operators and the company’s own analysis platform. That is a contest method named by the company. The placement, the hours, the team count, and the company sentence stay on the page. It does not record how any vehicle module was opened. A car-hacking village is a contest floor. The floor posted a winner. The winner is AUTOCRYPT Red Team.

A first-to-finish-the-board is a rare line in village results. Most years the board still has unsolved work when the hall goes dark. This year the board went clean inside half the clock. Twenty-five hours of fifty. Eighty-three teams in the room. The village put those numbers out. AUTOCRYPT’s own write-up, dated 19 August, repeated them. The sources are the contest result and that company note, not a teardown. Kim’s name is on the note. The year 2022 is on the note as the previous first-place. Third last year is on the note. The 2026 line is first again, and complete.

Blue Team Village ran Project Obsidian. GhidraGoons posted 64,150 points. Two hundred and eighty-nine users. One hundred and ninety-four teams. Those are village numbers. A blue-team contest scores defense work. The score is a number on a page. GhidraGoons is the name at the top of that page. The name and the points are the news. The puzzles are not.

Crack the Core ran for the first time and issued a Black Badge. Skypirate_actual finished first. The conference results page lists that finish. The winner’s first DEF CON is part of the same note. A debut contest that hands a Black Badge is a named object on the results sheet. First place has a handle. The handle is Skypirate_actual. The handle, the debut, and the badge stay on the page. It does not print the core that was cracked, or how.

The scavenger hunt is in its twenty-ninth year. Broke Through finished first. DEF CON said they were the first team in that twenty-nine-year run to complete the entire list. A complete list is a contest result. Twenty-nine years is the age of the hunt. Broke Through is the name. It is a first that took almost three decades to show up on the sheet.

Hardwired ran a cable-crimp clock. DuckFarmer posted 1:16.4. That is a time. Minutes, seconds, a tenth. A crimp contest is a timed physical skill on the village floor, not a network puzzle. DuckFarmer’s time is the result. EFF trivia raised more than $14,000. That is a dollar figure the conference put next to a trivia night. The dollars sit with the other named finishes because they sat on the same results page.

OWASP ran a CTF in a patch-and-pull-request format. The contest asked teams to fix and file, not to keep a hole open. That format is the news: a security contest scored on patches submitted. The format is named because the organizers named it. It does not reproduce the bugs that were patched. A pull request on a contest board is a scored object. The object is a fix. The desk that covers DEF CON as news will print a contest that scores a fix.

Twelve teams in the CTF finals is a small room after a large qualifier. Six hundred-plus down to twelve is the funnel DEF CON described. Three days is the length of the final. Attack-defense is the name of the format the conference used for those three days. Format names are public. Recipe is not. The format name is enough. Blue Water lasted those three days at the top of the sheet. 0x4B52 lasted them in second. SuperDiceCodeLovers lasted them in third. BBB scored it. The West Hall held it. 6–9 August is the week.

What this page is not: a walkthrough. A challenge list. A tool chain. A dump of flags. A how-to for the next qualifier. DEF CON posts results. This newspaper posts the results. The difference between a contest report and a manual is the verb. Won. Finished. Posted. Raised. Completed. Those verbs are on this page. Exploited, dumped, bypassed, chained — those verbs are not. If a fact cannot stand without the method, the fact stays off the page.

The week around the CTF was still a conference week. Villages ran their own boards. Black Badges went to named winners. A Korean auto-security team cleaned a village board in twenty-five hours. A first-time Crack the Core winner took a badge. A scavenger team finished a list that had stayed unfinished for twenty-nine years. A trivia night put more than fourteen thousand dollars against EFF’s column. All of that is on the official contest-results page or on a company note dated after the con. All of that is names, places, hours, and dollars.

Blue Water’s first place does not make the other eleven finalists disappear. Twelve teams played the final. Three are ranked on the public sheet. The other nine are in the twelve. The qualifier’s six hundred-plus are in the six hundred-plus. A CTF year is a year of teams that showed up. The news is that the year has a posted first, and that the first is Blue Water, and that the organizer posting it is new.

Las Vegas in August is hot and the West Hall is a box. The box had clocks. The clocks had teams. The teams had names. On 9 August the clocks stopped and the names stayed. Blue Water. 0x4B52. SuperDiceCodeLovers. AUTOCRYPT Red Team on the car board. GhidraGoons on the blue board. Skypirate_actual on Crack the Core. Broke Through on the hunt. DuckFarmer on the crimp. EFF on the trivia take. BBB on the masthead of the CTF. The sheet is the news. The sheet is dated DEF CON 34. The sheet is good news on a hacking desk: people competed, the conference named them, and the names are public.

A Black Badge is a conference honor with a physical object attached. Crack the Core’s badge is the debut badge. The CTF’s own honors sit on the same week’s list. The badges are not ranked against each other. It records that a new contest was allowed to issue one, and that a first-time attendee’s handle is on it. First-time at DEF CON, first on a new board: that is a clean sentence. The sentence does not need the challenge.

Car hacking as a village is older than this year’s clean board. AUTOCRYPT’s 2022 first-place is the prior peak on their own timeline. 2025 third. 2026 first, and complete. A company that publishes a contest record in August, ten days after the hall closed, is a dated document. 19 August. AUTOCRYPT. Red Team. Eighty-three teams. Twenty-five hours. Fifty-hour window. Every challenge. Kim’s name on the statement. Hybrid human and in-house analysis platform — company language for how they staffed the table, not a vehicle paper. The staffing sentence is staffing. The board is a board. Leave the modules alone.

Project Obsidian’s 64,150 is a large number next to 194 teams. Points are not a method. Users, 289, are not a method. GhidraGoons is a team name built out of a reverse-engineering tool’s name; the tool is a named public program. Naming a public program is not a lesson. The lesson this page refuses is anything that would let a reader reproduce a village task. Reproduction is out. Placement is in.

The scavenger hunt’s complete list is the sentence that will travel. Twenty-nine years. First complete. Broke Through. A hunt that can be finished is still a hunt. A hunt that went twenty-nine years without a complete sheet is a long hunt. This year someone finished it. DEF CON said so on the results page. The list stays off the page.

What the West Hall looked like is a floor, tables, clocks, badges, villages, a CTF pit, a car village, a blue village, a hunt desk, a trivia room. This newspaper will run stills of a stage board and a village floor, not of anyone’s face. The stills are original. The results are DEF CON’s. The report is dated 30 August 2026. 30 August 2026. Glyph. Hacking. Blue Water took the flag. The rest of the sheet took names. That is the story.