What is a crypto bug bounty?

A crypto bug bounty is a program in which a blockchain, wallet, exchange or DeFi project promises a reward to anyone who finds a security flaw and reports it privately instead of exploiting it. The people who do this are often called whitehat hackers. Because crypto transactions are hard to reverse and smart contract code is usually public, a single bug can put large sums at risk, which is why many projects run bounties alongside audits.

What is the main purpose of a bug bounty in a crypto project?

The goal is to find flaws before attackers do, and to give the finder a legal, paid alternative to exploiting them. Audits review code at a point in time, as explained in what is a smart contract audit. A bounty stays open after launch and invites many more people to look, including for well-known bug types such as a reentrancy attack.

The scale of rewards shows the stakes. In May 2022 the cross-chain bridge Wormhole paid $10 million, the top tier of its program, to a whitehat known as satya0x. The researcher had reported a flaw in its Ethereum bridge contract that could have let an attacker take control of the contracts. That payout was separate from the February 2022 Wormhole exploit on Solana.

How does a crypto bug bounty work?

Each program publishes rules. The Ethereum Foundation's program, a useful example, covers Ethereum's protocol specifications, its main execution and consensus clients, and the Solidity and Vyper compilers. Its maximum rewards are $2,000 for low, $10,000 for medium, $50,000 for high and $1,000,000 for critical bugs, with severity judged by impact, such as splitting the network or stealing ETH.

Typical conditions include a working proof of concept, testing only on private test networks, and no public disclosure before the fix. The foundation pays in ETH or DAI, requires real-name identity checks to pay out, and excludes people on sanctions lists.

What are the main crypto bug bounty platforms?

Some projects run bounties themselves. Others use a platform that hosts programs, sorts reports and handles payment. Immunefi, launched in December 2020, focuses on Web3 projects. As of October 2026 its site says it has paid more than $140 million to whitehats across more than 650 protocols and has over 85,000 registered researchers. It also runs audit competitions and offers a managed triage service that filters incoming bounty reports for projects.

What does a whitehat hacker do in crypto?

A whitehat finds weaknesses with permission or under a program's rules, and reports them so they can be fixed. Sometimes they act during a live attack. The Security Alliance's Whitehat Safe Harbor Agreement, which protocols adopt in advance, sets rules for whitehats to rescue funds during an active exploit and send them to a named recovery address. It bans starting exploits and requires all recovered funds to be returned. Uniswap's governance adopted it in January 2025, joining projects such as Balancer and Polymarket.

The flaws that bounties try to catch are covered in how crypto gets hacked. A bounty lowers risk but cannot guarantee code is safe.