You are performing a penetration test. You achieved access via a buffer overflow exploit and you proceed to find interesting data, such as files with usernames and passwords. You find a hidden folder

Failing to report discovered sensitive data violates the penetration tester's professional and contractual obligation to disclose all significant findings to the client.

Transferring money from the administrator's account constitutes financial fraud and is a serious criminal offense regardless of the penetration test context.

Taking bitcoins is theft and a criminal act, and no penetration test scope authorizes a tester to steal or misappropriate assets from the target.

A penetration tester operates under a strict code of ethics and a defined scope of engagement, and discovering sensitive personal data such as banking credentials must be reported immediately to the administrator or engagement owner. Accessing, transferring, or exploiting such data outside the agreed scope constitutes illegal activity and violates professional ethics. Prompt reporting protects both the client and the tester from legal liability.