August 2026 Immunefi Ecosystem Update
Security snapshot:
- August was the most-hacked month of crypto's most-hacked year.
- It was also Immunefi's biggest month on record in terms of confirmed vulnerabilities. Researchers submitted 424 valid reports against 154 in August 2025, and confirmed criticals went from 14 to 126.
- Payouts rose 12% year over year, and researcher payouts passed $143 million all-time.
Attackers had their busiest month of 2026, and so did Immunefi's researchers
The year is on track to break the record for most major crypto hacks, with August producing more successful attacks than any other month of 2026.
Immunefi set a record of its own in August. Researchers closed 424 valid reports across bug bounty programs and audit competitions, against 154 in August 2025, counting paid and confirmed reports with duplicates and spam removed. Confirmed criticals went from 14 to 126 in this period, nine times what was achieved a year earlier and the highest month in the platform's history.
The attackers are on course for their busiest year, but so are the researchers paid to find the bugs first.
Highlights of the Month
Two $20K competitions found 2-3x the platform average
The ENS Audit Competition went live with rewards up to $70,000, open through September 14. Firelight and Quantus ran $20,000 competitions and delivered 193 and 140 confirmed findings, respectively, 2-3 times the platform average, with about $40,000 in payouts landing in September.
Interested in launching an audit competition with Immunefi?
One bounty pool jumped twentyfold
Magpie raised its top reward twentyfold, from $10,000 to $200,000, TermMax lifted its own from $50,000 to $80,000, and Sky added two new assets to a program that pays up to $10 million.
August by the Numbers:
Payouts were up 12% year over year, more paid reports and more dollars than August 2025. Immunefi paid $802,000 to 126 whitehats in August, even as the figure eased off an unusually large July.
| Metric | June | July | August |
|---|---|---|---|
| Critical Threats Prevented (Bug Bounty) | 29 | 76 | 56 |
| Cumulative Researcher Payouts | $140.1M | $142.4M | $143.2M |
Researcher Spotlight
SR Summer wrapped on August 31. The season's Top 3 finishers by total bounties earned all joined Immunefi in 2026:
- heisenberg92 (@heisenberg_btc) - $30,097
- skydev (@skydev0h) - $18,790
- Moboutrig (@TopsEE637434) - $7,249
skydev also took Most Consistent Hunter and Most Valid Submissions.
The researcher base is up 55% year over year, and the work keeps getting bigger. 112 live bug bounty programs on Immunefi now pay $100,000 or more, and 30 pay $1 million or more. The best-paid work in crypto security is here.
Immunefi Platform Progress
Triaging Agent: The automated triaging agent took both audit competitions in August through triage end to end. To really show the power of the agent, Firelight and Quantus were run completely in parallel. This increases capacity for a historically resource-intensive offering.
Immunefi Studio: Following July's adoption growth, August focused on directly enhancing the Signal and Review products based on feedback from Security Researchers (SRs):
- Studio Signal: Added real-time commit and code-change monitoring, so researchers see when a program's code changes. Two new program metrics went live: program congestion, which shows how many researchers are already working a target, and last payout, which shows when that program last paid.
- Studio Review: Out-of-scope submissions are now detected automatically. Duplicate and known-issue verdicts explain the reasoning directly in the interface.
Direct feedback from the community shows clear appreciation for these updates, highlighting how the toolset is helping them in their daily work:
After completing this validation phase, focus now shifts to bundling the Immunefi Studio product suite into a single hub. The goal is to cover the end-to-end hunting experience with a simplified UX designed to boost hunting productivity for SRs.
Content Highlights
- Crypto lost $110 million to hacks in July amid rising bug bounty activity - Immunefi's monthly hack data cited. (The Block)
- Can a hardware wallet generate a weak Bitcoin seed? - Immunefi's Head of Security breaks down the Coldcard flaw. (Coinjuice)
About Immunefi
Immunefi is the security platform for the onchain economy; 92% of crypto's critical vulnerability disclosures flow through it, with it helping to prevent more than $25 billion in hacks across 650-plus protocols.
Foundation Highlights
Hacker Pledging Season 3 is rewarding the community. In Season 3 (running July through December), community members pledge IMU behind the security researchers they believe in and share in the rewards when those researchers get paid. Backers have already earned over 1.23M IMU this season, following the 1.47M IMU distributed when Season 2 closed. Community backing stood at 28.5M IMU pledged at the end of August, up from 26.1M in June.
Pledge IMU to a security researcher here to earn from their success.
—-
The Immunefi Foundation is scaling security to save crypto from hacks and build a safe, resilient onchain economy. The IMU token coordinates protocols, researchers, and community to continuously compound security for a safer onchain future.