Coinbase reduces bug bounty rewards citing AI impact
On July 29, Coinbase revised its HackerOne public bug bounty program by eliminating payouts for low- and medium-severity vulnerabilities. High-severity reward amounts were cut from $15,000 to $6,000 (a 60% reduction), while critical vulnerability rewards dropped from $50,000 to $15,000 (70%). The company attributed the changes to an increase in low-value reports driven by AI tools. Coinbase noted that internal systems now detect many lower-severity issues and wants external researchers to focus on complex vulnerabilities requiring expertise. The adjustments apply only to its Web2 HackerOne program; its Cantina initiative for smart contracts remains unaffected. GitHub also recently adjusted its bug bounty structure, reducing public payouts while maintaining higher rates in an invitation-only tier. Both companies are responding to a shift in the cybersecurity landscape where AI-generated reports and automation have increased report volume but reduced quality. HackerOne's 2025 data shows that valid vulnerability reports involving AI rose by 210% year-over-year, with automated tools excelling at surface-level flaws. However, human insight remains crucial for deeper system vulnerabilities.
Tickers: $COIN