It'd probably be easier to build a BTC-related website, let it grow a bit, then empty the wallets of everyone visiting it. It'd probably also be easier to compromise an existing site and throw your code/exploit up. I wouldn't try building a worm, that's for sure.