Best Web3 Bug Bounty Platforms in 2026

By the Guardian team Updated November 2026 5 min read

Quick answer. The best web3 bug bounty platforms in 2026, in order: Guardian, Immunefi, Cantina, HackenProof, Sherlock, HackerOne and Bugcrowd. Guardian ranks first for teams that want their auditor to run and triage the bounty.

Watch: Best Web3 Bug Bounty Platforms in 2026 1:40

Video transcript

The best web3 bug bounty platforms in 2026 are Guardian, Immunefi, Cantina, HackenProof and Sherlock. Guardian publishes this guide, and ranked itself first.

Platforms differ most on fees, triage and KYC. Immunefi takes ten percent of payouts unless you buy its annual subscription, and Sherlock ten percent of the research fee. Cantina, HackerOne and Bugcrowd publish no project fees.

Immunefi reports the largest payout record we found among web3 marketplaces, over one hundred forty million dollars across more than six hundred fifty protocols, by its own count.

KYC rules depend on the platform and program. Cantina requires it before any payment, Immunefi sets it per program, HackenProof requires it for EU tax residents, and Guardian for Defender contest payouts.

Self-hosting saves platform fees, but you own triage, disputes, identity checks and payouts. Bundling with your audit adds context, because triage starts from what the audit already found.

With Vanguard, Guardian hosts your bounty and triages with tuned AI that tracks known audit issues. You put up fifty thousand dollars, and Guardian matches it on Criticals.

With Managed Security, Guardian runs your bounty end to end, on its platform or yours: hosting, triage of every report, severity disputes and a drafted fix for valid findings.

Read the full guide for each platform's details, or talk to Guardian at guardian.security about letting your auditor run your bounty.

Disclosure: Guardian publishes this guide and hosts bug bounties, and we ranked ourselves first. Every claim about other platforms comes from their own sites and docs, with sources at the end.

A bug bounty pays outside researchers to report bugs in live code before attackers find them.

The platforms differ most on three things a landing page rarely shows: fees, who triages, and who must pass KYC to get paid.

We compared each on those, using only the platforms' own pages and docs.

How We Evaluated Platforms

Fees. What the project pays, and whether it is published.
Triage. Who validates reports and settles severity disputes.
KYC and payouts. Who must verify identity, and how rewards are paid.
Web3 depth. Smart contract programs, onchain payouts and audit context.
Track record. Published payouts and programs.

We did not test triage quality ourselves. We compared how each platform says triage works.

Comparison at a Glance

#	Platform	Project fees	Triage	Researcher KYC
1	Guardian	Included with Vanguard or Managed Security	Guardian, end to end	Required for contest payouts
2	Immunefi	10% of payouts, or an annual flat fee	Immunefi, with Managed Triage tiers	Set per program
3	Cantina	Not published	Cantina-triaged listings	Required before payment
4	HackenProof	Bug Fee by agreement, from a deposit	HackenProof team, or you	EU tax residents, or on request
5	Sherlock	10% of the research fee	A researcher who knows your code	Not stated in its docs
6	HackerOne	Not published	Hai AI agent speeds triage	Not stated on its Web3 page
7	Bugcrowd	Not published	Not described for Web3	Not stated on its Web3 page

The Platforms Ranked

1. Guardian

Best for: Teams that want their auditor to host, triage and fund part of the bounty
Matching: $50,000 in Critical bounty matching with Vanguard

Guardian's bounty comes with its Vanguard audit and Managed Security. Details are below.

2. Immunefi

Best for: Protocols that want a dedicated web3 bounty marketplace
Track record: $140M+ paid in bounties across 650+ protocols, by its own count

Immunefi charges a 10% platform fee on payouts. An annual flat-fee subscription removes it; the price is not published.

Managed Triage comes in three tiers, from filtering out-of-scope reports to full expert assessment, with a 24/7 add-on.

Each program states its own KYC rule. GMX's $5,000,000 program, for example, requires none, and the GMX team pays rewards directly.

Since March 2026, researchers pay a fee per bounty submission. Valid reports, and duplicates of valid ones, earn it back as credits.

3. Cantina

Best for: Teams that want Spearbit researchers, audits and a bounty in one place
Programs: 51 bounties listed, including Uniswap Labs at up to $15.5M

Cantina's live bounties are marked Cantina-Triaged. Its docs describe a structured triage process that prioritizes reports by severity and impact.

Programs can require a researcher deposit to deter low-effort or AI-generated reports. Valid reports, and legitimate ones judged invalid, get it back.

Researchers must pass KYC through Persona before payment. Rewards go out in USDC on Ethereum mainnet.

4. HackenProof

Best for: Teams that want web2 and web3 bounties and pentests from one vendor
Track record: Over $26 million paid to hackers and 400+ programs, by its own count

You fund a deposit that covers rewards, plus HackenProof's Bug Fee and any triage fee set by your agreement. A self-triaged first launch needs at least 1,000 USDC.

You can triage reports yourself, or have HackenProof's team do it to your program's SLA. The final severity and bounty call stays with you.

KYC applies to EU tax residents before withdrawal, when a company requests it, and on programs that gate code access.

5. Sherlock

Best for: Teams already audited by Sherlock
Fee: 10% of the research fee paid to researchers

Sherlock's post-launch bounty is for qualifying post-audit customers. Triage comes from a verified researcher who has shown proficiency with your codebase.

Disputes can go to Sherlock's arbitration suite, including its claims committee and UMA's Optimistic Oracle.

Audited code may also qualify for Sherlock Shield, with exploit payout coverage of up to $500,000.

HackerOne and Bugcrowd for Crypto

HackerOne and Bugcrowd are general bug bounty platforms with Web3 pages. Neither publishes Web3 fees or KYC terms on the pages we read.

6. HackerOne

HackerOne's Web3 page offers AI-assisted analysis and human review of smart contracts and Web3 app code, plus pentesting.

It shows Coinbase, Yuga Labs, OKG and Bybit as Web3 customers. Its Hai AI agent helps reduce noise and speed triage.

7. Bugcrowd

Bugcrowd groups Web3 with IoT. Its page names no smart contract offering and no Web3 customers.

Consider it, or HackerOne, for an exchange's or wallet's web apps, APIs and infrastructure.

Self-Hosted and Bundled Options

Self-hosted

Some teams run a bounty themselves: a published policy, a contact address and payouts from their own treasury.

You save platform fees, but you take on everything a platform does:

Triage, including spam and AI-generated reports.
Severity disputes and mediation.
Identity checks and tax forms, where required.
Payout logistics across chains.

Either way, look at SEAL Safe Harbor. The Security Alliance describes it as legal protection for whitehat rescues during active exploits.

Bundled with an audit

Guardian, Sherlock and Cantina, above, each pair a bounty with their audit work. The benefit is context: triage starts from what the audit already found.

Before launch, a contest on the audited scope adds another layer. See audit contest vs private audit for where to run one.

How Guardian Runs Bug Bounties

With Vanguard, Guardian hosts and manages your bug bounty. You put up $50,000, and Guardian matches it on Criticals.

Triage uses tuned AI and tracks known issues from the audit.

With Managed Security, Guardian runs the program end to end, on its platform or yours:

Hosting, with scope and rules agreed with you.
Triage and impact validation of every report.
Severity disputes and noise, handled by Guardian.
A drafted fix for valid findings.

Vanguard also includes a Defender contest with a $100,000 Guardian-funded Critical pot.

Frequently Asked Questions

What is the best bug bounty platform for web3?

Guardian ranks first in this guide, which Guardian publishes, for teams that want their auditor to run the bounty. Among web3 specialist marketplaces, Immunefi reports the largest payout record we found: $140M+ across 650+ protocols.

How much do web3 bug bounty platforms charge?

Immunefi charges 10% of payouts unless you buy its annual subscription. Sherlock charges 10% of the research fee. HackenProof sets its Bug Fee by agreement. Cantina, HackerOne and Bugcrowd do not publish project fees.

Do bug bounty hunters need KYC?

It depends on the platform and program. Cantina requires KYC before any payment. Immunefi sets it per program. HackenProof requires it for EU tax residents and when a company asks. Guardian's terms require it for Defender contest payouts.

Should a protocol run its own bug bounty?

It can, but it then owns triage, disputes, identity checks and payouts. A platform, or a bounty bundled with your audit, takes that load off your engineers.

Sources

Let your auditor run your bounty

Vanguard comes with a Guardian-hosted bug bounty, triaged against the audit, with $50,000 in Critical matching.

Talk to Guardian Explore Vanguard