Immunefi Refunds Bug Hunters' Duplicate Report Fees
The credits cover valid reports closed as duplicates or private known issues, a change that applies to blockchain bug bounties now.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust large companies to fairly reward people who find problems with their products?
Immunefi, a crypto bug-bounty platform, launched a credits system that returns submission fees on valid bug reports to more than 700 researchers. The program covers reports closed as duplicates or private known issues, and the change is in effect now rather than a future product.
Why it matters
Bug hunters had paid fees to report real vulnerabilities that others had already found or that protocols already knew about, and the credits address that complaint. Immunefi also says unique valid findings doubled from January through September, suggesting the platform is trying to keep skilled researchers engaged.
The figures come from Immunefi's own program data: credits are valued at $1 each and expire 12 months after entering an account. Unique valid findings doubled between January and September, but the source does not report how many of those reports were refunded under the new policy.
The players
Immunefi
A crypto security platform that runs bug bounty programs and audit competitions for blockchain protocols.
The details
Researchers who submit a valid report that is closed as a duplicate or as a private known issue receive a credit equal to the submission fee. Credits are applied automatically to researcher accounts, so no claim or separate application is needed. Credits can also be bought with USDC, a dollar-pegged stablecoin, at $1 per credit.
Timeline
Eligibility for bug bounty submissions reaches back to March 24.
Eligibility for audit competition submissions reaches back to April 10.
The credits system and the Plether audit competition were announced on November 2, 2026.
Purchased and earned credits expire 12 months after entering an account.
The Tech Race
Immunefi's program is one of several platforms competing to attract security researchers to audit blockchain code, and the credits policy is a response to researcher complaints about paid duplicate reports. The Plether audit competition, which runs on Arbitrum and is being tested on Arbitrum Sepolia, shows the platform is expanding its competitions alongside the refund policy.
Security researchers who file valid reports that are closed as duplicates or private known issues now receive automatic credits equal to their submission fee, usable toward future reports or purchases. Credits expire 12 months after they enter an account, and eligibility reaches back to March 24 for bug bounties and April 10 for audit competitions.
The takeaway
Watch whether Immunefi's automated credit checks, planned but not yet dated, change how quickly researchers see refunds. The Plether audit competition's $80,000 pool and its results will show whether the program keeps attracting high-volume reporting.
What happens next
Immunefi plans to automate credit checks, which currently run every two weeks, though the source gives no date for that change.
Further reading
For context on how researchers find and report flaws in blockchain code, see Cybersecurity.
Source note: This article includes information reported by Crypto.
Live Poll
Do you trust large companies to fairly reward people who find problems with their products?
