September 2026 Immunefi Ecosystem Update
Q3 counted $1.25 billion in crypto hacks, the protocols secured on Immunefi paid just $4.6 million to find their bugs first.
Researcher payouts on Immunefi were up 54% from Q3 2025, and valid bug bounty reports rose from 273 to 782. DefiLlama's Q3 total for crypto hacks and exploits compares with $818.1 million in Q2 2026 and $321.0 million in Q3 2025. DefiLlama does not subtract funds that attackers later returned.
Q3 2026 by the Numbers
| Metric | Q3 2026 | Q3 2025 |
|---|---|---|
| Researcher payouts | $4.6M | $3.0M |
| Valid reports, bug bounty | 782 | 273 |
| Valid reports, audit competitions | 145 | 82 |
| Critical bug payouts | $2.2M | $1.7M |
Security Signal
DefiLlama tracked $742.5 million in crypto hacks and exploits in September, across 35 incidents, against $111.2 million in September 2025. Two incidents made up 95% of the September total. In the same month, protocols on Immunefi paid researchers $801,562 to find critical bugs before attackers could.
Highlights
Seven established programs widened their scope
Listed by maximum bounty:
- USDT0, up to $6,000,000
- Spark, up to $5,000,000
- Origin Protocol, up to $1,000,000
- Ondo Finance, up to $1,000,000
- Aera, up to $500,000
- Pareto Credit, up to $50,000
- ZKsync OS now covers 232 assets, at up to $100,000.
- DAWN USD.infra Vault raised its maximum bounty to $50,000.
What Immunefi is learning from audit competitions
Public platforms started 89 audit competitions in Q4 2024 and 11 in Q2 2026. Those figures come from the article Immunefi published on September 23. Immunefi is changing how its competitions run, because duplicates are where the format breaks down. In one recent competition, a single high-severity bug drew 24 duplicate reports. A protocol fixes a bug once, so each later report of it is worth less.
Since September 21, leaderboards show chief findings and duplicates for each researcher, so anyone can see who found a bug first and took the largest share of its payout. In future competitions, Immunefi plans to publish confirmed bugs early, so later submissions of the same bug no longer qualify and researchers stop spending days on findings already made. Every submission is triaged and classified, and the submission fee covers that work, so Immunefi expects fees to come down as triage improves.
Immunefi has not found the right formula yet. The aim is a model where protocols get their code secured and the researchers who find unique bugs are the ones who get paid.
Teams preparing a launch can run an audit competition before they ship.
September by the Numbers
Payouts
Researchers earned $1,463,591 in September, up 103% from September 2025. The largest single payout was $150,000, for a critical report.
| Metric | July 2026 | August 2026 | September 2026 |
|---|---|---|---|
| Researcher Payouts | $2,315,959 | $802,428 | $1,463,591 |
| Payouts to Date | $142.4M | $143.2M | $144.7M |
Reports confirmed
| Metric | September 2026 | September 2025 |
|---|---|---|
| Critical vulnerabilities confirmed | 49 | 14 |
| Valid reports, bug bounty | 250 | 83 |
Audit competition reports are confirmed in batches after each competition closes, so that row moves with the competition calendar.
Researcher Spotlight
theboiledcorn was paid $64,000 in September for a critical report, their first critical on Immunefi.
A total of 278 researchers were paid in September, against 90 in September 2025. 108 bug bounty programs are now paying $100,000 or more on Immunefi, with 30 paying $1 million or more!
Immunefi Platform Progress
Immunefi Studio. Immunefi Studio is a closed beta of tools for security researchers. In September, Immunefi brought its tools into one hub: Instascope V3 for reading code, a Workspace that links cases and notes to that code, and an early MCP connection for a researcher's own AI agent. See Studio Workspace in action here!
Audit competition payout times. Under the new competition process, researchers in the three audit competitions that closed in August and September were paid 26 to 36 days after each competition ended. The two competitions that closed in May were larger, and their payouts took 60 and 63 days.
Content Highlights
- Liquid Network attacker crossed into theft: Immunefi CEO, crypto.news interview with Mitchell Amador, September 21.
- Bounty Pools Are Marketing, Bounty Payouts Are Security: A Review of Bug Bounty Platforms, blog post by Mitchell Amador, September 22.
Join the Mission
Launch a bug bounty or audit competition
Immunefi is the security platform for the onchain economy. 93% of crypto's critical vulnerability disclosures flow through it, and it has helped prevent more than $25 billion in hacks across 650-plus protocols.
Foundation Highlights
Hacker Pledging Season 3 runs from July to December. Community members pledge IMU behind security researchers and share in rewards when those researchers get paid. Correction: the August issue gave 28.5M IMU pledged at the end of August. The figure was 25.8M IMU. At the end of September, 26.2M IMU was pledged behind 426 researchers.
Pledge IMU to a security researcher here to earn from their success.