Cronos Ult app bug bounty on HackenProof: up to $20,000
Cronos pays up to $20,000 in USDC or USDT through HackenProof for security bugs in the Ult trading app and its backend API.
The Ult: Trade Stocks & Crypto bug bounty pays for security bugs in the Ult app and its backend API. Ult is a trading app from Cronos that combines crypto, perpetuals, commodities and prediction markets. HackenProof lists the program as live with a start date of 28 September 2026.
Rewards follow severity. A critical report pays $8,000 to $20,000. A high report pays $3,000 to $8,000. A medium report pays $500 to $3,000, and a low report up to $500. Payouts are made in USDC or USDT only.
Three targets are in scope: the Ult iOS app, the Ult Android app and the backend API at api.cronos.com. The program looks for bugs that lead to loss of user funds, leaks of sensitive data or unauthorized changes to data. Third party services such as Hyperliquid, Polymarket, CoinGecko, Privy and Alchemy are out of scope, as are zero day bugs disclosed in the last 14 days.
Researchers need at least 150 reputation points on HackenProof. KYC is required for rewards, and every report needs a proof of concept. Only the first reporter of a valid, reproducible bug is paid, and the bug must be reported within 24 hours of discovery.
Reports go through the program page on HackenProof. The program aims to give a first response within 5 business days, triage within 11 business days and pay within 15 business days.