Immunefi Returns Fees to 700+ Bug Hunters
A new credits system refunds submission fees on valid reports closed as duplicates or private known issues.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust large companies to fairly reward people who find problems with their products?
Immunefi has launched a credits system that returns submission fees on valid bug reports to more than 700 security researchers. The program covers hunters whose findings were closed as duplicates or private known issues.
Why it matters
The policy responds to complaints from researchers who paid to report real vulnerabilities that others had already found or that protocols already knew about. For the bug bounty ecosystem, it changes the financial risk of submitting reports in a crowded field.
Credits are applied automatically to researcher accounts, with one credit equal to $1 payable in USDC and expiring 12 months after entry. Credit checks currently run every two weeks, and Immunefi plans to automate them.
The players
Immunefi
Immunefi is a crypto bug bounty platform that connects blockchain projects with security researchers who report vulnerabilities.
The details
Researchers receive credits equal to the submission fee on valid reports closed as duplicates or private known issues, with no separate claim required. Eligibility reaches back to March 24 for bug bounties and April 10 for audit competitions, and purchased or earned credits can be spent within a year.
Timeline
March 24: Eligibility start date for bug bounty submissions.
April 10: Eligibility start date for audit competition submissions.
November 2: Credits system announced and the Plether audit competition opened.
12 months after credit entry: Purchased and earned credits expire.
The Tech Race
The credits system is a platform-level response to the competitive crowding of crypto bug bounties, where many researchers often find the same flaw. It positions Immunefi to retain researchers in a market where participation depends on the expected return on each submission.
Security researchers who submit reports that are closed as duplicates or private known issues can now recover the submission fee, reducing the financial risk of reporting. Researchers do not need to file a claim, since credits are applied automatically to eligible accounts.
The takeaway
Researchers weighing whether to submit a bug report can now factor in recovered fees for valid but duplicate findings. Checking credit balances before the 12-month expiration window closes will help avoid losing earned value.
What happens next
Immunefi plans to automate its biweekly credit checks, and purchased or earned credits will begin expiring 12 months after they enter researcher accounts.
Further reading
For related coverage, see Cybersecurity news on how bug bounty programs handle vulnerability reporting.
Source note: This article includes information reported by Crypto.
Live Poll
Do you trust large companies to fairly reward people who find problems with their products?
