Bug Bounty

Immunefi refunds bug report fees to 700+ hunters as AI floods triage

Immunefi now credits back submission fees on valid duplicate and private known-issue reports. What it means for UK bounty and VDP owners.

Illustration of a bug icon with the headline: Bounty platform refunds fees on duplicate bugs

Web3 bug bounty platform Immunefi has started handing back submission fees, as platform credits, to researchers whose valid reports were closed as duplicates or as issues the project already knew about privately. The change is a sign of how AI-assisted reporting is changing the economics of crowdsourced security, and UK programme owners should be watching.

What happened

On 2 November 2026 Immunefi launched Immunefi Credits. The scheme pays researchers back the submission fee on any valid report they paid to file, and it also covers reports that were closed as duplicates of someone else’s valid finding or matched against a private known issue. The platform says more than 700 researchers had credits on their accounts on launch day, applied automatically without any claim process.

Each credit is worth $1, can be bought with USDC, and now pays for submissions, mediation and account verification on the platform. They expire 12 months after being added, cannot be transferred or cashed out, and never replace a bounty. A researcher with a valid finding gets the normal reward plus credits equal to the fee they paid.

The credits are backdated to when fees began, which Immunefi gives as 24 March for bug bounties and 10 April for audit competitions. Immunefi summed up the problem it is fixing in one line: “You found a valid bug, and someone else reported it first.” According to crypto.news, researchers welcomed the change in public replies.

Immunefi’s move tackles the other half of pay-to-submit: what happens to the fee when the work is good.

How it works

The rules try to define which costs the researcher should carry and which belong to the platform or the project.

  • Credited: the researcher’s own valid finding once paid or confirmed; duplicates of a valid report filed by someone else, regardless of how many hunters reached it; matches against an issue the project had registered privately, duplicates included; and any mediation decided in the researcher’s favour, which also refunds the mediation fee.
  • Not credited: invalid or out-of-scope work, rule breaches, copies of a report that was itself rejected; resubmissions of the researcher’s own finding; and public known issues, such as bugs already on GitHub or in a published audit.
  • Burden of proof on known issues: any closure as a known issue has to cite either when the project logged it or where it was published. Without either, the issue is treated as private and the fee is credited. A fee is also credited if the project registered the issue after the researcher submitted.
  • Verification fee: this can also be credited once the researcher has a valid report after verifying and an accuracy of at least 25%. Verification stays free through Human Passport.

For now credits are checked every two weeks, so a balance can take up to a fortnight to appear. Immunefi says it is automating the checks. It says the scheme needed new tooling, including duplicate labelling since April and private known-issue tracking since July.

Behind all this is volume. Immunefi reports that distinct valid findings doubled over January to September while total submissions grew faster still, and it puts that down to AI tools speeding up both bug finding and report writing. Its September ecosystem update describes a recent audit competition in which one high-severity flaw attracted 24 duplicates. It says the fee pays for triaging every report and expects fees to fall as triage improves.

Checklist of which bug reports earn Immunefi Credits: valid findings, valid duplicates, private known issues and mediation wins, with invalid and public known issues excluded

Why it matters for UK organisations

Immunefi is a crypto platform, but the pressure it describes is the same for every programme. HackerOne chief executive Kara Sprague told Help Net Security this week that since January 2025, submissions to bug bounty platforms are up 2.8 times against 1.9 times for valid reports. Valid findings are at a record high but make up a shrinking share of what arrives. Google Cloud said much the same when it announced its new top reward tier last week: valid reports have remained stable for 18 months while total submissions have grown tremendously.

For a UK organisation running a bounty or vulnerability disclosure programme, the key word is triage. Every rejected, duplicated or out-of-scope report still takes analyst time, and most UK VDPs pay nothing at all, so they have no fee or reward lever to steer behaviour. The obvious responses are submission caps, reputation gates and pay-to-submit. Each cuts noise but also risks deterring the lone researcher with a real finding, who in the UK still works under the Computer Misuse Act 1990.

Immunefi’s rules are a useful pattern to borrow: penalise behaviour the researcher controls, such as invalid, out-of-scope or already-public reports, and do not penalise them for information they could not have seen. A researcher cannot know that a project has a private record of the same bug. If your programme closes reports as “known” without evidence, you are quietly passing your own disclosure debt on to the people trying to help you.

Expert view

In my experience the duplicate is the most corrosive outcome in any bounty programme. A researcher who gets a flat “informative” or “duplicate” with no reference to the original report concludes, often wrongly, that the programme is cheating them, and good hunters move on quietly. Immunefi’s demand that every known-issue closure cites evidence is the most important line in the announcement. It is a transparency rule disguised as a refund.

Two cautions: credits are not cash and they expire, so this mainly helps regular participants, and fee amounts have not been published. More broadly, the weak point in most disclosure processes is not the policy page but the lack of any record of what the organisation already knew, and when.

What to do now

  1. Keep a dated register of known issues. Log internally found or previously reported vulnerabilities with a timestamp, so that every “duplicate” or “known” closure can point to evidence. This also feeds the security update management discipline that Cyber Essentials expects.
  2. Tell researchers why a report was closed. Reference the original report or registration date where you can, even if you have to redact detail.
  3. Set out your AI report policy. State that automated or AI-assisted findings are welcome only with a working reproduction and a clear statement of impact on an in-scope asset.
  4. Use reputation, not cost, to throttle a free VDP. Track-record-based limits or private tiers keep the front door open for first-time reporters.
  5. Budget for triage. If submissions grow faster than valid reports, as every platform now says they do, plan for analyst hours or a managed triage service before the queue becomes a liability.

Bottom line

Immunefi has accepted that, in the AI era, a researcher who finds a real bug second should not pay for the privilege. UK programme owners do not need to copy the fee model, but they should copy the principle: be open about what you already knew, and carry the cost of your own private backlog yourself rather than passing it to the people who report bugs to you.

Sources

Related Posts