Table of Contents
In May 2026, Code4rena announced it would wind down, and Immunefi said it would take over its bug bounty customers. One of the best-known names in crypto security disappeared in a single post.
At the same time, AI tools have flooded bounty programs with reports. Cantina now tells buyers that 60 to 80 percent of submissions are invalid, yet each one still needs review.
So this compares six bug bounty platforms on what that shift makes important: who triages the noise, how payout disputes get settled and what each platform actually discloses.
Collecting bug reports is easy now. A bounty platform earns its fee by filtering them, judging severity fairly and settling disputes before a whitehat goes public.
Key Takeaways
- Long-running crypto bounty programs almost always find a critical bug.
- Immunefi is the largest and offers opt-in binding arbitration.
- Sherlock and Cantina put senior researchers between reports and your team.
- HackerOne and Bugcrowd suit exchanges with large web and app surfaces.
- Code4rena wound down in May 2026, moving its bounties to Immunefi.
What Actually Differs
Every platform here publishes your program and pays researchers. The differences sit in what happens between a report arriving and a payout leaving.
The first is triage, meaning who decides whether a report is valid and how severe it is. The second is disputes, meaning what happens when you and the researcher disagree about scope or severity.
The third is fit, since crypto-native platforms know smart contracts while generalists cover exchange websites and apps. A bounty also starts where an audit ends, as our audit firms roundup explains when it covers what no audit can guarantee.
What to note: write severity definitions and out-of-scope rules before launch, because most disputes start there.
Best Bug Bounty Platforms for Crypto and Stablecoin Projects
1. Immunefi
Does the job: the largest crypto-native bounty platform, with a formal arbitration route.
Immunefi says it has paid over 140 million dollars in bounties across 650+ protocols, and it absorbed Code4rena's bounty customers in May 2026.
The platform supports:
- A community of 85,000+ security researchers
- Bug bounties for live code and audit competitions before launch
- Mediation, then opt-in binding arbitration through the London Chamber of Arbitration and Mediation
- Arbitration awards enforceable under the New York Convention
- Published research on program outcomes and payouts
Immunefi's own data shows a median critical payout of 20,000 dollars against a mean of 114,355 dollars. Arbitration is optional for projects and costs the requesting party at least 7,500 pounds, and a 2024 public dispute with Trust Security shows mediation does not always end quietly.
Best for DeFi protocols and stablecoin issuers that want the widest researcher reach.
2. Cantina
Does the job: bounties built around filtering AI-era report volume.
Cantina, which works alongside the Spearbit researcher network, now sells its bounty product mainly on triage rather than reach.
The platform supports:
- AI filtering combined with experienced security researchers
- Validated reports with reproduction steps attached
- Risk scoring on each finding before engineers see it
- A trial before a full commitment
- Bounties that sit alongside its audit services
The page's headline statistics change as the page animates, so treat them as marketing rather than data. Cantina publishes no payout totals, fees or dispute process on its bounty page, and its domain recently moved to cantina.security.
Best for teams already overwhelmed by low-quality submissions.
3. Sherlock
Does the job: auditor-led triage, with bounties linked to Sherlock's audits and coverage.
Sherlock ran the 16 million dollar Usual bounty in 2025, and it puts senior auditors in front of every report.
The platform supports:
- Stake-gated submissions, so researchers post collateral with each report
- Senior auditors who validate, confirm impact and assign severity
- Bounties that inherit context from earlier Sherlock audits and contests
- Possible Sherlock Shield coverage for qualifying codebases
- Named users including Aave, Optimism and Sky
The page publishes no fees, payout figures or dispute process, and coverage depends on claims terms not shown there. Pair it with a review of stablecoin business insurance, because bounty-linked cover is not a full policy.
Best for protocols that already audit with Sherlock and want one security lifecycle.
4. HackenProof
Does the job: a crypto-focused bounty platform aimed at exchanges.
HackenProof, part of the Hacken group, calls itself the leading bounty platform for crypto exchanges and runs over 400 programs.
The platform supports:
- A community of 82,000+ researchers
- Triage of every submission before it reaches the client
- Rewards in fiat, stablecoins or native tokens
- Over 26 million dollars paid to researchers
- 100+ Web3 and 30+ Web2 customers in 45+ countries
The page mentions no platform fees, dispute process or KYC rules. Its payout total is far below Immunefi's, which reflects a focus on exchange web surfaces more than high-value DeFi criticals.
Best for centralised exchanges and payment apps with large web and mobile surfaces.
5. HackerOne
Does the job: the largest generalist platform, with long-running crypto exchange programs.
HackerOne runs programs for Coinbase and Crypto.com, and its 2024 data put average high and critical web3 bounties at 133,700 dollars.
The platform supports:
- Bug bounties and vulnerability disclosure programs
- Pentest as a service aligned with ISO 27001 and SOC 2
- Researchers covering smart contracts and blockchain systems
- Testing of new features before launch
- Industry reports on web3 vulnerability trends
The crypto page describes triage and smart contract coverage only in general terms. HackerOne's strength is breadth across web, cloud and apps, so DeFi-specific depth should be tested in a trial.
Best for regulated exchanges that need one program for apps, APIs and infrastructure.
6. Bugcrowd
Does the job: a generalist crowdsourced platform with its own triage team.
Bugcrowd groups web3 with IoT and offers bug bounties alongside pentesting and attack surface management.
The platform supports:
- Bug bounty and vulnerability disclosure programs
- A dedicated triage service and vulnerability rating taxonomy
- Pentest as a service, including AI pen tests
- Attack surface management
- Integrations into development workflows
The web3 page gives no crypto-specific figures, customers or smart contract detail, and Bugcrowd's old web3 page now returns page not found. It is a reasonable choice for web surfaces, not for onchain code.
Best for fintechs adding stablecoin features to an existing web and mobile product.
Bug Bounty Platforms Compared
| Platform | Focus | Who triages | Dispute route | Published scale |
|---|---|---|---|---|
| Immunefi | Crypto-native, DeFi | Immunefi, project decides | Mediation, opt-in arbitration | $140M+ paid, 650+ protocols |
| Cantina | Crypto-native, AI triage | AI plus researchers | Not published | Not stable on page |
| Sherlock | Crypto-native, audit-linked | Senior auditors | Not published | Not published |
| HackenProof | Crypto exchanges | HackenProof team plus AI | Not published | $26M+ paid, 400+ programs |
| HackerOne | Generalist with crypto clients | HackerOne | Not published | Web3 averages published |
| Bugcrowd | Generalist | Bugcrowd triage service | Not published | No web3 figures |
Only Immunefi publishes a formal dispute route. Everywhere else, a disagreement about severity is settled by the platform's judgement and your own goodwill.
What to note: ask each platform how many disputes it handled last year and how they ended.
Triage Is the Product Now
AI tools let anyone produce a plausible-looking vulnerability report in minutes. That pushes the cost of a bounty program from paying researchers to reading their reports.
Platforms are responding in different ways. Sherlock makes researchers stake collateral, Cantina layers AI filters over human reviewers, and Immunefi leans on scale and a formal dispute process.
The risk on the other side is a valid critical dismissed as noise. When that happens, a whitehat who feels underpaid can go public, which is why a clear severity table and a dispute route matter as much as the reward size.
What to note: measure a platform by time to first response and the share of reports it rejects before they reach you.
How to Choose
1. Match the platform to your attack surface
Onchain code points to Immunefi, Sherlock or Cantina. Web and mobile surfaces at an exchange point to HackenProof, HackerOne or Bugcrowd.
2. Size the top reward to the funds at risk
A critical left unreported becomes a theft, and our guide to the first hour after one shows how little can be recovered. The reward should beat what an attacker could gain by exploiting the bug quietly.
3. Decide who judges severity
Ask whether the platform or your own team makes the final call. Auditor-led triage costs more but produces fewer arguments.
4. Opt into a dispute route
Where arbitration is available, opting in signals good faith to researchers. Where it is not, write your own escalation process into the program terms.
5. Keep the program running
Immunefi's data shows the chance of finding a critical rises the longer a program runs. Budget for years, not a launch-week promotion.
What to note: fund the reward pool in advance, so researchers can see the money exists.
How This List Was Built
Inclusion required three things, so that the comparison means something.
- A first-party page describing a bug bounty service for crypto or blockchain assets
- A platform accepting new programs today
- A triage service offered by the platform, not left entirely to the client
Code4rena was left out because it announced its wind-down in May 2026. Platforms who believe they meet the three criteria above are welcome to send documentation for consideration in the next update.
What to note: last reviewed against platform websites in November 2026.
Risks and Limitations
- A bug bounty does not replace an audit, and an audit does not replace a bounty.
- Payout totals and researcher counts are platform claims and not independently verified.
- AI-generated reports raise triage costs and the risk of missing a real finding.
- Disputes over scope and severity can become public and damage trust.
- No platform here publishes its fees, so costs are known only after a quote.
Conclusion
The best bug bounty platform for a crypto project is the one that filters noise well and settles disagreements fairly. Reach still matters, but it is no longer scarce.
Immunefi leads on scale and formal arbitration, Sherlock and Cantina on researcher-led triage, HackenProof on exchange programs, and HackerOne and Bugcrowd on broad web surfaces.
Whichever you choose, publish clear severity rules, fund the pool and keep the program running. Immunefi's own data shows long-running programs almost always find a critical.
Read Next:
- Best Smart Contract Audit Firms for Stablecoin Businesses
- Best Insurance for Stablecoin Businesses
- What to Do in the First Hour After a Theft
FAQs:
1. What is a crypto bug bounty program?
It is a standing offer to pay security researchers who report vulnerabilities in a project's code or systems, instead of exploiting them.
2. How much do crypto bug bounties pay?
Immunefi's data shows a median critical payout of 20,000 dollars, while the largest programs offer up to 16 million dollars for a single critical bug.
3. Do I still need an audit if I run a bug bounty?
Yes. An audit reviews code before launch, while a bounty keeps researchers looking at live code and every upgrade after it.
4. What happens if a researcher disputes a payout?
On most platforms the platform mediates. Immunefi also offers opt-in binding arbitration through the London Chamber of Arbitration and Mediation.
5. What happened to Code4rena?
Code4rena announced its wind-down in May 2026, and Immunefi said it would onboard its bug bounty customers and researchers.
Disclaimer:
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or security advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation, and readers should conduct their own independent research or consult a qualified professional. Payout totals, researcher counts and other figures are drawn from each platform's own website or news reports at the time of writing, are not independently verified here, and change frequently. A bug bounty does not guarantee that vulnerabilities will be found. Confirm current terms, fees and dispute processes directly with each platform before launching a program.
