Windows 10, iOS 14, Chrome, Safari, and Firefox were hacked in Tianfu Cup, China's largest hacking competition; winning team from Qihoo 360 got $744K in prizes
Context & Ripple Effects
The Tianfu Cup is running its second headline-grabbing edition since becoming China's top contest after a participation ban kept Chinese researchers away from foreign events like Pwn2Own — last year it saw Chrome, Edge, and Safari fall on stage. This year the scope widened to full operating systems: Windows 10 and iOS 14 went down alongside all three major browser engines.
The result lands months after the 2020 Pwn2Own ran virtually and still produced exploits against Windows, macOS, Adobe Reader, and desktop Safari — evidence that elite exploit work continued on both sides of the split even as the two circuits no longer share competitors.
First-order effects
- Qihoo 360's winning team walks away with $744K and holds working exploits against fully patched Windows 10, iOS 14, Chrome, Safari, and Firefox, putting Microsoft, Apple, Google, and Mozilla under immediate pressure to ship fixes.
- Vendors who do not attend Tianfu Cup now learn about critical holes in their flagship OSes and browsers secondhand, through disclosures made on a stage they have no presence at.
Second-order effects
- With Chinese researchers concentrated at Tianfu Cup rather than Pwn2Own, the $744K payout sets a new benchmark that pressures both contests to raise bounties to keep top talent — a bidding dynamic visible in the corpus's own payout history, where Pwn2Own totals grew from $557K in the 2015 Firefox-Chrome-Safari round to seven figures today.
- Qihoo 360's sweep reinforces the position of China's large security firms as the primary employers of elite exploit researchers, squeezing independent teams out of the highest-value targets.
Third-order effects
- If the circuit split holds, browser and OS patch cycles will increasingly be set by demonstrations at national contests rather than a single global venue, fragmenting the vulnerability-disclosure calendar along geopolitical lines.
- A recurring pattern of one domestic firm dominating the flagship targets points toward consolidation of offensive research capability inside a few state-aligned companies — a structural shift regulators and vendors would need to account for when assessing whose exploits exist in the wild.
The trend: Elite hacking competitions are splitting along national lines, with Tianfu Cup displacing Pwn2Own as the stage where China's top researchers demonstrate browser and operating-system exploits.