Immunefi is the leading security platform for blockchains. Over $180B of user funds protected across 650+ protocols.
Get full onchain protection ➡️
- Tweets 10,774
- Following 661
- Followers 75,374
- Likes 6,440
Immunefi is the security infrastructure layer of crypto.
We protect 70% of all DeFi TVL today.
Our track record:
- We work with virtually every major DeFi project: Aave, Arbitrum, Optimism, Sei, LayerZero, Ethena, Jito, ENS, The Graph, and so many more
- Multiple $10M+ bounty payouts, the largest in internet history
- $25 billion+ in losses prevented, calculated based on the severity and exploitability of vulnerabilities disclosed
- $125m in payouts to security researchers
- 80% of customers have received valid critical vulnerability disclosures via the platform
- Thousands of valid vulnerability reports processed, creating the industry's most comprehensive dataset of real exploits
The Immunefi token ($IMU) is the central value creation asset powering the entire Immunefi ecosystem, so that it can grow to protect all onchain value.
And it will.
Join us.
118
127
429
91,183
🚨 New Bug Bounty Alert! 🚨
@paxoslabs has launched a $500K Bug Bounty Program on @Immunefi.
Help secure Transit, a stablecoin conversion protocol for swaps on the same chain or across chains, and PAXGy, tokenized gold that grows in gold terms.
Start hunting: immunefi.com/bug-bounty/paxo…
1
3
58
2,360
Immunefi retweeted
AI changed bug bounty in about a year.
Agents now read more code than any of us could, and they find more bugs, faster. It also turned hunting into a race to be first: more reports, more duplicates, more slop, and a lot of good researchers burning out.
At @immunefi , we're building Immunefi Studio so every hunt counts in this new world: better information, better tools, and more of researchers' work turning into valid findings.
This week I'll share why we built it, when it opens, and what it's already doing for the researchers using it.
All week, @vidrepar , @joxegr and @yassine3eth show what's inside, one post a day each on the tools they build.
2
5
17
576
A lot of finding bugs comes down to noticing changes first.
A proxy upgraded 25 days ago. 541 lines removed from a node client yesterday. A program editing its overview and scope.
Studio home now shows all of it next to the programs you watch and the work you have open.
1
2
16
1,860
On Aug 30, an attacker pumped a thinly traded governance token on Cronos, posted it as collateral, and borrowed $120.4M from Tectonic, the chain’s largest lending protocol.
It took 11 minutes.
The attacker manipulated both the token’s market price and its collateral value. Tectonic treated that inflated value as real and allowed the attacker to borrow $120.4 million across nine lending markets.
Cronos halted the chain and rewound 10,961 blocks, almost two hours of history, to reverse it. $9.19M had already left and is still unrecovered.
Most protocols don’t have a chain that can rewind. For them, the fix has to come before the borrow.
And this wasn’t a one-off. @trmlabs counted 32 price manipulation attacks in 2026 through early September. All of 2025 had 12. Price manipulation now accounts for roughly 1 in 8 crypto hacks, up from 1 in 17 in 2022.
Researchers are finding the same bug class before attackers do:
✦ 16 price and oracle manipulation reports have been paid/confirmed on @immunefi so far in 2026, already matching all of 2025.
✦ Since 2022, there have been 60 of these reports. 49 of them were critical or high. 26 were critical.
✦ That’s more than 8 in 10 at the top two severity levels.
Price and oracle manipulation bugs rank that high because they make a protocol believe something false about value. Every borrow and liquidation then acts on that wrong number. No phishing, no stolen key and no insider is needed.
When a researcher finds one first, they’ve found the path an attacker would use to drain the protocol, before anyone uses it.
The attacks are getting more frequent but so are the catches.
3
4
31
1,818
Crypto hacks more than doubled in a year: 207 in the first half of 2026, up from 83 in the first half of 2025.
Here’s what @MitchellAmador, CEO of @Immunefi, told @davidgokhshtein about why:
“It’s not, ‘Are they taking AI seriously?’… They’re not taking security seriously.
I can’t tell you how many teams I’ve talked to, including wallet teams, who are running their audits now through just AI, thinking that’s going to work, which is a joke. That doesn’t work at all. For one thing, the best capabilities are hidden from you…
People are telling themselves this lie so that they can spend less money… And so they’re getting destroyed over and over and over again.
We’re going into a world where it has never been easier to create hardened and safe code. But you have to put in the effort. And instead, people are learning exactly the opposite lesson.
Guess who’s learning that lesson real well? Attackers are learning that lesson real well. They’re on the frontier. They’re paying attention.
This AI is the beginning of a truly limitless era for on-chain applications. But guess what? It needs to start and end with security, and most of these guys aren’t doing that.”
Attackers probe your code every day, so your defense has to as well.
That’s what @Immunefi’s bug bounties and audit competitions do. In August alone:
✦ 424 valid vulnerability reports, up from 154 a year earlier, our biggest month on record
✦ 126 confirmed criticals, up from 14
✦ Researcher base up 55% year over year
Launching something with user funds at stake? Reach out.
2
8
38
2,500
Security researcher @iguardz just earned $20,000 for a Critical Smart Contract bug.
They joined in late April. In under six months they’ve earned $33,292 across 6 reports, and 2 of those were Critical.
This bug is one of the 40+ critical bugs confirmed through @immunefi every single month.
3
7
136
4,694
For every critical vulnerability exploited onchain, roughly four were caught and fixed first.
Attackers got to about 320 of them first, draining roughly $6.75 billion. Every one was a code-level vulnerability.
Security researchers got to about 1,238 first. They disclosed them through bug bounties, about 92% of them through @Immunefi, and each was patched before any funds were lost.
That’s the advantage of a crowd. Over 100,000 researchers are registered on Immunefi, and the best of them find what audits and internal teams miss.
The economics are lopsided. From 2021 to early 2026, the mean payout for a critical bug was $114k. The median hack in 2024–25 cost $2.2 million.
The risk also persists long after launch. 93.9% of bug bounty programs running five years or more have surfaced at least one critical vulnerability.
An audit is a snapshot of your code at one moment. A bug bounty keeps researchers looking for as long as your code is live.
The question isn’t whether your code has a critical vulnerability. It’s who finds it first.
Full report: mitchellamador.com/p/93-of-c…
4
8
52
3,478
2 new assets were added to @enzymefinance's scope
They are offering up to $200k for finding bugs in their code
Start hunting: immunefi.com/bug-bounty/enzy…
4
45
5,170
🚨 @Lombard_Finance just DOUBLED its max bounty from $250k to $500k.
If you find a critical bug, you can now earn up to $500,000.
The program has been running since 2024. They pay researchers, and they resolve reports fast.
A team that pays, moves fast, and then doubles the reward cares about security.
They have 52 assets in scope. Start hunting: immunefi.com/bug-bounty/lomb…
1
13
164
7,389
Immunefi retweeted
Lombard has doubled its bug bounty on @immunefi. Critical smart contract vulnerabilities are now eligible for up to $500,000.
Grateful to every researcher helping make onchain Bitcoin more secure.
6
1
38
3,602
Security researcher @alexfilippov314 just earned $25,000 for finding a High severity Blockchain/DLT vulnerability on @Immunefi.
He's ranked #57 all-time, with over $394K earned across 17 paid reports since joining in May 2025.
Blockchain/DLT is also growing on Immunefi. Its share of total payouts has risen from 40% in 2025 to 44% in 2026 so far, an 11% relative increase.
Congrats, @alexfilippov314!
6
10
170
7,121
$15,000 for a Critical smart contract bug.
@SagaKrypto got paid for a Critical smart contract vulnerability, for a total of 14 confirmed and paid reports.
@SagaKrypto has been finding bugs since 2022 and has now earned more than $234K 🔥
They’re 88th all time, 24th this year and 4th over the last 90 days on the @Immunefi leaderboard. The closer you look at recent results, the higher @SagaKrypto ranks.
Congrats!
1
5
109
4,156
Immunefi retweeted
1,000 studio reviews done!
Studio Review is still in beta. There is much more to do, and we are on it. Excited for what is coming.
1
6
14
772
The Ledger/CryptoBilis incident involved unauthorized hardware implants in wallets.
A hidden implant found in Ledger devices sold by reseller CryptoBilis read the recovery phrases off the screens during setup and transmitted them over LTE via an eSIM, without modifying the secure elements.
Researcher estimated losses exceed $93M across hundreds of wallets.
This is a reminder that security isn’t just about smart contracts and code audits. It includes distribution, manufacturing, and physical integrity.
That's why security needs multiple layers of defense.
At Immunefi, we help secure one critical part of that defense by giving security researchers a way to find and report vulnerabilities in live crypto systems before attackers exploit them.
Crypto gets safer when every layer is treated as an attack surface.
9
8
32
3,073
Full report: coindesk.com/tech/2026/10/13…
Read about defense-in-depth: mitchellamador.com/p/the-sec…
1
5
682
2 new assets were added to @twynexyz's scope
They are offering up to $50k for finding bugs in their code
Start hunting: immunefi.com/bug-bounty/twyn…
7
29
3,055