Wormhole Bug Bounty
Immunefi · up to $1,000,000
Bug bountyKYC required
Wormhole pays up to $1,000,000 for valid security vulnerabilities through its bug bounty on Immunefi. In scope: smart contract, blockchain/dlt. Payouts require KYC.
What is in scope
- Smart Contract
- Blockchain/DLT
Facts from Immunefi's public program data, program last updated Sep 29, 2026. The full scope, severity table and rules are on the official program page.
Risk warnings
- Test only as the program's rules allow (usually local forks or testnets). Exploiting a live system is illegal and voids any reward.
- Report privately through the official platform. Do not disclose the bug publicly before it is fixed and you are permitted to.
- Reward amounts are maximums; the program decides the payout based on severity and impact.