Bug Bounty
Security & Intelligence Program
Help us protect millions of crypto transactions. Report vulnerabilities and contribute threat intelligence — qualifying reports may be rewarded at our discretion.
Vulnerability Severity Tiers
Qualifying reports may receive a discretionary reward. Severity, real-world impact, and report quality decide eligibility. All decisions are final.
CriticalTop priority
RCE, authentication bypass, database exposure, private key leakage
HighHigh priority
Privilege escalation, IDOR, stored XSS, SQL injection
MediumCase-by-case
Reflected XSS, CSRF, information disclosure, rate limit bypass
LowRecognition
Missing headers, clickjacking (limited impact), verbose errors
Intelligence Submissions
Contribute verified threat intelligence to improve our database coverage. All submissions are reviewed within 48 hours.
Sanctioned Address
Verified address on OFAC/EU/UN sanctions list not yet in our database
High value
Phishing / Scam
Active phishing site or confirmed scam wallet with evidence
Case-by-case
Mixer / Tumbler
New mixer service or contract address not in our registry
Case-by-case
Bridge Exploit
Cross-chain bridge vulnerability or exploit address
Case-by-case
Submission Rules
Maximum 5 submissions per day per account (anti-gaming limit)
Intelligence submissions must include proof (transaction hashes, screenshots, URLs)
Security reports must be disclosed responsibly — 90-day disclosure deadline
Duplicate reports receive no reward — first valid report wins
30-day cooldown after intel submission before the same address type can be submitted again
Report security vulnerabilities: [email protected] | PGP key available upon request.