Immunefi

Immunefi is a bug bounty platform for crypto. Protocols post a reward for anyone who finds a serious flaw in their code. Security researchers, called whitehats, hunt for those flaws and report them in private. Immunefi checks each report and makes sure the researcher gets paid. It is the largest platform of its kind: in October 2026 it claimed more than $140 million paid out. It is not built on Solana. It serves many chains, and its IMU token lives on Ethereum. It matters here because Solana teams such as Orca, Marinade and Wormhole run their bug bounties on it.

How Immunefi bug bounties work

A protocol publishes a program: which contracts or systems are in scope, and the reward for each severity level (critical, high, medium, low). Severity follows Immunefi's own classification, which ranks a bug by real-world impact, such as stolen funds, frozen funds or a network shutdown, not by how clever it is.

Researchers test on local forks only. Program rules on Immunefi forbid testing against mainnet or public testnets. They submit a report with a proof of concept, a working demonstration of the bug. Immunefi's managed triage filters out invalid reports before the project sees them. The project then confirms the bug and pays. Many programs pay critical bugs as a share of the funds at risk, often 10% up to the program cap. Many also require KYC (identity checks) before payout.

Projects can lock bounty money in an Immunefi Vault, so researchers can see the funds exist before they start work. When a project and a researcher disagree, Immunefi mediates. Since January 2025 projects can also opt in to Immunefi Arbitration. It is run with the London Chamber of Arbitration and Mediation, and its rulings are legally binding. Fees start at £7,500. In 2022 The Block reported that Immunefi takes a 10% commission on bounty payouts. Check current terms with the company.

Immunefi bug bounty programs on Solana

Solana bounties on Immunefi cover the code that runs on-chain, and most pay in Solana tokens. These program pages were live on October 14, 2026:

• Orca ORCA$1.65-2.1%: up to $500,000, live since May 2022 and last updated August 2026. It covers the Whirlpools concentrated-liquidity AMM. Payouts are in USDC or ORCA on Solana, with no KYC. Payouts over $250,000 vest monthly over 12 months.
• Marinade MNDE$0.025+0.1%: up to $250,000, live since December 2021. It covers the liquid staking contracts and pays in mSOL and MNDE.
• Wormhole W$0.012+3.9%: up to $1,000,000, paid in W tokens. It covers the cross-chain messaging protocol's contracts, guardian nodes and chain integrations, including Solana. Wormhole also paid the platform's best-known award: $10 million in 2022 for a critical bridge bug.

Two bigger Solana programs need a check. Kamino Finance KMNO$0.042+0.5% opened a $1.5 million program in October 2025. It covers Kamino's lending, vault, oracle and farms code. Jito JTO$0.426+1.1% Foundation launched a $250,000 program in September 2024, paid in JTO. It covers the Jito validator client, relayer, programs and Stakenet. Both program pages returned "not found" when we checked on October 14, 2026. Immunefi's IronScore site still lists Kamino at $1.5 million. Confirm a program is live before you start hunting.

Not every Solana bounty runs through Immunefi. Anza ran its Alpenglow consensus bug bounty in August 2026 on its own site, and charged 0.5 SOL per report. Solana security firms such as Asymmetric Research also publish their own reviews of Solana DeFi.

Immunefi audit competitions and attackathons

An audit competition is a time-limited contest. Many researchers review the same codebase at once, and the reward pool is split by findings. Attackathons are a larger version, often run with an ecosystem fund. The format finds bugs that a single audit firm can miss. The full report for the ENS audit competition, published in October 2026, says 43 researchers each found at least one unique issue, and 23 of the bugs were critical.

The competition market got smaller in 2026. Code4rena, the best-known rival for competitive audits, began winding down in May 2026. Immunefi offered to move its bounty clients and researchers onto its own platform.

Immunefi Magnus, Safe Harbor and IronScore

Magnus is Immunefi's security operations suite, launched in February 2025. It brings bug bounties, audits, pull-request reviews, onchain monitoring and firewall tools into one dashboard. An AI layer is trained on Immunefi's archive of past bug reports and exploits.

Safe Harbor is often misunderstood. It is not a disclosure policy. It is a legal framework, built on the Security Alliance (SEAL) agreement, for the minutes when a protocol is already being drained. Projects that adopt it let whitehats rescue funds during a live attack and send them to a protocol-controlled vault for a pre-agreed reward. Immunefi's own program requires the funds to be returned within six hours. It warns that it "cannot guarantee you any degree of immunity from criminal prosecution."

IronScore is a public security rating for protocols. It scores protocols from 0 to 100 across five weighted areas: bounty coverage, response times, money committed, track record and how fresh the scope is. Users can also scan a wallet's DeFi positions against those scores. The ratings are built from Immunefi's own platform data, so they favour protocols that run programs there.

Immunefi track record: payouts and the biggest bug bounties

Immunefi's two official pages disagreed in October 2026. The homepage claims $140M+ paid, $25B+ in hacks prevented and $180B+ in assets protected. The About page still shows $116M+ paid, 60,000+ researchers and $190B+ protected. Treat the figures as company claims that grow over time.

Some milestones are easier to check:

• The two most-cited payouts: $10 million for Wormhole and $6 million for Aurora, both in 2022.
• In October 2026 Immunefi said on X that it had passed 10,000 paid vulnerability reports, and that 29 single bugs have paid $1 million or more.
• Its research says 93.9% of programs running five years or more have surfaced a confirmed critical bug. The homepage claims that 93% of crypto's critical vulnerability disclosures come through Immunefi. That figure is a company claim with no independent check.

Is Immunefi legit, and who is it for?

Yes, Immunefi is a real business with a long payout record. The better question is whether it fits you.

• Security researchers with Rust and Anchor skills can earn real money hunting Solana programs, at the Orca, Marinade and Wormhole caps. The constraints: many programs require KYC, out-of-scope rules are strict, and the project, not Immunefi, makes the first call on severity.
• Solana protocol teams with meaningful TVL get a ready researcher pool, triage, vaults and Safe Harbor. For a small team that cannot fund a six-figure critical tier, the platform does little: researchers go where the caps are.
• IMU holders get exposure to the platform's incentive layer, not a share of its revenue. See the token section below.

Is Immunefi safe? Risks for researchers and protocols

• Payout disputes. Bounty size is a maximum, not a promise. In November 2024 Immunefi suspended Trust Security for 90 days. The firm had publicly disputed a ruling that its critical finding was out of scope. Arbitration now exists, but projects must opt in, and fees start at £7,500. Immunefi itself warned in October 2026 about "ghost bounties" across the industry: programs that advertise large maximums and rarely pay.
• Program status changes. Programs pause, shrink or disappear. The Kamino and Jito pages show this: both returned "not found" in October 2026. Check a program's "last updated" date before investing time.
• Legal exposure in Safe Harbor. Rescuing funds during a live exploit carries legal and technical risk, which Immunefi says plainly.
• Custody. Immunefi holds no user deposits. Bounty funds sit in vaults funded by each project. Immunefi deploys no Solana programs of its own, and Solana Compass lists no program addresses for it, so there is no Solana upgrade authority to check here.
• Token risk. IMU's public sale priced it more than 70% below the last private round. Team and early backers hold 42.5% of supply on multi-year vesting, so future unlocks add supply.

Immunefi vs HackerOne, Code4rena, Cantina and Sherlock

Immunefi is the biggest bounty market built only for crypto. Each rival wins on narrower ground:

• HackerOne is the general-purpose bug bounty platform. It suits exchanges and companies whose risk sits mostly in Web2 systems; Crypto.com runs its program there.
• Sherlock, Cantina and HackenProof compete for both audit contests and bounties. A protocol choosing between them should compare triage quality, payout speed and the researcher pool for its chain, not the headline caps.
• Code4rena was the reference platform for competitive audits until it began closing in May 2026.
• Solana-native routes: core teams like Anza have run bounties on their own infrastructure, and many Solana protocols hire specialist audit firms directly.

IMU token: tokenomics, Hacker Pledging and listings

IMU launched on January 22, 2026, after a CoinList public sale on November 12-19, 2025. The sale raised about $5 million at $0.01337 per token, roughly a $133 million fully diluted valuation. Supply is fixed at 10 billion IMU:

• 47.5% ecosystem and community
• 26.5% team and contributors
• 16% early supporters
• 10% reserve

Only the public-sale tokens unlocked at launch. Within days, IMU traded on Coinbase, KuCoin, Bybit, Bitget, Crypto.com, Gate and MEXC, among others.

IMU's main use is Hacker Pledging. Holders pledge IMU behind researchers they back. When a backed researcher earns a bounty, the researcher and their backers share bonus IMU rewards, split 50/50. Season 1 closed on March 9, 2026, with 14.3 million IMU pledged. Season 2 offered a 4.5 million IMU bonus pool and ran until July 7, 2026. IMU is also described as a governance token for platform standards. Holders do not receive bounty fees.

Immunefi team, funding and history

Immunefi was founded in 2020 and is led by CEO Mitchell Amador. The Block described it as Singapore-based in 2022. It raised a $5.5 million seed round, then a $24 million Series A in September 2022 led by Framework Ventures, with Electric Capital, Polygon Ventures and Samsung Next taking part.

The All Stars program for elite whitehats followed in 2025. In March 2026, Anchorage Digital bought IMU and chose Immunefi to secure Porto, its self-custody wallet for institutions. In May 2026 Immunefi moved to take on Code4rena's bounty clients and researchers.