May 2026 Immunefi Ecosystem Update
Ready to get involved in the Ecosystem? Buy IMU →
Allocating into crypto security? Talk to us →
May Snapshot: Immunefi is the standard for onchain security. Code4rena wound down May 13 - its bug bounty customers and wardens moved to Immunefi. Base Azul and Firedancer V1 audit competitions wrapped. Bounty payouts more than doubled month-over-month, critical bugs hit a 2026 high, and IMU Pledged crossed 17M for the first time. Lifetime: $20.6T protected, 1.24B transactions secured.
Immunefi Becomes the Default Home for Crypto Bug Bounties
On May 13, Code4rena announced it is winding down operations. Within hours, the Immunefi platform announced it would absorb Code4rena's bug bounty customers, porting over scope, rules, and reward structures, and welcoming their wardens.
Code4rena raised $6M from Paradigm in 2023; Zellic acquired it in 2024. Its closure marks the end of one of the leading standalone competitors for crypto bug bounties. Protocols migrating to the Immunefi platform now plug into a researcher network battle-tested across $138M+ in payouts, professional triage and mediation, and managed migration support.
Code4rena's exit is the market's answer to who runs onchain security. Immunefi is the standard. The protocols and researchers serious about it have already chosen.
Know someone running a bug bounty program on Code4rena who needs a soft landing? Forward this email.
May Highlights
Two audit competitions wrapped in May.
Base Azul closed May 4 with a $250K pool. Coinbase's first independent L2 upgrade since splitting from the OP Stack used the Immunefi platform's competition format to pressure-test the code before mainnet. Base Azul activated on mainnet May 13.
Firedancer V1 closed May 9 with a $1M total pool ($700K Primary, $200K All Stars, $100K Podium). Solana's independent validator client, written from scratch in C with tile-based sandboxing. Reports are in evaluation; rewards distribute in June.
Two institutional-grade infrastructure programs validated through Immunefi's audit competition format, within five days of each other.
Interested in launching an audit competition with Immunefi? Talk to us →
Immunefi Studio soft launch.
A new toolkit of products targeting report quality has launched to 20% of SRs. Studio Review gives researchers instant pre-submission feedback on PoC clarity, impact framing, and duplicate risk - so drafts are sharper before they submit. Studio Signals surfaces payout velocity, response times, and severity-aware bounty data, refreshed daily, so researchers focus where it pays. Higher signal, lower noise, and for projects, less time spent on submissions that should never have been filed.
$20.6T protected. 1.24 billion transactions secured.
The lifetime numbers behind the platform at the close of May: $20.6 trillion in cumulative value protected, 1.24 billion client transactions secured, $116.2B in active client TVL under continuous coverage. That depth is the Immunefi flywheel: every new researcher, pledge, and disclosure compounds onto it.
Immunefi is the standard for onchain security; if you’re not using Immunefi, you’re not taking security seriously. See the platform protecting crypto →
May by the Numbers:
Bounty payouts more than doubled month-over-month. Total bounties paid to SRs surged +135.4% from April to May - reflecting growing researcher activity and higher-stakes vulnerabilities caught before exploitation.
Critical bugs at a 2026 monthly high. Critical-severity vulnerabilities confirmed and paid grew +11.1% month-over-month - the most dangerous class of bugs, each capable of causing direct loss of user funds at scale if left undiscovered.
Researcher community continues to grow. New researcher registrations grew +4.5% month-over-month in May, with the platform attracting more security talent every month this year.
| Metric | March | April | May |
|---|---|---|---|
| Protocols Protected | 243 | 232 | 216 |
| Live Threats Prevented | 247 | 132 | 382 |
| Total Researcher Payouts (all-time) | $133.9M | $134.9M | $138.5M |
| IMU Price | $0.002731 | $0.002385 | $0.001820 |
| IMU Pledged (Hacker Pledging) | 15.7M | 16.3M | 17.1M |
Immunefi Platform Progress + May Roadmap
Code4rena migration in flight. Customer porting, scope re-creation, and warden onboarding remain the active priority through June. Dedicated migration support is live.
Hacker Pledging Season 2 continues through July 7. The bonus structure compounds IMU demand alongside the platform's growing share of critical vulnerability disclosures. More pledges feed sharper threat detection.
Pledge IMU to a researcher here to keep the network compounding.
Content Highlights
- The Vulnerability Apocalypse - Mitchell stakes out the position: vulnerability volume will outrun every team's manual triage capacity, and continuous incentivized researcher coverage is the only stack that scales against it.
- After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted (CryptoSlate) - Mitchell on the operational disciplines DeFi has been underinvesting in: multisig hygiene, supply chain hardening, real-time monitoring, and emergency response.
- Immunefi: The Complete Onchain Protection Platform (CIO Tech World) - Mitchell's clearest pitch yet for why bug bounties, audit competitions, monitoring, and incident response belong on one platform, written for the CIO audience.
Join the Mission
For the community: Buy IMU →
For institutional partners: Get in touch with Institutional Relations →
Immunefi protects $190B in TVL across 216 protocols. 93% of critical vulnerability disclosures in crypto flow through this platform. If you're not using Immunefi, you're not taking security seriously. If you're allocating into crypto security infrastructure, we'd like to talk.
The Immunefi Foundation is scaling security to save crypto from hacks and build a safe, resilient onchain economy. The IMU token coordinates protocols, researchers, and community to continuously compound security for a safer onchain future.