Hedera bug bounty on Immunefi
Hedera pays up to $30,000 on Immunefi for bugs in its public network and services. The program was last updated 31 August 2026.
The Hedera bug bounty on Immunefi pays for bugs in Hedera's public proof of stake network. Immunefi shows the program as live since 5 February 2025 and last updated on 31 August 2026. The maximum bounty is $30,000. Rewards are denominated in USD and paid in USDC on Ethereum.
Critical blockchain reports pay 10 percent of the funds directly affected, with a cap of $30,000 and a minimum of $10,000. High reports pay between $3,000 and $10,000. Medium reports pay a flat $3,000. Low reports pay between $50 and $100.
Hedera is an open source public network with Solidity smart contracts, consensus, and token services. A proof of concept is required for every severity. Testing must be done on local forks, not on mainnet or public testnets. KYC is required before a payout, including identity, proof of address, and a government issued ID.
Official contributors, employees, auditors who took part in the review, people on the OFAC SDN list, and politically exposed persons cannot take part. Submit reports through Immunefi.