Coinbase bug bounty programs
coinbase.com Updated
Coinbase runs three public programs: a self-hosted bug bounty paying up to $1,000,000, a Sorona bug bounty paying up to $16,001 and a HackerOne bug bounty paying up to $15,000. It also owns Base, which runs one more program.
- Top reward
- $5,000,000
- Base, Cantina
- Programs
- 4
- 4 pay cash
- Targets in scope
- 29
- 8 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs Coinbase runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Coinbase
Self-hosted · The company-wide program. Pays up to $1,000,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Coinbase
Self-hosted · Bug bounty |
– | – | – | – | $1,000,000 | Full | – | – | Open |
|
Coinbase cb-mpc
Sorona · Bug bounty |
– | $16k (highest) | – | – | $16,001 | Partial | – | – | Open |
|
Coinbase
HackerOne · Bug bounty |
$15k (highest) | $6,000 | – | – | $15,000 | Full | – | – | Open |
-
- Safe harbor
- Full
-
- Critical
- –
- High
- $16k (highest)
- Medium
- –
- Low
- –
- Safe harbor
- Partial
-
- Critical
- $15k (highest)
- High
- $6,000
- Medium
- –
- Low
- –
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Coinbase owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
29 targets across all 4 programs, each listed once with the programs that cover it. 23 excluded.
-
github.com/coinbase/cb-mpc, which the program carries as a SOURCE_CODE asset, bounty-eligible and rated up to critical severity, and which Coinbase names the primary focus of the whole program. The declaration is the repository, so the library counts in full rather than only the protocols the reward table names
Products and areas
Covered by Sorona
-
https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad
Products and areas Critical
Covered by HackerOne
-
Protocol message handling: encoding, decoding and the round state machine that decides which message a party will accept from another
Products and areas
Covered by Sorona
-
The high-level protocol layer reached through include/cbmpc/api/: threshold signing, distributed key generation and TDH2 threshold decryption. An easily exploitable break here that leads to key compromise is the $50,000 rung
Products and areas
Covered by Sorona
-
The lower-level cryptographic layer beneath it, including zero-knowledge proofs, commitment schemes and the arithmetic they are built on, priced at the Medium rung
Products and areas
Covered by Sorona
-
The rest of the C++ library, covering non-cryptographic code, crashes and deprecated cryptographic code, which the program pays at the Low rung
Products and areas
Covered by Sorona
-
The wider surface Coinbase declares in the same policy: open-source projects at github.com/coinbase and github.com/base, the *.coinbase.com web and API estate, the Coinbase Wallet browser extension and Coinbase WaaS. Of these, only the repositories are open source
Products and areas
Covered by Sorona
-
Web2 products, assets and infrastructure owned by Coinbase
Products and areas
Covered by Self-hosted
No target matches. Try part of a host name, such as the company name.
Out of scope 23
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
status.*.coinbase.com
HackerOne
-
status.coinbase.com
HackerOne
-
https://github.com/coinbase/x402
HackerOne
-
https://github.com/x402-foundation/
HackerOne
-
Ability to abuse existing banking functionality such as ACH or credit card chargebacks
Self-hosted
-
Awards to anyone the program's US sanctions screening blocks, which runs before payment rather than at triage
Sorona
-
Demo applications, sample code under demo-*, and the C API headers under include/cbmpc/c_api/*
Sorona
-
Demo apps, testnet, staging environments, etc.
Self-hosted
-
Deprecated open source libraries
Self-hosted
-
Fully AI-generated or automated submissions with no human validation behind them
Sorona
-
github.com/coinbase/cb-mpc-go, the sibling Go repository, which accepts submissions but is marked bounty-ineligible and pays nothing
Sorona
-
N/A - Not Coinbase owned or operated
HackerOne
-
Non-security-impacting UX issues
Self-hosted
-
Physical security
Self-hosted
-
Proofs of concept that reach the bug through include-internal/ rather than through the public API surface
Sorona
-
Publicly available leaked credentials that have since been rotated
Self-hosted
-
Rate Limiting (non-critical issues)
Self-hosted
-
Rate-limiting issues and default security misconfigurations without a demonstrated loss
Sorona
-
Social engineering
Self-hosted
-
tagomi.com and the other domains the program marks explicitly bounty-ineligible
Sorona
-
The $1,000,000 Extreme tier, which the cb-mpc table marks not applicable to this library, so a key compromise here settles at $50,000
Sorona
-
Username enumeration
Self-hosted
-
Vulnerabilities in third-party applications that integrate with Coinbase
Self-hosted
Recent changes
Reward and scope changes across every Coinbase program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under coinbase.com and the companies Coinbase owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Coinbase.
Something wrong or missing? Report a correction.