This page sets three public numbers side by side. The first is what bug bounty programs offer to pay. The second is what ended contests recorded as earnings. The third is what exploits cost in 2026. All come from two public feeds fetched on 2026-10-10. Each table names its source.
On 2026-10-10 the Immunefi public bounty API returned 232 program records. 62 have an end date in the past and 16 are paused. The other 154 are open. 103 of them carry the project type Defi, 136 list smart contracts as a program type, and 87 require identity checks (KYC).
| Maximum reward | Programs | Share | Median | Sum |
|---|---|---|---|---|
| $10,000,000 or more | 3 | 1.9% | $10,000,000 | $35.0M |
| $1,000,000 to under $10,000,000 | 27 | 17.5% | $1,000,000 | $52.9M |
| $100,000 to under $1,000,000 | 73 | 47.4% | $200,000 | $17.9M |
| $10,000 to under $100,000 | 42 | 27.3% | $45,000 | $1.6M |
| Under $10,000 | 9 | 5.8% | $5,000 | $31,000 |
| All open programs | 154 | 100.0% | $150,000 | $107.5M |
Source: Immunefi public bounty API, fetched 2026-10-10.
The median open program offers a maximum of $150,000. For the 103 programs with the project type Defi the median is $150,000. There are 3 programs at $10,000,000 or more, namely LayerZero ($15,000,000), Stargate ($10,000,000) and Sky ($10,000,000). The maximums of all 154 programs add up to $107,467,597. The 30 programs at $1,000,000 or more hold 81.8% of that sum.
A maximum is the top of a reward table. 136 of the 154 programs publish reward rows in the API. In 134 of those 136, the maximum sits on the critical severity row.
The API holds no payment data for the open programs. It does hold leaderboards for 60 of the 62 ended records. 39 of the 60 are named as audit competitions. Their end dates run from 2023-12-04 to 2026-09-14. One leaderboard row is one researcher in one contest, with the earnings that Immunefi records.
| Earnings per row | Rows | Share of rows | Sum | Share of sum |
|---|---|---|---|---|
| $0 | 172 | 9.3% | $0 | 0.0% |
| $1 to under $100 | 513 | 27.6% | $17,037 | 0.2% |
| $100 to under $1,000 | 583 | 31.4% | $229,910 | 3.2% |
| $1,000 to under $10,000 | 437 | 23.5% | $1,483,677 | 20.7% |
| $10,000 or more | 153 | 8.2% | $5,448,011 | 75.9% |
| All rows | 1,858 | 100.0% | $7,178,635 | 100.0% |
Source: Immunefi public bounty API, fetched 2026-10-10.
The 60 leaderboards hold 1,858 rows and $7,178,635 of earnings. The reward pools of the same contests add up to $9,855,000, so the recorded earnings are 72.8% of the pools. The median row earned $290.50. 172 rows earned nothing. In the median contest the top row took 32.0% of the recorded earnings.
On 2026-10-10 the DeFiLlama hacks feed listed 292 incidents dated in 2026. The latest is dated 2026-10-07. 280 of them carry a loss amount above zero. The amounts add up to $2,243,485,659, or $2.24 billion. Among those 280, the median loss is $500,430.
| Target type | Incidents | Lost | Share |
|---|---|---|---|
| DeFi Protocol | 210 | $1,177.6M | 52.5% |
| Chain | 23 | $432.6M | 19.3% |
| CEX | 2 | $400.7M | 17.9% |
| Wallet | 8 | $142.2M | 6.3% |
| Token | 25 | $43.1M | 1.9% |
| 10 other target types | 24 | $47.2M | 2.1% |
| All targets | 292 | $2,243.5M | 100.0% |
Source: DeFiLlama hacks feed, fetched 2026-10-10.
The feed covers all crypto targets. DeFi protocols were the target in 210 incidents and lost $1,177.6M, which is 52.5% of the total. The largest single loss in the feed is Bitget, a centralized exchange (CEX), at $387,000,000 on 2026-09-24.
| Class | Incidents | Lost | Share |
|---|---|---|---|
| Key Compromise | 31 | $703.8M | 31.4% |
| Bridge & Cross-Chain | 32 | $700.1M | 31.2% |
| Access Control | 53 | $370.2M | 16.5% |
| Token & Share Accounting | 50 | $245.6M | 10.9% |
| Oracle Manipulation | 41 | $73.4M | 3.3% |
| Frontend & Infrastructure | 10 | $43.2M | 1.9% |
| Governance | 8 | $42.9M | 1.9% |
| Protocol Logic | 38 | $25.2M | 1.1% |
| 6 other classes | 29 | $39.1M | 1.7% |
| All classes | 292 | $2,243.5M | 100.0% |
Source: DeFiLlama hacks feed, fetched 2026-10-10.
Key Compromise lost $703.8M in 31 incidents. Bridge & Cross-Chain lost $700.1M in 32 incidents. Access Control has the most incidents, 53.
The sum of all 154 maximum rewards equals 4.8% of the 2026 losses. 16 incidents each lost more than $15,000,000, the largest maximum on offer. Of the 280 incidents with an amount, 197 lost more than $150,000, the median maximum.
Programs also limit what they pay for. 140 of the 154 open programs carry the Immunefi default exclusion for "attacks requiring access to leaked keys/credentials". The other 14 have no default exclusion text in the API. Key Compromise is the largest loss class in the table above. The two feeds use different labels, so read this as a rough match and not as an exact one.
A maximum reward is an offer. It is not a payment. For the 154 open programs the API holds no payment data, so this page gives no payout distribution for them. The contest leaderboards cover ended contests only. They show the researchers that Immunefi lists, and this page cannot tell how many others took part.
The counts depend on the filter. Immunefi's own program list showed 169 programs on 2026-10-10. The filter on this page gives 154. Programs on other platforms are not counted.
The loss amounts are as DeFiLlama records them. They are not reduced by returned funds. The feed records $5,675,416 of returned funds across 8 incidents in 2026. Both feeds change, so read each number as of 2026-10-10.
Program data comes from https://immunefi.com/public-api/bounties.json, fetched 2026-10-10 06:19 UTC. A program counts as open when isPaused is false and endDate is empty or later than the fetch time. The maximum reward is the maxBounty field, in US dollars. The scope count looks for the text "leaked keys/credentials" in defaultOutOfScopeGeneral. Contest earnings come from boostedLeaderboard. The earning of a row is totalEarnings when the row has it and earnings when it does not. The pool is rewardsPool.
Loss data comes from https://api.llama.fi/hacks, fetched at the same time. An incident counts for 2026 when its date is on or after 2026-01-01 00:00 UTC. The loss is the amount field, in US dollars, and an empty amount counts as zero. Groups use the targetType and classification fields. A group under 1.0% of the total goes into the "other" row. Shares are rounded to one decimal, so a column can differ from 100.0% by 0.1.
These tables give the size of the offers, the recorded contest earnings and the losses. They do not give your odds. To work out the expected value of a campaign from your own cost and probability, use the ROI calculator, the payout distribution calculator or the expected value calculation page.
Figures were fetched on 2026-10-10 and will change. A maximum reward is not a payout, and actual payouts may be zero. This site documents one independent researcher's experience and does not constitute financial or security advice.