Apple Calls $2M a Record. Crypto Paid $10M in 2022.

In October 2025, Apple used the Hexacon security conference to announce that it had doubled the top award in its Security Bounty program to $2 million, with stacked bonuses that can push a single payout past $5 million. The company called it “an unprecedented amount in the industry and the largest payout offered by any bounty program we’re aware of.”

The claim is not true, and crypto is the reason it is not true. A researcher known as satya0x was paid $10 million for a single vulnerability in February 2022, more than three years before Apple reached for the word record. The money came from Wormhole, a cross-chain bridge, and it moved through Immunefi, the largest bug bounty platform in crypto. By 2026 the standing ceiling on one crypto bug is not $5 million but $16 million, posted by the stablecoin issuer Usual on Sherlock, which calls it the largest bug bounty in tech history. Apple’s new high-water mark would not crack the top ten paying programs in Web3.

That gap is not an accident and it is not generosity. It is a price. Big Tech and crypto are paying for two different things, and the distance between $200,000 and $16 million is the cleanest number in security economics for showing what a software bug is worth when the software holds money.

How Big Tech prices a bug

Every large technology company runs its bounty on a severity grid. A report is triaged into a band, usually low, medium, high and critical, and each band maps to a fixed dollar range. The ranges move with the asset, so a remote code execution in a flagship product pays more than a scripting flaw on a marketing page, but the structure is the same everywhere: the payout tracks how bad the bug is for the company, not how much cash it hands an attacker.

The absolute numbers are smaller than crypto outsiders expect. Google paid nearly $12 million to more than 600 researchers across all of its reward programs in 2024, and its single biggest reward that year was $100,115, awarded for a bypass of a Chrome security defense. Its published ceilings sit near $151,515 for the general program, $250,000 for Chrome and $300,000 for top-tier mobile targets. Microsoft paid a record of more than $20 million to 562 researchers in its biggest year yet, and the largest single award in the program’s history is $200,000. HackerOne, the platform that hosts thousands of corporate programs, paid out $81 million across every program it runs between mid-2024 and mid-2025, which works out to roughly $42,000 per program per year. Apple, for its part, has paid about $35 million to more than 800 researchers since the program opened in 2020.

These are the numbers of a mature, rational market. A bug in a browser or an operating system is worth real money because a breach costs the company reputation, user trust and regulatory attention. But a browser flaw is one link in a chain. An attacker still has to build the rest of the exploit, deliver it and find something worth stealing on the far side, and the vendor can revoke the whole thing with a patch the following Tuesday. Big Tech is pricing the cost of embarrassment and cleanup, discounted by how hard the bug is to turn into money. That discount is enormous, and it is why even Apple’s new flagship tops out in the low millions.

How crypto prices a bug

Crypto throws the severity grid out and prices on a single variable: the money the bug could move. The industry calls it primacy of impact. A critical vulnerability is one that lets an attacker take or freeze user funds, and the reward is set as a share of those funds, almost always capped at a headline ceiling. Ten percent of the value at risk is the rough norm, so a protocol holding $160 million behind one function will advertise a $16 million top prize.

That is close to what Usual did, and it is why the Web3 bug bounty market now exceeds $162 million in advertised rewards across hundreds of programs. The leaderboard looks like no corporate program on earth.

Seven of these programs advertise a single-bug ceiling at or above the $5 million maximum Apple called a record. Four sit at or above $10 million. The entry fee to the top tier of crypto security is roughly the exit ceiling of the most generous program in consumer technology.

The two price lists, side by side

Put the two worlds in one table and the mismatch stops looking like a rounding error and starts looking like a category difference. The middle column is what each program says a top bug can earn; the right column is the largest sum actually known to have been paid.

The best-documented crypto payout, Wormhole’s $10 million, is 50 times Microsoft’s largest award ever and roughly 100 times Google’s biggest reward of 2024. The difference is not that crypto researchers are better paid for the same work. It is that the work protects a fundamentally different kind of target.

What $10 million bought

The Wormhole payout is worth sitting with, because it explains the entire price list. In February 2022 an attacker exploited a signature-verification flaw on Wormhole and minted about 120,000 wrapped ether out of nothing, a theft worth roughly $323 million, which the trading firm Jump Crypto covered to keep the bridge solvent. Separately, the researcher satya0x found a second, unrelated path into the same system, a weakness in the machinery used to upgrade the bridge’s contracts that could have handed an attacker control of them outright. Wormhole paid $10 million for that disclosure, and no funds were lost on the find itself.

The number was deliberate. Immunefi, which brokered the payout, framed it at the time as a signal to the wider field: that the best researchers in the world would be well taken care of if they chose disclosure over exploitation. A protocol that had just watched $323 million walk out the door understood exactly what the alternative was worth, and it priced the bounty against that, not against what a browser vendor would have paid for a comparable flaw. Every eight-figure ceiling that followed inherited the same logic.

Bridges are the reason the numbers are this large. They are the single richest honeypot in crypto, pools of locked collateral that back assets on another chain, and one logic error in the locking contract can release all of it at once. There is no account to freeze and no fraud desk to call. When the sum a bug can set loose is measured in hundreds of millions, a $10 million bounty is not extravagant. It is a discount on the alternative.

A bug that is also a withdrawal

The structural reason crypto pays more comes down to three properties a browser bug does not have. A smart-contract exploit is direct, liquid and irreversible, and each of those words adds a zero.

Direct means the bug and the theft are the same action. There is no second step. Where an attacker with a browser exploit still has to find a target, trick a victim and move laterally, an attacker with a reentrancy bug in a lending contract simply calls the function and the money leaves in the same transaction. Liquid means what comes out is already money. A drained protocol gives up ether, stablecoins or a blue-chip token that trades on every exchange, with no stolen database to fence and no credentials to launder first. Irreversible means it is final: once the transaction confirms, usually within seconds, there is no chargeback, no issuing bank and no central authority with a delete button. The same property that makes self-custody attractive makes theft permanent, whether a key leaks through a SIM-swap or a tampered hardware wallet.

Stack the three together and a critical smart-contract bug is worth its full face value to a thief, immediately and with near certainty. That is the number a bounty has to beat. Apple competes with a gray market of spyware brokers who need months to weaponize a chain and risk a patch at any moment. Crypto competes with a withdrawal that clears before breakfast.

The $20,000 median behind the headline

The ceilings are real, but they are not what most researchers take home, and an honest comparison has to separate the sticker from the receipt. Immunefi studied 593 of its programs from January 2021 through February 2026 and found a median critical payout of $20,000 and a mean of $114,355, out of $107.3 million in critical awards all time. Most confirmed critical bugs do not threaten a nine-figure vault, so most payouts land well below the advertised cap.

That sounds like it should close the gap with Big Tech. It does not. The point that survives is the comparison of like with like: crypto’s average critical payout of $114,355 is larger than the single biggest reward Google handed out in all of 2024, and its median critical of $20,000 sits in the same range as a typical high-severity corporate payout for a bug that merely embarrasses a company rather than draining it. The whole distribution is shifted up, not only the top of it. In the first half of 2026, Immunefi paid out $13.45 million across 837 valid reports, and its cumulative payouts to researchers have passed $134 million.

Why crypto has to pay the face value

There is a harder reason the ceilings are high, and it has nothing to do with gratitude. In crypto the same person who reports a bug could, with the same keystrokes, take the money instead. The bounty is not competing with a researcher’s conscience alone; it is competing with the exploit’s full value, and both sides know it.

The clearest statement of that math came from a whitehat called Riptide, who in 2022 found a bug in Arbitrum’s Nitro sequencer that put roughly $470 million at risk. Arbitrum advertised a $2 million maximum and paid 400 ether, about $560,000. Riptide’s objection was not really about the money, it was about the signal: “if you post a $2mm bounty, be prepared to pay it when it’s justified. Otherwise just say the max bounty is 400 ETH and be done with it.” Then came the line every protocol treasury should keep taped to the wall: “Hackers watch which projects pay out and which do not. IMO not a good idea to incentivize a whitehat to go blackhat.”

That is the whole argument for paying crypto numbers. A program that underpays is not merely stingy; it is lowering the price at which honesty stops being the rational choice. The ambiguity runs deep enough that some exploits are not clearly crimes at all, as the long argument over whether draining a mispriced market counts as theft or as aggressive trading has shown, a question that keeps resurfacing in cases of oracle and economic manipulation where the code did exactly what it was told to do. When the line between bounty and ransom is that thin, the bounty has to be large enough to stay on the right side of it.

Paid in tokens, taxed at the peak

Here the advantage swings back toward Big Tech, and it is the part of the comparison the crypto headlines leave out. Apple and Microsoft pay dollars into a bank account. Many crypto programs pay in their own token, and some lock it. The Solana Foundation pays its critical bounties, worth up to $2 million, in SOL locked for twelve months. Anza’s bounty for the Alpenglow consensus upgrade put as much as 50,000 SOL on the table, locked for a year, and charged researchers half a SOL per report just to submit.

A locked token is a bet, not a paycheck. The researcher carries a year of price risk on an asset that, if the project stumbles, can fall faster than almost anything in the dollar economy; Immunefi’s own data shows hacked tokens drop a median of 61 percent over the following six months. The sticker says $2 million; the receipt depends on where the token trades when the lockup ends.

Tax makes it sharper. In the United States a bug bounty is ordinary income, reported on a 1099-NEC and taxed as self-employment earnings at the fair market value on the day it is received. A researcher paid in a token at its peak can owe tax on a figure far above what the tokens are worth by the time they vest, and no agency refunds the difference. That is why programs paying in stablecoins or dollars are quietly preferred, and why the wider fight over who keeps the value of a dollar-denominated token matters more to a working researcher than another zero on the ceiling.

The regulator Apple never has to call

A bounty paid by Apple raises no questions beyond payroll. A bounty paid by a crypto protocol can touch three US agencies before the money moves, and that overhang is part of why realized payouts sometimes trail the headline.

The first is the Securities and Exchange Commission. If a bounty is paid in a token the SEC might treat as a security, the payment itself sits inside an unresolved question about registration and distribution, and the agency’s shifting posture on which tokens are securities shadows every token-denominated program. The second is the Justice Department. Exploiting live code, even to rescue funds, can look like unauthorized access under the Computer Fraud and Abuse Act; the Justice Department said in 2022 that it would not charge good-faith security research, but pulling money out of a running contract to prove a point lives in a gray zone that good faith does not fully clear. The third is the Treasury’s Office of Foreign Assets Control. A protocol cannot lawfully pay a sanctioned attacker, so when a theft traces to a state actor, as the largest exchange hack of 2025 did, the bounty model simply breaks: you cannot buy the money back from North Korea.

None of this touches a browser bug. Apple writes a check and moves on. A crypto treasury has to ask whether the payment is a securities distribution, whether the researcher’s method was lawful access and whether the counterparty is on a sanctions list, and any one of those can shrink or stop the payout the ceiling advertised.

Record thefts are why the ceilings keep rising

The ceilings climb because the thefts climb. September 2026 was the worst single month of the year, with about $768 million lost across dozens of incidents by CertiK’s count, driven by a roughly $388 million theft from the exchange Bitget and a $320 million exploit of the Liquid Network, of which more than $270 million was later returned. CertiK’s running total for the year passed $2.68 billion. Immunefi recorded $972 million stolen across a record 207 incidents in the first half of 2026 alone.

Against that backdrop the economics of a bounty are not close. Immunefi’s research puts the average direct theft from a critical exploit at $24.5 million, against a median critical bounty of $20,000. A protocol that spends the price of a used car to avoid a loss the size of a funding round is not being generous; it is buying the cheapest insurance in technology. Immunefi’s chief executive, Mitchell Amador, has framed the year in the company’s reporting as a reminder that crypto security is adversarial and never stops evolving, and that the honest read on the numbers is that the industry is still learning. The ceilings are what learning costs.

An audit is not a bounty, and a bounty is not insurance

The size of a crypto bounty also reflects how little else there is to fall back on. A consumer-software company ships behind layers: code review, a QA team, staged rollouts, telemetry that flags an exploit in progress, and the ultimate backstop of a patch pushed to every device overnight. A smart contract has none of that once it is deployed. The code is the product, it is public, it is immutable in most cases, and it is holding the money from the first block. A bug that slips past the audit has no second gate before it reaches an attacker.

That is why the industry has stopped treating the pre-launch audit as the finish line. Jack Sanford, who co-founded Sherlock, puts the limit plainly: “Point-in-time audits are indispensable, but they were never meant to carry the entire burden of security.” An audit is a snapshot of a codebase on one date; the protocol keeps shipping, integrating and accruing value after it. The continuous bounty is the layer that stays live after the auditors leave, and the ceiling has to be high because it is often the last line, not the first.

Even calling it insurance oversells it. A bounty pays a researcher who chooses to come forward; it does nothing if the finder decides to drain the contract instead, and it returns nothing to users once funds are gone. It buys a probability, not a guarantee, that the next person to find the bug will prefer the reward to the exploit. Framed that way, the $16 million ceiling is not a lavish prize. It is the price of raising that probability on a system where every other safety net has been removed by design.

The platforms in the middle

The two markets barely share a middleman. Big Tech runs its programs through HackerOne and Bugcrowd, platforms built for a world where a report is triaged, a severity is agreed and a wire transfer follows weeks later. Crypto grew its own rails because that workflow does not fit an asset that can vanish in one transaction, and the companies that dominate it, Immunefi, Sherlock and Cantina, are names most corporate security teams have never dealt with.

The differences are not cosmetic. Severity on a crypto platform is scored by primacy of impact, the dollars a bug can move, rather than by a generic low-to-critical label. Payment settles on-chain, often in the protocol’s own token, sometimes from a vault the program has to prove is funded before a researcher will even engage. To hold back the flood of low-effort submissions, Immunefi and Sherlock ask researchers to post a small stake that is forfeited for a junk report, a mechanism no Big Tech program uses. And the largest prizes increasingly route through invite-only tiers, so the advertised ceiling and the pool most researchers can actually reach are not the same number.

The split matters for the comparison because it explains why the numbers never converged. HackerOne can pay $81 million across thousands of programs and still cap most criticals in the thousands, because its clients are pricing reputational risk on patchable systems. Immunefi has routed more than $110 million to researchers while advertising single bugs at eight figures, because its clients are pricing the direct, liquid, irreversible loss a single function can cause. Same job title, two different economies, and the gap between them is the clearest measure of what putting money directly on-chain actually costs.

2026: both industries get repriced by AI slop

For all the distance between a $200,000 Microsoft award and a $16 million Usual ceiling, the two worlds have started to converge on one problem at the same time. Large language models have made it almost free to generate a plausible-looking vulnerability report, while disproving one still costs a human engineer real hours. The inbox fills with confident, well-formatted nonsense, and triage, not discovery, becomes the bottleneck.

The response has been the same move almost everywhere: split the program in two. The maintainers of curl shut their bounty entirely in January 2026. Its creator, Daniel Stenberg, said the goal was to “remove the incentive for people to submit crap and non-well researched reports to us,” adding that the torrent of submissions had put a heavy load on the security team and that ending payment was an attempt to reduce the noise. Six months later GitHub cut its public payouts and moved the real money to an invite-only tier, becoming the fourth major program to restructure in 2026, after Google, Bugcrowd and HackerOne’s Internet Bug Bounty.

Crypto arrived at the same design from the other direction. Immunefi and Sherlock use stake-to-submit deposits, small refundable bonds a researcher forfeits for a junk report, and both run invite-only elite tiers where the largest programs route their hardest work to a vetted few. Whether the gate is a $30,000 VIP band or a leaderboard of some 160 trusted researchers, the shape is identical: a narrow lane for the proven, a filtered one for the crowd. The same surge in AI-generated submissions that pushed curl and GitHub to act is the other half of the irony. The machine that floods the inbox is also the machine writing the next generation of vulnerable code.

What the gap actually measures

So Apple is wrong, but not for a trivial reason. When the company calls $5 million the largest payout in the industry, it is measuring the cost of a bug to a business that can patch, revoke and apologize. Crypto’s $16 million is measuring something else: ten percent of a vault that a single transaction can empty, with no patch window, no clawback and no bank on the other end. The two numbers are not on the same scale because they are not pricing the same risk.

For researchers, the comparison cuts both ways. The ceilings are genuinely higher, and the average crypto critical already beats Big Tech’s best single year, but the median is $20,000, the money often arrives as a locked token, and the tax bill can land at the token’s peak rather than its floor. For protocols, the logic is simpler than it looks: a bounty is the cheapest line in a budget whose alternative is a nine-figure hole and a token that never recovers.

The honest headline is not that crypto is generous. It is that crypto has built the first security market where the reward tracks the money at stake directly, because in crypto the bug is the money. Big Tech pays for embarrassment. Crypto pays for finality. And the one place the two are finally meeting is the least glamorous of all: both now spend more and more of their time deciding which reports a machine wrote before deciding what to pay for the ones a human did.

Frequently Asked Questions

Why do crypto bug bounties pay so much more than Apple or Google?

Because a crypto exploit is the theft itself. The bug and the withdrawal are the same transaction, the stolen funds are already liquid, and the transfer is irreversible, so the bounty has to compete with the full value a thief could take in one block. Big Tech bounties price reputational and operational damage on systems that can be patched, so their ceilings sit far lower.

What is the largest bug bounty ever paid in crypto?

The largest single payout on record is $10 million, paid to a researcher known as satya0x by the Wormhole bridge in February 2022 through Immunefi. The highest advertised ceiling in 2026 is $16 million, posted by the stablecoin issuer Usual on Sherlock, which is the largest bug bounty in the technology industry.

If the ceilings are $16 million, why do most researchers earn far less?

Because the payout is sized to the funds a bug could move, and most confirmed bugs do not threaten a nine-figure vault. Across 593 programs, Immunefi reports a median critical payout of $20,000 and a mean of $114,355. The multimillion-dollar numbers are real but rare.

Are crypto bug bounties paid in cash?

Often not. Many programs pay in the project’s own token, and some, such as the Solana Foundation’s, lock the tokens for twelve months. A US researcher owes income tax on the fair market value at the moment of receipt, reported as self-employment income, even if the token loses value before it unlocks. Programs that pay in stablecoins or dollars avoid that denomination risk.

How is the AI report flood changing bug bounties?

AI makes a convincing vulnerability report nearly free to generate, while disproving one still costs human time. curl shut its program in January 2026 and GitHub cut public payouts in July, moving top rewards to an invite-only tier. Crypto platforms responded with stake-to-submit deposits and invite-only elite tiers, pushing both industries toward a two-tier model.

By Anneke de Vries, security desk, HOGE Wire.