Bug Bounty Platforms
Bug Bounty Platforms evaluated across fee disclosure and the platform's take rate, dispute recourse when payment is refused, the advertised maximum against what was actually paid, and the coverage model and its depth on blockchains.
7providers tracked
5ranked (methodology v2026.11.1)
12 November 2026Ranking snapshot
3 November 2026oldest read · due 18 DecIndependent. Evidence-based.We rank with a published method and sourced evidence. No one can pay to rank.How it works
Set your country and amount to see your costs ·
Your setup
What your country changes
Pick a country to see which bug bounty platforms serve it. Nothing is hidden — any that does not is listed with that reason.- 🇺🇸 United States
- 🇨🇦 Canada
- 🇲🇽 Mexico
- 🇬🇧 United Kingdom
- 🇩🇪 Germany
- 🇫🇷 France
- 🇮🇹 Italy
- 🇪🇸 Spain
- 🇳🇱 Netherlands
- 🇨🇭 Switzerland
- 🇸🇪 Sweden
- 🇳🇴 Norway
This affects provider availability.
Requirements (0)
Preferences (0)
Preferences re-weight Fit for you, which needs your country.
More filters
5 providers match your requirements
Out of 5 ranked providers. 0 excluded.
What this ranks
Ranked here: crypto bug bounty platforms through which you fund a bounty, compared on what the platform keeps, recourse when payment is refused and what is actually paid.Not ranked here: anything other than a platform through which you fund a crypto bug bounty.5 of the 7 assessed are ranked; 2 were turned away by name. Who, and whyRequirements narrow the list; they never change a published ChainChoice Score. How the ranking works
Immunefi
How Immunefi was chosen
Leads this ranking on Coverage model & blockchain depthCrypto-native continuous bug bounty marketplace with binding arbitration
79 / 100 out of 100published score, #1 of all 5 worldwide
Evidence
High
4/4 criteria scored, with 4 dated sources quoted.Coverage model & blockchain depthFee disclosure & take rate
Why it leads
- Immunefi is 3 points ahead of Sherlock, mainly because it scores higher on its payout transparency and its model depth.
- Best in this ranking on model depth (9/10; next 8/10)
- Ahead of Sherlock on payout transparency (+4.7 points) and model depth (+1.9 points)
Tradeoff
Dispute recourse: 2 points below the best in this ranking
Share
#ProviderPriceCompare
2
SH
Contest-first audits
76 / 100 out of 100
3
CY
Cyfrin's competitive audit arena
67 / 100 out of 100
4
Spearbit's public bounty and competition arm
65 / 100 out of 100
5
Crypto-focused bounty platform run by Hacken
64 / 100 out of 100
Not confirmed (2) — not ranked until its source is read again; listed, not ruled out.
- Secure3 · Re-read pending, no primary record: Secure3 publishes no terms and no dated sign it still runs contests.
- HackerOne · Re-read pending, page walled: HackerOne’s programme pages no longer show paid totals to an automated read.
Compare providers (0)
See key differences in features, fees, security and more.
Fee disclosure
Fee disclosure & take rate
30% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Fee disclosure (0–10) | ChainChoice Score |
|---|---|---|
| Immunefi | 7 | 79 |
| Sherlock | 7 | 76 |
| HackenProof | 5 | 64 |
| Cantina (Spearbit) | 4 | 65 |
| Cyfrin CodeHawks | 3 | 67 |
Payout transparency
Advertised maximum vs actually paid
25% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Payout transparency (0–10) | ChainChoice Score |
|---|---|---|
| Cyfrin CodeHawks | 7 | 67 |
| Immunefi | 6 | 79 |
| HackenProof | 5 | 64 |
| Cantina (Spearbit) | 4 | 65 |
| Sherlock | 3 | 76 |
Model depth
Coverage model & blockchain depth
15% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Model depth (0–10) | ChainChoice Score |
|---|---|---|
| Immunefi | 9 | 79 |
| Cantina (Spearbit) | 8 | 65 |
| Sherlock | 7 | 76 |
| HackenProof | 5 | 64 |
| Cyfrin CodeHawks | 4 | 67 |
Dispute recourse
Dispute recourse when payment is refused
30% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
| Provider | Dispute recourse (0–10) | ChainChoice Score |
|---|---|---|
| Sherlock | 7 | 76 |
| Immunefi | 5 | 79 |
| Cyfrin CodeHawks | 4 | 67 |
| Cantina (Spearbit) | 3 | 65 |
| HackenProof | 2 | 64 |
All 4 published criteria
Every ranked row’s score on each criterion, in the published order. Choose a column to order by it.
| Provider | ChainChoice Score | |||||
|---|---|---|---|---|---|---|
| 1 | Immunefi | 7 | 5 | 6 | 9 | 79 |
| 2 | Sherlock | 7 | 7 | 3 | 7 | 76 |
| 3 | Cyfrin CodeHawks | 3 | 4 | 7 | 4 | 67 |
| 4 | Cantina (Spearbit) | 4 | 3 | 4 | 8 | 65 |
| 5 | HackenProof | 5 | 2 | 5 | 5 | 64 |
How this ranking works
How firm the #1 is, the per-criterion arithmetic behind each score, who pays ChainChoice, and which bug bounty platforms were assessed and left out.
FirmThis verdict holds under every one-point re-read
See the arithmetic
Every published criterion was moved up and down by one point and the ranking re-run. The same product came first each time. The published rankings file
Why this score4 published criteria · leads 2 of 4
Published criterionWtScore, and the best hereGap/10 out of 10Pts
Fee disclosure & take rate7.2·76.7
Dispute recourse when payment is refused7.2−254.8
Advertised maximum vs actually paid6−164.8
Coverage model & blockchain depth3.6·94.3
Σ methodology points20.6/32
Each bar is the score on that criterion’s own 0–10 scale, never rescaled to the pool. The dark line is the best any product here reached on that axis. Wt is the most the criterion can add to the 86-point weighted total. Pts is weight × score × 32; the sum is the methodology score, and each weighted point behind the leader costs 2.6 on the displayed score. how these are weighted
Why it ranks first
Why Immunefi leads this category right now
Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Immunefi lists 155 continuous bug bounty programmes, the largest crypto-native standing footprint in this set, and runs Managed Triage with AI triage agents and expert human triagers drawn from 83,000+ registered security researchers. Weakest on dispute recourse when payment is refused (5/10): Immunefi allows mediation as the only dispute once a report is paid or closed; binding arbitration is opt-in and enabled on 17 of 155 programmes, and 142 programmes charge researchers to mediate. A mediation won returns its fee as Immunefi Credits. Published price: "the subscription removes the 10% platform fee on all payouts" (immunefi.com/bug-bounty-program/, fetched 2026-11-03), i.e. the default is a 10% platform fee on every payout.
Best for
Coverage model & blockchain depth — 9/10
Main tradeoff
Its rulebook is no longer public. The support articles defining "No Fix, No Pay", Issuing Payouts and Arbitration Overview all now return a login wall ("Login to your account | Immunefi") — you cannot read the terms that govern whether you get paid until after you sign up. And the "no fix, no pay" rule itself means a project that acknowledges your critical but declines to fix it owes you nothing; immunefi.com/rules/ only references the rule obliquely, listing "Abusing the 'no fix, no pay' rule by stealth fixing the bug later without providing full payment to the whitehat" as prohibited conduct.
Verify before signup
"the subscription removes the 10% platform fee on all payouts" (immunefi.com/bug-bounty-program/, fetched 3 November 2026), i.e. the default is a 10% platform fee on every payout. The annual subscription price that removes it is not published: the page lists BBP Subscription ("Annual flat fee, zero commission on payouts"), Enterprise Subscription and Premium BBP ("An add-on that restricts submissions to a curated pool of experienced, vetted researchers") with no dollar amounts. Researcher-side costs also exist: Managed Triage uses "pay-to-submit pricing" to keep spam out, with the amount set per programme. Since 2 November 2026 (Immunefi blog, "Immunefi Credits") submission, mediation and verification fees are paid in Immunefi Credits, and a researcher whose report is valid, a duplicate of a valid report, a private known issue or a mediation won receives credits equal to the fee.
Recommendation summary
What should decide this category
Do you want continuous coverage of deployed code, or a time-boxed contest before launch?
Do you know what percentage the platform takes from a payout, and is it published?
What happens if you and a researcher disagree about severity — who decides, and can it be appealed?
Quick picks
Strong options in this category
Start with the lead choice first, then use the shortlist only if you still need a challenger or stronger fit for a specific setup.
Best overall
Immunefi
Crypto-native continuous bug bounty marketplace with binding arbitration
Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Immunefi lists 155 continuous bug bounty programmes, the largest crypto-native standing footprint in this set, and runs Managed Triage with AI triage agents and expert human triagers drawn from 83,000+ registered security researchers. Weakest on dispute recourse when payment is refused (5/10): Immunefi allows mediation as the only dispute once a report is paid or closed; binding arbitration is opt-in and enabled on 17 of 155 programmes, and 142 programmes charge researchers to mediate. A mediation won returns its fee as Immunefi Credits. Published price: "the subscription removes the 10% platform fee on all payouts" (immunefi.com/bug-bounty-program/, fetched 2026-11-03), i.e. the default is a 10% platform fee on every payout.
Best for: Coverage model & blockchain depth — 9/10
Fee disclosure & take rate · weight 30%7/10Dispute recourse when payment is refused · weight 30%5/10Advertised maximum vs actually paid · weight 25%6/10Coverage model & blockchain depth · weight 15%9/10
Quick pick
SH
Sherlock
Contest-first audits with post-launch bounty and coverage backstop
Contest-first audits with post-launch bounty and coverage backstop. Strongest on fee disclosure & take rate (7/10): Sherlock publishes its post-launch bounty fee: a Platform Fee equal to 10% of the Research Fee, paid within 10 days of resolution. It also prices dispute escalation at $1k for the claims committee and about $15k for the UMA oracle tier. Weakest on advertised maximum vs actually paid (3/10): Sherlock's bounty list shows 38 programmes by maximum reward only (Usual Labs at 16,000,000 USDC is the largest); it publishes no total paid, no per-programme paid amount and no median or mean payout. Published price: Post-launch bug bounty (docs.sherlock.xyz/bug-bounties/post-launch-bounty, fetched 2026-11-03): "The Platform Fee is equal to ten percent (10%) of the Research Fee", payable "100% paid within 10 days of latest resolution".
Best for: Fee disclosure & take rate — 7/10
Fee disclosure & take rate · weight 30%7/10Dispute recourse when payment is refused · weight 30%7/10Advertised maximum vs actually paid · weight 25%3/10Coverage model & blockchain depth · weight 15%7/10
Quick pick
CY
Cyfrin CodeHawks
Cyfrin's competitive audit arena; contest-only, no continuous bounty
Cyfrin's competitive audit arena; contest-only, no continuous bounty. Strongest on advertised maximum vs actually paid (7/10): CodeHawks publishes a results leaderboard for each contest with every auditor's earnings against the fixed prize pool (the Gamma contest paid from a 50,000 USDC pool, top earner 22,648.81), plus its reward formula; it gives no platform-wide total or median. Weakest on fee disclosure & take rate (3/10): CodeHawks states only "Low platform fees" against competitors' "Higher platform fees", with no percentage or amount; its published payout formula divides the prize pool among auditors and says nothing of Cyfrin's own cut. Published facts: Platform fee: not published. The docs (docs.codehawks.com/llms-full.txt, fetched 2026-11-03) compare only "Low platform fees" to competitors' "Higher platform fees", with no figure.
Best for: Advertised maximum vs actually paid — 7/10
Fee disclosure & take rate · weight 30%3/10Dispute recourse when payment is refused · weight 30%4/10Advertised maximum vs actually paid · weight 25%7/10Coverage model & blockchain depth · weight 15%4/10
Quick pick
Cantina (Spearbit)
Spearbit's public bounty and competition arm, now inside an agentic security suite
Spearbit's public bounty and competition arm, now inside an agentic security suite. Strongest on coverage model & blockchain depth (8/10): Cantina runs 51 live continuous bug bounties triaged by its own team, including Uniswap's $15.5M programme, alongside time-boxed competitions (one live, 144 ended). Weakest on dispute recourse when payment is refused (3/10): Cantina lets either party escalate a finding to Cantina for free mediation, but its docs state that the client has the final say on the resolution; the only backstop is a policy on clients who reject more than five valid findings in a year. Published price: Platform fee/commission: not published. It is absent from docs.cantina.security/llms-full.txt, and the Terms of Use (last updated October 23, 2026) say only that clients pay "on such terms as shall be outlined on the applicable submission page".
Best for: Coverage model & blockchain depth — 8/10
Fee disclosure & take rate · weight 30%4/10Dispute recourse when payment is refused · weight 30%3/10Advertised maximum vs actually paid · weight 25%4/10Coverage model & blockchain depth · weight 15%8/10
Considered and not ranked
2 products we looked at and left out
A shortlist is only honest if it says who it turned away. Each of these was assessed against the same published criteria as the ranked table and excluded for a stated reason — not overlooked.
We assessed 7 products here and rank 5 — 71% of what we looked at. That share is of the products we assessed, not of the category: how many exist is not something we can count, so we do not claim a number for it.
Secure3· Re-read, no recordHackerOne· Re-read pending, walled
What this ranking does not assess
- Liveness failure: the operator stops, censors you or loses data.
- Exit failure: you cannot get out at par, on time, or with what is yours.
These can still cost you money here; the ranking does not measure them, so a high place says nothing about them. Which criterion scores each family, and why the others do not apply, is in /data/risk-coverage.json.
How this ranking is built
Reviewed on fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.
Data checked Nov 2026 · Independent rankings · We show our work
How this page is reviewed
Reviewed means every product ranked on this page was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
Accountable for this review: Mathias Siemonsmeier, Founder.
How we review · Review calendar · Corrections log · How we make money
Direct answer
What is the best bug bounty platform in 2026?
Immunefi ranks #1 overall for bug bounty platforms on ChainChoice. Crypto-native continuous bug bounty marketplace with binding arbitration. It holds that rank under an affiliate-blind methodology scored across 4 published, weighted criteria — the code that ranks providers physically cannot read affiliate payouts (CI-enforced), so a payout can't move a rank. The verdict re-computes on every fee change, incident, or regulatory action; the full reasoning and the audit receipt are under Methodology.
How you can lose money here, and what the ranking scores
- Execution failure: you get a worse price, later, or nothing.Scored by Dispute recourse when payment is refused · 30% (Immunefi 5/10, Sherlock 7/10, Cyfrin CodeHawks 4/10)
- Information failure: the number is wrong or bought, or your data leaks.Scored by Advertised maximum vs actually paid · 25% (Immunefi 6/10, Sherlock 3/10, Cyfrin CodeHawks 7/10)
Not assessed by this ranking: Liveness failure, Exit failure. A high place says nothing about these; the Methodology tab says what each means.
Also scored, as cost, quality or a summary of several families: Fee disclosure & take rate (30%), Coverage model & blockchain depth (15%).
FAQs
3 questions readers ask before choosing bug bounty platforms.
Frequently asked
Questions people ask before choosing bug bounty platforms
Does a large advertised bounty mean large payouts?
No. The headline maximum is a marketing ceiling and is shown here as a fact, never scored as an achievement. What is scorable is whether the platform lets anyone verify the gap between what it advertises and what it has genuinely paid.
Why does coverage model carry the least weight?
Because it is the most visible difference and the easiest to check yourself. A contest covers a commit for a window; continuous coverage follows deployed code afterwards. The harder questions — what the platform keeps, and what recourse exists when a payout is refused — carry 60% between them.
What matters most when picking an bounty platform?
Fee disclosure and dispute recourse — 60% of the weight between them. They are the two things a researcher cannot discover until it is too late.
Free advisor·No signup needed
Still unsure? Get your best bug bounty platforms pick
Answer a few quick questions and get one clear recommendation based on how you actually plan to use crypto — then review the evidence before deciding.
No signup·Free first pass · Private·No spam · No account
Not financial advice · Independent · Always do your own research
Best picks
Best bug bounty platforms in 2026
A bounty platform is not an audit, and this page scores it as what it is: a standing offer to pay strangers for bugs. The decisive questions are whether the platform discloses its fee and take rate, what recourse a researcher has when a payment is refused, and how the advertised maximum compares with what has actually been paid — headline ceilings in this market are marketing, and are shown as facts rather than scored.
Best overall
Immunefi
Crypto-native continuous bug bounty marketplace with binding arbitration
Data checked Nov 2026
Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Immunefi lists 155 continuous bug bounty programmes, the largest crypto-native standing footprint in this set, and runs Managed Triage with AI triage agents and expert human triagers drawn from 83,000+ registered security researchers. Weakest on dispute recourse when payment is refused (5/10): Immunefi allows mediation as the only dispute once a report is paid or closed; binding arbitration is opt-in and enabled on 17 of 155 programmes, and 142 programmes charge researchers to mediate. A mediation won returns its fee as Immunefi Credits. Published price: "the subscription removes the 10% platform fee on all payouts" (immunefi.com/bug-bounty-program/, fetched 2026-11-03), i.e. the default is a 10% platform fee on every payout.
Best for: Coverage model & blockchain depth — 9/10
Browse this network
MS
Written and reviewed by Mathias Siemonsmeier, Founder
Not financial advice · For informational purposes only · Always do your own research