Chapter 9: First Blood
I really did try to sleep this time. I got into bed, pulled the covers up, closed my eyes, told myself I'd go to sleep like a normal person because I had uni tomorrow and showing up looking like death wasn't exactly keeping a low profile. I lasted about four minutes. Tossed and turned and stared at the ceiling and tossed again and none of it worked.
"Okay, this is just getting stupid. Hhpfff."
I did a big sigh and got out of bed. Biscuit lifted his head off the pillow, looked at me, decided I wasn't interesting enough to stay awake for, and went straight back to sleep. I walked over to my desk and stood there drumming my fingers on the wood, looking at my laptop.
"Right. I think I'll do one simple job. Or look around for one. If I can even find one at all."
I turned on my laptop and went straight to the forum.
The bounty board was busy for this time of night. New posts every couple of minutes. I started scrolling through them, reading the descriptions, checking the payouts. Last time I'd gone in way too fast. Saw a job, jumped on it, didn't think.
"I even forgot to set up a wallet. I still feel stupid for that one." I rubbed my face with both hands. "But okay. Relax. This time it's going to go alright. I've got everything set up. I just need to find something good and hope I'm the first one to see it."
I scrolled past the big jobs. Not because I couldn't do them. Probably. But they didn't work like the small ones. The big bounties weren't open to everyone. You had to contact the seller first, send them your history, prove you were worth the risk. They'd look at your profile, your completed jobs, your reputation score. And mine was zero. Completely empty. Nobody was going to hand a serious contract to an account that was created yesterday.
"Okay, so I have to build my portfolio. My reputation." I said it out loud and then stopped. Sat there for a second. "I need to build a portfolio. For hacking. For doing something illegal. Like it's nothing."
And then it hit me.
Not the hacking part. I'd already done that. I'd broken into that German company and pulled data and got out clean. That wasn't what hit me. What hit me was how easy it felt. How normal. I was sitting in my mum's house in my pyjamas, scrolling through a list of crimes like I was browsing job listings on Indeed, and my only concern was whether my CV was good enough.
Why was I doing this?
My hands stopped moving on the keyboard. I just sat there. Staring at the screen but not seeing it. My brain did that thing where it loops, where the same question comes back around and around and you can't get off it.
Why? Why this? I had two gifts that could do anything. I could study. I could build things. I could go legit from day one and never break a single law. So why was my first instinct to open Tor and look for someone who'd pay me to break into their competitor's systems?
I looked down at my hands. They were shaking. Not a lot. Just a little tremor in my fingers, like I'd had too much coffee except I hadn't had any. I pressed them flat on the desk and held them there.
Was this who I was? Before, in my old life, I was nobody. Normal bloke. Nothing special. Never broke the law, never even thought about it. And now I had power and the first thing I did with it was this?
I sat with that for a minute. Maybe two. The house was dead quiet. Just the boiler clicking downstairs and Biscuit breathing on the bed.
And then the answer came. Not a dramatic one. Not some big moral revelation. Just a quiet, honest thought: because I can. Because nobody else can do what I can do. Because the people posting these jobs are going to hire someone anyway, and at least I know where the line is. At least I won't cross it.
That wasn't noble. I knew that. But it was true.
I unclenched my hands. Flexed my fingers. The shaking had stopped.
"Right," I said quietly. "Right. Okay."
I went back to scrolling.
I needed something small. Something clean. Something nobody else was going to bother with.
Found it on the third page. A post from a user called TradeZero, six hours old, four replies. Someone wanted access to the admin panel of a cryptocurrency exchange based in Eastern Europe. Not one of the big ones. A small outfit, maybe a few thousand users. The job was simple: get admin access, pull proof, get out. Don't touch anything, don't steal anything, don't break anything. Just prove you were in.
The bounty was 0.2 Bitcoin. At today's rate that was about sixty quid. Maybe sixty-five.
Sixty-five quid. For hacking into a crypto exchange.
I leaned back in my chair. "Not exactly retirement money, is it?"
But that wasn't the point. The point was doing it. Getting it done. Building a name. You don't walk into a career starting at the top. Even on the dark web.
I opened a new tab and started looking at the exchange. The website was rough. The kind of site that looked like it was built in 2011 and nobody had touched it since. The English on the landing page was bad enough that I could tell it had been translated by someone who spoke English as a third language at best.
I turned on System Insight.
And the whole thing fell apart in front of me.
The web server was running outdated software. Not just outdated, abandoned. The framework hadn't been updated in over two years and had four known vulnerabilities that had been publicly disclosed. The SSL certificate was configured wrong. The admin panel was on a subdomain that wasn't even hidden, just not linked from the main site. And the authentication on that subdomain was using a session token system that I could have broken with a strongly worded letter.
"Oh, come on." I actually laughed. "This is... this is really bad."
I almost felt guilty. Almost. But then I remembered that this exchange was holding real people's money with security that would embarrass a GCSE IT student, and the guilt went away pretty quick.
I went in through the session token vulnerability. It took me about eight minutes. Eight minutes from opening the tab to sitting in the admin panel looking at the dashboard. User accounts, transaction logs, wallet balances, everything. The admin password was stored in plaintext. Plaintext. In 2016. I wanted to find whoever built this site and have a word.
I took three screenshots. The admin dashboard, the user database header, and the server configuration page. Enough to prove I'd been there without exposing any actual user data. I wasn't here to hurt anyone. I was here to do the job.
Then I cleaned up. Cleared the session, removed my traces from the access logs, closed the connection. System Insight helped me check that I hadn't left anything behind. Clean. Invisible. Like I was never there.
I went back to the forum and posted my proof under the bounty. Screenshots, description of the method, timestamp. Professional. Or at least as professional as you can be when you're sitting in your pyjamas in your mum's house at two in the morning.
Then I waited.
Biscuit had rolled onto his back at some point and was lying with all four legs in the air, completely dead to the world. I scratched his belly while I waited and he made a noise that was somewhere between a grunt and a purr.
"I just hacked a crypto exchange, Biscuit. What did you do today?"
He farted.
"Fair enough."
My phone buzzed. Not the forum. Jake. A text that just said: u up? followed by nvm ur probably dead asleep like a normal person followed by actually ur never normal so maybe ur awake followed by anyway dave threw up in the taxi and we had to pay £40 extra im fuming
I typed back: go to sleep jake
cant. too angry about the £40. that's like 8 pints. he owes me 8 pints.
I smiled and put the phone down. Jake was going to text me for another twenty minutes regardless of whether I replied or not. That was just Jake.
The forum notification came through about forty minutes later. TradeZero had verified my proof. Job done. Payment sent.
I opened my wallet. There it was. 0.2 Bitcoin. Sitting there like it was nothing. Sixty-odd quid. My first earnings as Null.
I stared at it for a while. It wasn't much. Less than what Mum earned in a day at work. Barely enough to cover a week's food shop. But I'd earned it in eight minutes of actual work, and I'd done it without anyone in the world knowing who I was or where I was.
"Right," I said to the screen. "That's one."
I refreshed the bounty board. More jobs. New ones posted in the last hour. A vulnerability scan for a fintech startup, 0.15 BTC. A penetration test for someone's personal server, 0.1 BTC. Small stuff. The kind of work that real hackers wouldn't bother with because the money wasn't worth their time.
But it was worth mine. Because I wasn't building a bank account. I was building a reputation.
I took the fintech job. This one was harder. Better security, newer systems, actual competence behind the setup. It took me forty-five minutes and I had to use System Insight properly, not just glancing at the structure but really studying it, finding the one weakness in an otherwise solid defence. A misconfigured API endpoint that allowed authenticated users to escalate their privileges. Subtle. The kind of thing that wouldn't show up in an automated scan but was obvious to me the moment I looked at it.
I documented everything, posted the proof, and waited.
By four in the morning I'd done three jobs. The crypto exchange, the fintech startup, and a quick one that was just verifying whether a specific email server was vulnerable to a known exploit. It was. Took me twelve minutes.
Total earnings: 0.45 Bitcoin. About a hundred and forty quid.
A hundred and forty pounds for one night's work. Not a fortune. But more than I'd ever earned in a night before. More than Mum made in a day. And nobody knew. Not Mum, not Dad, not Nathan, not Jake. Nobody.
I closed the laptop and leaned back. The room was freezing because the heating wouldn't come on again until six. My eyes were burning from staring at the screen for three hours. Biscuit had migrated from the bed to the floor at some point and was now sleeping on my left foot.
"Okay. Bed. For real this time."
I picked Biscuit up, which he protested by going completely limp like a furry sack of potatoes, and got back into bed. He immediately claimed the pillow.
"That's my pillow."
He didn't move.
"Fine."
I lay there in the dark. The house was completely silent. Somewhere outside a fox was screaming, which is one of those sounds you never get used to no matter how many times you hear it. It sounds like a woman being murdered in your garden and it happens at least three times a week.
A hundred and forty quid. Three jobs. A few hours. And this was me being careful, being slow, picking the easy ones.
I thought about what I could do if I actually tried. If I went after the bigger bounties. The ones worth half a Bitcoin, a full Bitcoin. At today's prices that was a hundred and fifty, three hundred quid. In a year, if Bitcoin kept going up? More. Maybe a lot more.
But that was for later. Right now Null had three completed jobs, a clean record, and a name that three separate people on the dark web had now seen. It wasn't much. But last night it was nothing.
I closed my eyes. Biscuit pressed his back against my leg.
Tomorrow I had lectures at nine. Statistics. The thought of sitting through an hour of probability distributions that I could do in my sleep made me want to stay in this bed forever. But I'd go. I'd sit there and nod and take notes and be Liam Reed, the student who nearly died and came back a bit different.
Because that's what people expected. And right now, the best thing Null could do was be exactly the person nobody would ever suspect.
My phone buzzed one more time. Jake again.
he definitely owes me 8 pints. goodnight.
I smiled in the dark and fell asleep.