Coinbase Cuts Bug Bounty Rewards Amid AI-Driven Report Surge

Crypto exchange Coinbase has made significant changes to its HackerOne bug bounty program. Effective July 29, the company removed rewards for low- and medium-severity vulnerabilities. High-severity payouts fell from $15,000 to $6,000, a reduction of 60%. Critical rewards dropped from $50,000 to $15,000, a cut of 70%.

Coinbase attributed these changes to an increase in low-value reports accelerated by artificial intelligence. According to the company, during the first half of this year, 44% of closed reports were duplicates, 37% were informative but not exploitable and 15% were invalid. Just 4% led to payouts.

Coinbase's internal tools can now continuously detect many lower-severity issues. The company wants external researchers to focus on difficult vulnerabilities that require domain expertise and creativity.