Expected value for bug bounty work is one line of arithmetic: expected value = p × payout − cost. Every essay ranking for this query argues about the average hunter. The average is useless because payouts are not averaged, they are drawn from a skewed table. You do not earn the mean payout. You earn the payout of the one severity class you can actually hit, on the one program you decide to attack.
So the honest input is not an average. It is a percentile from the live payout table. On 2026-10-01, across the 225 active programs on Immunefi, the 190 live critical-severity reward rows paid out a median of $100,000, a 25th percentile of $50,000, a 75th percentile of $500,000, and a 90th percentile of $1,000,000. The largest active ceiling is $15,000,000 (LayerZero). Every one of those figures was fetched from Immunefi's public bounty API at page build time and is re-stated with its fetch date, not typed from memory.
All inputs are yours. The site asserts nothing about your probability of success.
Expected value: $
ROI on cost:
Breakeven probability (EV = 0):
EV = p × payout − cost
= 0.05 × $100,000 − $4,000
= $5,000 − $4,000
= $1,000
ROI = EV ÷ cost
= $1,000 ÷ $4,000
= 0.25 → +25%
BEP = cost ÷ payout
= $4,000 ÷ $100,000
= 0.04 → you need p ≥ 4% to clear zero
The breakeven probability is the number most essays skip. It converts a payout table into a decision rule: if your honest estimate of p sits below cost ÷ payout, the campaign is negative before you write a single line of test scaffolding.
The year-to-date loss figure is not a decoration. Each dollar lost to an exploit is a bug class that reached production, which means either nobody was looking or nobody paid for looking. On 2026-10-01, DeFiLlama's hack database put the year-to-date total at $2.24B across 2026, with the largest single classification being key compromise at roughly $704M, ahead of bridge and cross-chain attacks. Key compromise is an operational-security bug class that most smart-contract bounty tables barely cover, which is one reason bounty economics and loss statistics do not map onto each other one to one.
For a hunter, the mapping question is direct: does the program you target even pay for the bug class you can find? A critical row that covers access-control flaws will not pay out on a frontend key leak. Read the impacts list, not the headline number.
Where these numbers come from. Program count, activity status, and every payout figure come from Immunefi's public bounty API, fetched at page build time on 2026-10-01 (235 programs listed, 225 not paused). Percentiles were computed over the 190 live critical-severity reward rows with a positive max payout across active programs. Loss figures come from DeFiLlama's public hack database, same fetch date, largest-classification totals computed from its rows. Every displayed number links to its source inline. The calculator runs entirely in your browser on your own inputs; nothing you type leaves the page.
Payout tables change. A percentile computed today will drift as programs launch, pause, or re-tier their reward tables. Treat the fetch date as part of each number.
It is positive exactly when your honest p clears cost ÷ payout. The distribution data narrows the guesswork on the payout side (median $100k, p75 $500k across active programs as of 2026-10-01), but p remains yours to estimate from your own track record. Nobody can hand you a credible p, and anyone who does is selling something.
Because the table is skewed by a few nine-figure ceilings. A mean across 190 rows mixes LayerZero's $15M with hundreds of $50k rows and produces a number no single program actually pays. Percentiles describe where you would land in the table, which is the quantity your decision actually turns on.
Not automatically. The $2.24B lost in 2026 concentrated in classes like key compromise that many smart-contract programs do not scope. Loss statistics signal where bugs exist; bounty tables signal what gets paid. Read both, then check whether your target program's impacts list covers the class you can find.
Program tables drift continuously, so recompute the payout percentile against the live bounty API each time you cost a new campaign. The figures on this page carry their fetch date for exactly that reason.
Past campaign results do not predict future bounty payouts. Expected value estimates assume probability-weighted outcomes and actual payouts may be zero. Program count, payout percentiles, and loss figures were fetched 2026-10-01 and will drift. This site documents one independent researcher's experience and does not constitute financial or security advice.