Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Exodus bug bounty programs

exodus.com Updated

Exodus runs one public program: a HackerOne bug bounty paying up to $20,000.

Top reward
$20,000
HackerOne
Programs
1
1 pays cash
Targets in scope
28
7 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Exodus runs.

  • Exodus

    HackerOne · Bug bounty

    Open

    Top reward

    $20k
    Critical
    $20k
    High
    $10k
    Medium
    $5,000
    Low
    $2,500
    Safe harbor
    Full
    First response
    18 hours average

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

28 targets. 32 excluded.

  • *.a.exodus.io

    Wildcards High

  • *.exodus.com

    Wildcards High

  • *.exodus.io

    Wildcards High

  • agents.exodus.com

    Web No bounty

  • ctr.a.exodus.io

    Web Critical

  • fiat-p.a.exodus.io

    Web Critical

  • fiat-prod-fallback.a.exodus.io

    Web Critical

  • fiat.a.exodus.io

    Web Critical

  • kyc.a.exodus.io

    Web Critical

  • login.exodus.com

    Web Critical

  • nexotrack-p.exodus.io

    Web Critical

  • nexotrack.exodus.io

    Web Critical

  • pay-admin.exodus.io

    Web Critical

  • pay.exodus.io

    Web Critical

  • turing.exodus.io

    Web Critical

  • https://play.google.com/store/apps/details?id=exodusmovement.exodus&hl=en_IN

    Android Critical

  • exodus-movement.exodus

    iOS Critical

  • https://apps.apple.com/us/app/exodus-crypto-bitcoin-wallet/id1414384820

    iOS Critical

  • https://github.com/ExodusOSS/bytes

    Source code Critical

  • https://github.com/ExodusOSS/crypto

    Source code Critical

  • https://github.com/ExodusOSS/hydra

    Source code Critical

  • https://www.npmjs.com/package/@exodus/errors

    Source code Critical

  • https://www.npmjs.com/package/@exodus/keychain

    Source code Critical

  • https://www.npmjs.com/package/@exodus/safe-string

    Source code Critical

  • https://www.npmjs.com/package/@exodus/sentry-client

    Source code Critical

No target matches. Try part of a host name, such as the company name.

Out of scope 32

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.atp-exodus.com

  • get.exodus.*

  • *.grateful.me

  • www.exodus.com/job-application/*

  • api-p.xoswap.com

  • api.passkeys.network

  • api.xoswap.com

  • dashboard-p.xoswap.com

  • dashboard.xoswap.com

  • embedded.passkeys.foundation

  • exchange-p.exodus.io

  • exchange-server-p.exodus.io

  • exodusstore.blob.core.windows.net

  • http://exchange-server.exodus.io

  • http://exodus.com/keybase.txt

  • http://www.exodus.com/contact-support

  • https://exodus.atlassian.net

  • my.passkeys.network

  • passkeys.foundation

  • relay.passkeys.foundation

  • safeguard.a.exodus.io

  • slack-invite.exodus.com

  • support-helpers.a.exodus.io

  • support.exodus.com

  • wallet.passkeys.foundation

  • xoswap-graphql-p.a.exodus.io

  • xoswap-graphql.a.exodus.io

  • https://play.google.com/store/apps/details?id=com.exodus.grateful

  • https://apps.apple.com/us/app/grateful-by-exodus/id6754093889

  • Exodus Browser Extension

  • Exodus Mobile App Browser and Wallet Connect

  • Passkey Wallet

Recent changes

Reward and scope changes across every Exodus program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Exodus products, from the NVD.

Search NVD
  • CVE-2020-28269 Critical

    Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

About this page

This page gathers every public program listed under exodus.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.