Crypto Exchange Bug Bounty Programs: A 2026 Benchmark

By the Guardian team Updated November 2026 6 min read

Quick answer. Among CoinGecko's top 10 exchanges, Coinbase, Kraken and Crypto.com run the strongest programs: published maximums of $5 million, $1.5 million and $1 million, with explicit safe harbor. Gate and BingX cap Criticals at $5,000 or less.

Watch: Crypto Exchange Bug Bounty Programs: A 2026 Benchmark 1:43

Video transcript

Among CoinGecko's top ten exchanges, Coinbase, Kraken and Crypto.com run the strongest bug bounty programs.

On October 29, about 6.36 billion dollars left Binance wallets, according to TRM Labs. Few exchange controls can be checked from outside. A bug bounty can.

Headline maximums run from four thousand dollars at BingX to five million for Coinbase's onchain program. We could not verify Bitget or MEXC.

The headline is usually not the ordinary Critical payout. Five of the eight put it behind a separate program, a narrow tier, discretion or asset tiers.

Most reports earn nothing. Kraken rewarded 26 of 434 reports in the last year, 6 percent.

Every program covers websites, APIs and apps, but only Coinbase and Crypto.com list deployed contracts. All eight rule out social engineering, so the people who approve withdrawals are off limits.

Five of eight programs give explicit safe harbor. Binance's is partial, Gate and BingX state none, and OKX, Binance and BingX ban disclosure outright.

A strong program pays its headline from a published Critical band, covers contracts and wallet code, and adds explicit safe harbor, a disclosure path and response targets.

A bug bounty waits for researchers to choose your systems. A Guardian pentest goes after them on your schedule, down to the flows that approve withdrawals.

Read the full benchmark, or talk to Guardian about testing your exchange at guardian.security.

On October 29, about $6.36 billion left Binance wallets across ten blockchains, according to TRM Labs. TRM assesses that Binance's hot wallet signing infrastructure was compromised; at the time, Binance had not published a root cause.

Few exchange security controls can be checked from outside. A bug bounty is one of them.

Its page shows what an exchange pays for, what researchers may test and what legal cover they get.

We read the programs of the ten top-ranked exchanges on CoinGecko on November 5, 2026. Every program figure comes from the program pages themselves.

How We Counted

Selection. The ten highest Trust Score ranks in CoinGecko's public exchanges API, pulled November 5, 2026.
Trust Score. CoinGecko scores liquidity, regulation, cybersecurity, past incidents and proof of reserves, from 1 to 10.
Bias. Cybersecurity is one input, so the list may favor mature programs. Bybit ranked 35th that day.
Sources. Each program page, read the same day, including the data HackerOne and Bugcrowd pages load.
Headline maximum. The largest reward a program states, in any tier or linked program.
security.txt. We requested /.well-known/security.txt on each exchange's main domain.
Not verified. For Bitget and MEXC, third-party listings point to BugRap, which blocked our reader. We report no terms for either.

The Benchmark

Payouts and platforms first. The # column is the CoinGecko Trust Score rank.

#	Exchange	Platform	Headline max	Where the top tier sits
1	Coinbase	HackerOne, Cantina	$5,000,000	Cantina: Base, cbBTC, cbETH contracts
2	Kraken	Self-hosted, by email	$1,500,000	Critical band from $100,000
3	OKX	HackerOne	$1,000,000+	Discretionary Extreme tier
4	Binance	Bugcrowd	$100,000	Discretionary; P1 up to $10,000
5	Bitget	Not verified	Not verified	Program page not readable
6	Gate	HackenProof	$5,000	Critical band from $3,000
7	Bitstamp	HackerOne (Robinhood)	$25,000	Main website only
8	MEXC	Not verified	Not verified	Program page not readable
9	Crypto.com	HackerOne	$1,000,000	Extreme-tier assets and contracts
10	BingX	HackenProof	$4,000	Critical band from $2,500

Next, the legal terms.

Exchange	Safe harbor	Disclosure	security.txt
Coinbase	Gold Standard, on HackerOne	HackerOne process; Cantina by permission	Expired June 2024
Kraken	Own statement	Written consent only	Current, signed
OKX	Own statement	Not allowed	None found
Binance	Partial	Not allowed	No Expires field
Bitget	Not verified	Not verified	None found
Gate	None stated	With permission only	Our check was blocked
Bitstamp	HackerOne Gold Standard	Only through HackerOne	Expired July 2026
MEXC	Not verified	Not verified	None found
Crypto.com	HackerOne Gold Standard	No rule of its own	None found
BingX	None stated	Not allowed	None found

Payout Patterns

Headline maximums run from $4,000 at BingX to $5,000,000 for Coinbase's onchain program. Four of the eight programs we read offer $1 million or more.

The headline is usually not the ordinary Critical payout. Only Kraken, Gate and BingX pay it from one Critical band across their whole scope.

The other five put it behind something:

A separate program: Coinbase's $5 million is for Base, cbBTC and cbETH contracts, on Cantina. Its other contracts reach $500,000.
A narrow tier: up to $1 million on HackerOne for access to Coinbase wallets or keys. Other Criticals reach $15,000.
Discretion at OKX: an Extreme tier of $30,000 to $1,000,000+. Listed Criticals reach $30,000.
Discretion at Binance: up to $100,000 for extraordinarily severe issues. Its P1 band is $5,000 to $10,000.
Asset tiers at Crypto.com: up to $1 million on Extreme-tier assets and contracts; $5,000 or less elsewhere.
Asset tiers at Bitstamp: $25,000 for its main website. Subdomains and apps reach $8,000.

Two pay through their own rails. Kraken pays in BTC to a verified Kraken account, and Binance pays in BNB.

Most reports earn nothing. Kraken rewarded 26 of 434 reports in the last year (6%), with an average payout of $3,962.

HackenProof shows $26,705 in rewards across 531 Gate submissions since July 2020. For BingX, it shows $25,162 across 580 since September 2022.

Scope Patterns

Every program we read covers the exchange's websites, APIs and mobile apps. Onchain coverage is thinner:

Coinbase covers every mainnet contract it deploys, plus Base contracts, through Cantina.
Crypto.com lists two token contracts and the Crypto.org chain code.
OKX lists its wallet extensions, wallet core, OKT Chain and open-source Web3 DEX code.
Binance includes Trust Wallet's apps, browser extension and wallet-core library.
Kraken lists its Kraken Wallet app, but no contracts.
Gate, Bitstamp and BingX list no onchain assets.

People stay out of scope. All eight programs rule out social engineering or phishing.

So researchers are not invited to test the people who approve withdrawals. Our report on onchain vs offchain crypto hacks shows why that gap matters.

AI now has its own rules. Kraken treats AI-generated reports as ineligible, and Coinbase's Cantina program excludes submissions generated with ChatGPT or other LLM tools.

OKX requires researchers to disclose any AI use, and may close unvalidated AI reports as spam.

One testing limit stands out. Robinhood's program, which covers Bitstamp, says to stop testing unbounded-loss bugs at $1,000.

Safe Harbor and Disclosure

HackerOne describes safe harbor as a statement that good-faith researchers are authorized and will not face legal action from the organization.

Five of the eight programs give that cover explicitly:

HackerOne Gold Standard Safe Harbor: Coinbase, Crypto.com and Bitstamp. Coinbase states it on HackerOne, not on its Cantina page.
Their own statements: Kraken and OKX. Kraken calls compliant research "authorized" under the CFAA and DMCA.
Partial: Binance, whose Bugcrowd page offers "a limited goodwill statement" on legal action.
None stated: Gate and BingX. BingX reserves the right to pursue "relevant legal responsibilities" if aggressive test payloads are not deleted in time.

Disclosure is tightly held:

Banned: OKX, Binance and BingX.
Permission needed: Kraken (written consent), Gate, and Coinbase's Cantina program.
Through HackerOne: Coinbase's HackerOne program and Bitstamp. Crypto.com adds no rule of its own.

Then the front door. RFC 9116 requires a security.txt file to carry Contact and Expires fields, and says stale data should not be used.

Of the files we could read, only Kraken's was current. Coinbase's expired on June 1, 2024, and Bitstamp's on July 12, 2026.

Binance's file has no Expires field. We found no file at five exchanges, and Gate blocked our check.

What a Strong Program Includes

Taking the best terms in this set, a strong exchange program has:

A published Critical band that reaches the headline amount, as Kraken's does.
Deployed contracts in scope, as at Coinbase and Crypto.com, plus wallet code, as at OKX.
Explicit safe harbor, such as HackerOne's Gold Standard.
A disclosure path after the fix, with a stated timeline.
Response targets: Kraken commits to acknowledge in 1 business day, triage in 10, pay in 14.
Published statistics on reports and rewards.
A current, signed security.txt that points to the program.
A clear rule on AI-generated reports.

Building a program for a protocol instead? See how to set up a web3 bug bounty program.

How Guardian Tests Exchanges

A bug bounty waits for researchers to choose your systems. A pentest goes after them on a schedule you set.

Guardian's fintech security work attacks the flows that authenticate users, authorize actions and approve withdrawals, function by function.

That spans web app, API, infrastructure and browser extension pentests, plus SDK audits. With Managed Security, Shield watches every internet-facing surface, and an engineer verifies each finding.

For onchain code, Vanguard includes a Guardian-hosted bug bounty with $50,000 in Critical matching. For the test plan, see crypto exchange pentesting.

Frequently Asked Questions

Which crypto exchange pays the most for bug bounties?

Coinbase, in our November 2026 read: up to $5 million for Critical bugs in its Base, cbBTC and cbETH contracts, through Cantina. For an exchange's own website, APIs and apps, Kraken's Critical band is highest: $100,000 to $1.5 million.

Does Binance have a bug bounty program?

Yes, on Bugcrowd. P1 findings pay $5,000 to $10,000, and extraordinarily severe issues may earn up to $100,000, paid in BNB. Disclosure is not allowed, and Bugcrowd labels its safe harbor partial.

Can researchers publish findings from exchange bug bounties?

Rarely on their own terms. OKX, Binance and BingX ban disclosure. Kraken, Gate and Coinbase's Cantina program need permission; Bitstamp, Crypto.com and Coinbase's HackerOne program follow HackerOne's process.

Do exchange bug bounties cover smart contracts?

Rarely. Of the eight programs we read, only Coinbase and Crypto.com list deployed contracts. OKX, Binance and Kraken cover wallet apps or code; the rest cover websites, APIs and apps.

Sources

Test your exchange before researchers do

Guardian pentests the flows that authenticate users, authorize actions and approve withdrawals.

Talk to Guardian Explore fintech security