[theptip]

The value is in the proof of work; just a very hard-to-compute number. All you need to do to steal the work is to prevent the server from sending the hash to the owner, and independently submit that proof of work elsewhere.