Security researcher ily2 has received a $3 million bounty for disclosing a critical smart contract vulnerability through Immunefi, marking one of the largest single web3 security payouts in recent memory. Immunefi, a leading web3 bug bounty platform, publicly announced the payout on X, describing it as a reward for a “critical” severity issue affecting smart contracts, though neither Immunefi nor the affected project have disclosed technical details of the bug or which protocol was involved as of now. According to Immunefi’s public leaderboard and researcher profile, this payment brings ily2’s total earnings on the platform to about $3.03 million from 3 paid reports, placing them among the top-10 all‑time whitehat hackers on Immunefi. Immunefi operates as a specialized bug bounty marketplace for crypto and DeFi projects, connecting web3 protocols with security researchers who report vulnerabilities in exchange for rewards paid in crypto. The platform encourages very high bounties for critical issues—often targeting around 10% of the value at risk—so that projects have incentives to pay large but controlled rewards instead of facing potentially catastrophic exploits. Previous headline bounties facilitated via Immunefi or similar schemes have reached $10 million (for Wormhole) and $6 million (for Aurora), which places the $3 million payment to ily2 in the same tier of high-impact web3 security events, signaling both the likely severity of the undisclosed bug and the amount of user funds that may have been protected by the disclosure. The payout is significant for the broader web3 ecosystem because it underscores a maturing norm of “pay the whitehat, not the hacker”: protocols are increasingly budgeting large, pre-committed rewards to incentivize responsible disclosure rather than post‑incident negotiations with attackers. Immunefi reports that it has facilitated tens of millions of dollars in bug bounties overall and protects a substantial share of the total value locked in crypto, positioning large rewards like this as part of an institutionalized security layer around DeFi and smart contract infrastructure. For security researchers, the case of ily2 illustrates how specialized expertise in smart contract auditing can translate into multi‑million‑dollar earnings via formal bounty programs, rather than via gray‑area exploit activity.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…