Crypto’s Bug Bounty Platform Wars: Pools vs Payouts

On 12 October the XRP Ledger Foundation confirmed it had paid $250,000 to two researchers for a flaw that could have minted 18 trillion XRP from nothing, roughly 184 times the token’s total supply, in a single transaction. The bug was an integer overflow that had lived in the payment engine since 2015: the ledger paid each order owner their full amount while charging the buyer only a wrapped-around total, and the difference was fresh XRP that was never supposed to exist. By any technical measure it was one of the most dangerous vulnerabilities ever quietly handed to a major chain instead of being drained from it. One of the finders was not even human; the report is credited to a researcher named Cayden Liao and an automated system called Veria AI, and it reached the program on 22 September. You can read the sequence in Protos’s account of the disclosure.

The reward was not the story. The reaction was. Within hours the on-chain investigator ZachXBT called the $250,000 cheap, pointed out that the organizations behind the ledger sit on billions of dollars in treasury, and warned that the next person to find a bug of this class might simply use it. “This is why people do not take XRPL or Ripple seriously as an org,” he wrote, in comments picked up by Bitcoin.com News. His point was not really about Ripple. It was about incentives: a program that underpays on a catastrophic find teaches every researcher watching exactly what their next catastrophic find is worth, and whether it might be worth more somewhere else.

Three weeks earlier, Mitchell Amador, the chief executive of Immunefi, the largest bug bounty platform in crypto, had made a blunter version of the same argument. “Bounty pools are marketing, payouts are security,” he wrote in a public teardown of rival platforms. For a whitehat in 2026 the question is no longer only how much is my bug worth. It is where do I take it, because the venue increasingly decides whether the number on the landing page ever becomes a number in a wallet. This is the bug bounty platform war, and it is being fought in the gap between the sticker and the receipt.

A $250,000 Receipt for a Trillion-Dollar Bug

Start with the XRPL case, because it contains the whole argument in miniature. The ledger runs its own vulnerability program rather than outsourcing to a marketplace, which means it sets its own ceiling, its own severity scale, and its own payout. There is no published maximum of the kind Immunefi or Sherlock advertise, so when the Foundation decided a bug capable of counterfeiting the entire money supply was worth $250,000, that figure was not benchmarked against a public pool. It was a judgment call, and the market judged it right back.

The problem ZachXBT flagged is the one that haunts every underpriced payout. A rational attacker compares the bounty to the alternative. For a flaw that could mint 184 times the supply, the alternative is theoretically unbounded, and a $250,000 reward is a rounding error against it. The whitehats who reported it did the honest thing; the worry is about the next person, who now has a data point. As ZachXBT put it, underpaying a find like this could eventually cost the chain nine figures. That is not a moral claim. It is a pricing claim, and it is the same claim a whitehat known only as Riptide made about Arbitrum back in 2022, which we will come to.

The detail that a machine co-discovered the bug matters too. Automated vulnerability research is now good enough to surface a decade-old overflow in one of the most scrutinized codebases in crypto, which cuts both ways. It lowers the cost of finding bugs for defenders and attackers alike, and it floods programs with low-quality submissions. Both halves of that story are reshaping where the money goes, and both run straight into the platform question.

Pools Are Marketing, Payouts Are Security

Amador’s essay was unusual for a chief executive: a named, numbered attack on competitors, published under his own byline. The thesis is simple. The pool a platform advertises, the big number on the program page, is a marketing asset. The money that actually reaches researchers is the only honest measure of whether the platform works. “Payouts are the honest measure of what reaches security researchers,” he wrote, and “when a platform advertises large pools but pays almost nothing year after year, the problem cannot be the bug bounty model, it must be the platform hosting it.”

Then he put numbers to it. By his accounting Immunefi has paid out $137 million across 174 live programs to more than 85,000 registered researchers, including 29 separate payments of $1 million or more. Against that he set his rivals. Cantina, he claimed, “lists 59% of Immunefi’s bounty pool and has paid 1.9% of what Immunefi has paid.” HackenProof, he said, “has paid 1.8x its live bounty pool,” a backhanded way of saying its advertised pool is small relative to what it has delivered. Sherlock, he noted pointedly, “does not publish any information on aggregate payouts.” And Code4rena, once the leading competitive-audit venue, now has “no live bounties, having shifted them to Immunefi.”

It is worth being clear about the obvious. This is the man who runs the platform that pays the most telling you to rank platforms by how much they pay. The conflict of interest is total. But a self-serving argument can still be a correct one, and the core observation, that advertised pools and realized payouts can diverge by two orders of magnitude, is simply true. The interesting questions are why they diverge, and what a researcher should do about it.

Why the Venue Decides the Payout

A bug is not a fixed-price commodity. The same critical vulnerability, submitted to two different programs on two different platforms, can be worth wildly different sums, and can face wildly different odds of being paid at all. Several things drive the spread. Each program writes its own scope and its own sizing rule, so one values a critical at a flat tier while another promises a percentage of the funds at risk. Triage quality differs, so one platform’s reviewers confirm a report in days while another argues severity for weeks. Payout speed and asset differ, so one program wires stablecoins and another hands over a locked native token. And every program carries a reputation, earned or not, for honoring the number it advertised.

The canonical cautionary tale is Arbitrum. In September 2022 a whitehat going by Riptide found a flaw in the Nitro sequencer that put roughly $470 million of bridge deposits at risk. Arbitrum’s advertised maximum was $2 million. It paid 400 ETH, worth around $540,000 at the time, as CryptoPotato reported. Riptide’s public response became a slogan for the whole reward side: “If you post a $2mm bounty, be prepared to pay it when it’s justified. Otherwise just say the max bounty is 400 ETH and be done with it.” And the warning that still gets quoted: “Hackers watch which projects pay out and which do not.”

That sentence is the entire market in seven words. Researchers route their best work toward programs with a track record of paying, and away from those with a history of haggling, exactly as traders route order flow toward the venue with the best fill. The bounty platforms are, in that sense, competing exchanges, and the thing they compete for is the attention of a small number of elite finders. Bounties and audits are complementary layers of the same defense, which is why the audit industry’s own repositioning, covered in our look at CertiK’s pivot to a trust layer, maps so closely onto what is happening to bounties: both are being judged less on marketing and more on delivered outcomes.

Immunefi, the Incumbent

Immunefi’s dominance is not a marketing claim; it is a structural fact. In a February research post the platform argued that roughly 92.33% of all post-launch critical vulnerabilities in crypto are disclosed through it, a figure it built from 7,695 confirmed reports and 1,143 confirmed criticals scoped to blockchain and smart-contract code, at a critical rate near 14.9% of valid submissions. You can read the methodology on Immunefi’s blog, keeping in mind that it is the platform grading its own share. By its telling it sits 381 times ahead of HackerOne and 87.9 times ahead of Cantina on critical disclosures, and protects more than $180 billion in user funds.

The flow backs the stock. In the first half of 2026 Immunefi paid $13.45 million across 837 valid bugs even as a record 207 incidents drained about $972 million from the industry, per The Block’s summary of its half-year report. The model is the continuous bounty: a program stays open indefinitely, criticals are typically sized as a percentage of the funds a bug put at risk, and the platform takes a performance fee on top of each payout. To fight the submission flood it leans on dedicated triage teams and stake-to-submit mechanics, where filing a report requires putting up a deposit that is forfeited for spam.

There is a quieter story inside the 92% figure. A single venue coordinating more than nine in ten critical disclosures is efficient, but it is also a concentration. It means one company’s triage standards, one company’s severity scale, and one company’s relationships with protocols increasingly define what a bug is worth across the entire market. Amador can credibly argue that payouts are what matter precisely because his platform is the one that pays; the same dominance that makes the argument persuasive is the thing that should make the market a little nervous about having one scorekeeper.

Sherlock and the Coverage Bet

Sherlock competes on a different model. Rather than selling a standalone bounty, it stitches together the whole lifecycle: collaborative audits and an AI-assisted review engine during development, competitive audit contests at launch, and continuous bounties on live code afterward. Its own site claims it has secured more than $250 billion in TVL, uncovered over 2,000 critical vulnerabilities, and run more than 1,500 reviews with over 11,000 researchers. The distinctive piece is coverage: Sherlock has historically paired its programs with a financial backstop that pays out if a covered vulnerability slips through, turning a missed bug into something closer to an insurance claim than a pure loss.

Sherlock also hosts the single largest number in the business. Usual’s program, announced in April 2025, carries a $16 million ceiling, which The Block called the largest bug bounty in tech history, ahead of Uniswap v4 at $15.5 million and LayerZero at $15 million. It is sized on the same ten-percent-of-at-risk logic, capped at $16 million against roughly $100 million of exposure, and it sits on top of a codebase that had already been through some twenty audits. No public critical payout has been reported against it, which is rather the point: a ceiling that large exists to signal confidence and attract elite eyes, not because anyone expects to write the check.

Sherlock’s co-founder Jack Sanford has framed the whole model around one idea, that a one-time review cannot carry a protocol forever. “Point-in-time audits are indispensable, but they were never meant to carry the entire burden of security,” he told Crypto Briefing. The weakness Amador zeroed in on is transparency. Sherlock publishes vulnerabilities found and pool sizes, but not aggregate dollars paid, which makes it impossible for an outsider to run the payouts-are-security test on it. On a coverage model that opacity is partly structural, since a missed-bug claim is not the same line item as a bounty, but it still leaves researchers guessing.

Cantina, the Contest House

Cantina, built by the team behind the elite auditor collective Spearbit, runs two products at once: large public audit competitions, with prize pools that run from a couple hundred thousand dollars to well over a million, and an ongoing bounty marketplace for live code. Its flagship bounties are among the richest anywhere. Its own opportunities page lists Uniswap at $15.5 million, Reserve Protocol at $10 million, Euler at $7.5 million, Polymarket and Coinbase at $5 million each (Coinbase’s being the largest from a centralized exchange), and Morpho at $2.5 million. The same page reports $65.3 million in available payouts, $56 million paid out historically, 7,902 vulnerabilities found, and more than 24,000 researchers.

Hold that $56 million next to Amador’s claim that Cantina has paid $2.6 million. Both numbers are real, and the gap between them is the entire pools-versus-payouts fight compressed into one line. Cantina’s figure counts everything it has disbursed, with the audit competitions doing most of the lifting. Amador’s figure counts only continuous bug bounties, the narrow category where Immunefi is strongest. Neither party is lying; they are measuring different things, and each has chosen the measurement that flatters it. The lesson for a researcher is that aggregate payout stats are nearly useless without knowing what they include, and that a platform heavy on competitions pays very differently from one heavy on bounties.

That difference is practical, not academic. A competition pays out a fixed pool, split among everyone who placed, on a deadline; it rewards breadth and speed. A continuous bounty pays a single finder whenever a qualifying bug appears, sometimes years later; it rewards patience and depth. The same researcher might earn a few thousand dollars placing in a Cantina contest and a six-figure bounty on an Immunefi program for comparable effort, or the reverse, depending entirely on timing and luck. Choosing the venue is choosing the payout structure, before a single line of code has been read.

The Platforms That Shrank or Vanished

The platform war has casualties. The most significant is Code4rena, the venue that popularized the competitive-audit model, where independent researchers called wardens raced to find bugs for a share of a pot. In May 2026 it announced it was winding down, and Immunefi stepped in to absorb its bounty clients and invite its wardens over, promising to migrate scopes, rules, and reward structures, as The Block reported. The twist is that Code4rena had been acquired by the security firm Zellic only in 2024, so even a well-capitalized buyer could not keep it alive two years later. Consolidation is not a side effect of this market; it is the market.

The Web2 giants, HackerOne and Bugcrowd, remain enormous in traditional software but thin in crypto, where a handful of exchanges run programs (Crypto.com’s $2 million is the notable one) while protocol-level work flows to the specialists. HackenProof occupies a crypto-native middle tier that Amador grudgingly credited with paying out more than its advertised pool. The pattern across all of them echoes the one reshaping the audit business, where S&P Global’s acquisition of OpenZeppelin signaled that security services are being rolled up by larger balance sheets. Fewer independent venues means less room for arbitrage, and more pressure on the survivors to differentiate on model rather than on the size of the number they print.

The 2026 Platform Map

The landscape, as of mid-October 2026, sorts into a handful of venues with sharply different shapes. The figures below mix self-reported platform data with Amador’s competitive accounting and third-party roundups, so treat the payout columns as directional rather than audited; the entire point of this article is that these numbers are contested.

Two things jump out of the table. First, the ceilings cluster tightly at the top, between $15 million and $16 million, because above a certain point the number is pure signaling and everyone has converged on the same signal. Second, the payout columns are either large, tiny, or blank, and the blanks are doing a lot of work. A platform that will not publish what it pays is making a choice, and in a market where Riptide’s rule holds, that choice is itself information.

The Ceiling Is Not the Check

The gap between advertised ceilings and realized payouts is not an edge case; it is the normal condition of the market. The total advertised bounty market crossed $162 million in available rewards by late August, according to Sherlock’s roundup of the highest-paying programs. Yet Immunefi’s own research across 593 long-running programs found a median critical payout of just $20,000 and a mean of $114,355. A market with $16 million ceilings and a $20,000 median critical is not a contradiction. It is working exactly as designed, with a few giant numbers out front and a long tail of ordinary ones behind.

The individual receipts tell the story better than the averages. The table below lines up famous ceilings against what was actually paid, and the pattern is that the receipt depends far more on the program’s conduct than on the sticker.

Wormhole remains the proof that the model can work: a $10 million ceiling that paid $10 million to the researcher known as satya0x in 2022, still the largest single bounty in crypto history. Optimism paid its advertised $2,000,042 in full to the researcher saurik. Arbitrum did not pay its ceiling, and the XRP Ledger, by its critics’ lights, did not either. The receipts, not the stickers, are what the next researcher studies.

How a Researcher Actually Chooses

Given all of this, a professional whitehat does not pick a target and hope. They run an expected-value calculation before committing time, and the sticker price is only one input. The sizing rule matters enormously: a flat $10,000 critical tier is a different proposition from a percent-of-at-risk program, which is different again from Kamino’s unusual structure on Solana, which sets a six-figure floor under any critical. The payout asset and speed matter too: stablecoins wired in days beat a native token locked on a twelve-month vesting schedule, especially when that token can fall by more than half before it unlocks.

Then come the frictions. Many programs now charge stake-to-submit, a non-refundable deposit to file a report; Solana’s Alpenglow consensus bounty, for instance, required a small non-refundable deposit per submission to throttle spam. Exclusivity and dual-submission rules determine whether the same bug can be taken elsewhere if the program lowballs it. And increasingly the deciding factor is legal cover, whether the program has adopted standardized safe-harbor terms that promise not to sue a good-faith researcher. The table below sketches the real decision.

The AI Repricing

The thing quietly rewriting every platform’s economics in 2026 is the flood of machine-generated reports. The same capability that let an AI help find the XRPL overflow also lets anyone with a chatbot generate plausible-looking vulnerability writeups by the thousand, and triage teams are drowning. The clearest signal came from outside crypto. In January the maintainer of curl, Daniel Stenberg, shut his project’s long-running bug bounty after the share of valid reports collapsed, writing that the goal was to remove the incentive for meaningless submissions, as he explained on his blog.

The platforms are repricing in response, and the direction is a two-tier split. In July GitHub cut its public payouts and introduced a permanent invite-only tier, with public rewards dropping to $250, $2,000, $5,000, and $10,000 across severity levels while vetted researchers get $1,000, $7,500, $20,000, and $30,000 or more, as The Hacker News documented. Google stopped accepting AI-written reports; Bugcrowd coined the term sloptimism for the phenomenon. Crypto platforms fight it with stake-to-submit and heavier triage.

The effect on arbitrage is direct. As public lanes get noisier and cheaper, elite researchers concentrate in invite-only and high-trust programs where their time is protected, which pulls the best findings toward the platforms that can offer those lanes. That reinforces Immunefi’s gravity and raises the bar for everyone else: a venue that cannot both filter the slop and guarantee the elite a clean, well-paid lane will struggle to keep the researchers who actually find the nine-figure bugs. The AI flood, in other words, is accelerating the same consolidation the Code4rena shutdown already showed.

What No Platform Can Price

For all the sophistication, there are losses no bounty platform can touch, and they are a growing share of the damage. The first category is operational compromise rather than code. In early October an attacker used a Safe multisignature wallet to whitelist a malicious contract on a Base vault and walked off with about 1,783 wstETH, roughly $6 million, from a vault holding around $31.7 million. Immunefi’s head of security Gonçalo Magalhães noted that the vault’s operators were anonymous, with seven unidentified signers, so a researcher who spotted the flaw had no safe way to report it. “A bug bounty could definitely have stopped this attack,” he told crypto.news, but only if a program had existed to receive the report. When the failure is a leaked key or a careless whitelist, not a logic bug, no amount of bounty pool helps; those cases belong to operational security, the world of hardware wallets and key custody.

The second category is the sanctioned attacker. When North Korea’s Lazarus Group drained $1.5 billion from Bybit in February 2025, the largest crypto theft on record and attributed by the FBI to Pyongyang, no bounty could lawfully be paid, because paying a sanctioned thief is a crime; Bybit instead paid third-party trackers to trace and freeze funds. The third is the ransom dressed up as a bounty. In September an attacker took roughly $319 million in Bitcoin from the Liquid Network and returned about 85% of it, as TRM Labs recounted, while demanding a 10% cut to send back the rest. Blockstream refused outright, saying it would not pay for the return of stolen property, per The Block. The line between a recovery bounty and extortion is who set the terms, and it is getting blurrier.

This is where the Security Alliance’s Safe Harbor framework comes in, the standardized terms that preauthorize a whitehat to intervene during a live exploit and keep a 10% bounty capped at $1 million, now adopted by dozens of protocols protecting tens of billions in value, documented at securityalliance.org. The cap is also its flaw: 10% capped at $1 million is one-half of one percent on a $200 million rescue, so the framework is weakest exactly where the money is largest. September 2026 was the worst month of the year, with CertiK tallying $766.4 million in losses, a reminder that the defensive layer is not keeping pace with the offense.

What Comes Next

Three forces will shape the platform war from here. Consolidation will continue, with Immunefi’s disclosure share and the Code4rena absorption pointing toward a market with one dominant venue and a few differentiated challengers rather than a crowded field. Models will keep diverging, with Sherlock betting on coverage and lifecycle, Cantina on competitions, and Immunefi on continuous bounties at scale, so the researcher’s venue choice becomes a choice of payout structure. And institutional money, the Coinbase and Reserve programs at $5 million and $10 million, will keep lifting the floor even while the ceilings stay pinned around $16 million.

The legal overhang will matter more, not less. A formal program with safe-harbor terms is increasingly a legal instrument as much as a payments rail, because the difference between a researcher who gets paid and one who gets prosecuted can come down to whether the venue promised not to sue. The United States posture here is still unsettled, with the SEC’s approach shifting from enforcement-by-lawsuit toward rulemaking, a change we traced in our piece on SEC crypto enforcement in 2026, while sanctions law continues to make paying certain attackers impossible no matter how the bounty is framed. Those cross-currents, mapped in our rundown of Washington’s next ninety days, will decide how much room platforms have to protect the people who report bugs.

The XRPL episode is the tell for where all of this is heading. A $250,000 check on a bug that threatened a nine-figure chain was, by the standards Amador laid out, a payout problem dressed up as a generous gesture, and the market said so within the hour. The pools-versus-payouts fight will not be settled by anyone’s definition of a payout. It will be settled, program by program, by which venues researchers trust to turn the sticker into a receipt, because the ones that do not will find out what Riptide warned in 2022: the hackers are watching, and they keep score.

Frequently Asked Questions

Which platform pays the most in crypto bug bounties?

By its own accounting Immunefi has paid the most, about $137 million lifetime across 174 live programs, including 29 individual payments of $1 million or more. It also facilitated the record single bounty, $10 million to the researcher satya0x for a Wormhole vulnerability in 2022. Rivals such as Cantina advertise comparable or larger ceilings, but report far less in continuous bounty payouts.

What was the XRP Ledger $250,000 bug bounty?

In October 2026 the XRP Ledger Foundation paid $250,000 to researchers who found an integer overflow, present since 2015, that could have minted around 18 trillion XRP in a single transaction, roughly 184 times the token’s supply. The investigator ZachXBT publicly called the reward cheap given the ledger’s treasury, arguing that underpaying catastrophic finds pushes future researchers toward exploiting bugs rather than reporting them.

Why do advertised bounty pools differ from actual payouts?

A pool is the maximum a program advertises; a payout is what a researcher actually receives. They diverge because big ceilings are mostly a signaling and marketing tool, because many programs size real payouts as a small percentage of the funds at risk, and because platforms count different things as a payout. Immunefi’s chief executive summarized the view as pools being marketing and payouts being security.

Is Immunefi better than Sherlock or Cantina?

They are built for different jobs. Immunefi runs the largest continuous-bounty marketplace and discloses the most criticals. Sherlock bundles audits, contests, and a coverage backstop that can pay if a bug is missed. Cantina, from the Spearbit team, is strongest on public audit competitions alongside bounties. A researcher’s best venue depends on their specialty, their tolerance for locked-token payouts, and each program’s record of actually paying.

Can a researcher get in legal trouble for reporting a crypto bug?

Yes, which is why the venue matters. Reporting to an anonymous team with no formal program, as in the October Base vault case, can expose a good-faith researcher to legal risk under computer-fraud statutes. Standardized safe-harbor terms, such as those from the Security Alliance, preauthorize intervention and promise not to sue, while sanctions law can make paying certain attackers illegal regardless of intent.

Anneke de Vries covers security and exploits for HOGE Wire.