The block chain can't though once the coins are transferred

That assumes the key is actually on the server.

I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.

	▲	muvlon 5 hours ago \| parent [-]
		The server could simply be running a patched PHP.