- Top reward
- $20,000
- Top severity paid
- Critical
- Assets in scope
- 28
- Public CVEs
- 1
- Last change
At a glance
What to know before you start testing.
- Pays up to $20,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$20,000 from $5,000 |
| High |
|
$10,000 from $2,500 |
| Medium |
|
$5,000 from $500 |
| Low |
|
$2,500 from $300 |
- Response
-
Within 5 days
First Response | < 5 days
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you.
- Hall of fame
-
Yes
you will be listed in our Hall of Fame
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
28 assets you may test, 32 excluded.
Web 12
- agents.exodus.com Informational No bounty
- ctr.a.exodus.io Critical
- fiat.a.exodus.io Critical
- fiat-p.a.exodus.io Critical
- fiat-prod-fallback.a.exodus.io Critical
- kyc.a.exodus.io Critical
- login.exodus.com Critical
- nexotrack.exodus.io Critical
- nexotrack-p.exodus.io Critical
- pay-admin.exodus.io Critical
- pay.exodus.io Critical
- turing.exodus.io Critical
Source code 7
- https://github.com/ExodusOSS/bytes Critical
- https://github.com/ExodusOSS/crypto Critical
- https://github.com/ExodusOSS/hydra Critical
- https://www.npmjs.com/package/@exodus/errors Critical
- https://www.npmjs.com/package/@exodus/keychain Critical
- https://www.npmjs.com/package/@exodus/safe-string Critical
- https://www.npmjs.com/package/@exodus/sentry-client Critical
Wildcard domains 3
- *.a.exodus.io High
- *.exodus.com High
- *.exodus.io High
iOS apps 2
- exodus-movement.exodus Critical
- https://apps.apple.com/us/app/exodus-crypto-bitcoin-wallet/id1414384820 Critical
Android apps 1
- https://play.google.com/store/apps/details?id=exodusmovement.exodus&hl=en_IN Critical
Desktop and binaries 1
- Exodus Desktop Wallet Critical
Products and areas 2
- Smart Contract: Solana - EQYRmLmkE7G7a2WQyojwrXg4SeguypCdnbm3ecncizsd Critical
- Smart Contract: Solana mainnet - xoUSDq85Rjsb6SbUwJyreFgeWQvxdkT7R3c3g7s6p5Y Critical
Out of scope (32)
- https://play.google.com/store/apps/details?id=com.exodus.grateful
- Exodus Browser Extension
- https://apps.apple.com/us/app/grateful-by-exodus/id6754093889
- Exodus Mobile App Browser and Wallet Connect
- Passkey Wallet
- api.passkeys.network
- api-p.xoswap.com
- api.xoswap.com
- dashboard-p.xoswap.com
- dashboard.xoswap.com
- embedded.passkeys.foundation
- exchange-p.exodus.io
- exchange-server-p.exodus.io
- exodusstore.blob.core.windows.net
- http://exchange-server.exodus.io
- http://exodus.com/keybase.txt
- https://exodus.atlassian.net
- http://www.exodus.com/contact-support
- my.passkeys.network
- passkeys.foundation
- relay.passkeys.foundation
- safeguard.a.exodus.io
- slack-invite.exodus.com
- support.exodus.com
- support-helpers.a.exodus.io
- wallet.passkeys.foundation
- xoswap-graphql.a.exodus.io
- xoswap-graphql-p.a.exodus.io
- *.atp-exodus.com
- get.exodus.*
- *.grateful.me
- www.exodus.com/job-application/*
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Exodus (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features.
-
DO NOT test Exodus Exchange and XOSWAP features, endpoints and hosts or anything related to it, Do not conduct any testing that leads to creating an order, exchange or swap
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service).
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Extended testing/attacks of Exodus servers or infrastructure
-
Rate limiting or brute-force attacks on exodus backend infrastructure
Not accepted
-
Weaknesses that would require Email Phishing or Social Engineering
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]
-
Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
-
Package include/dependency vulnerabilities without demonstrating a vulnerability.
-
Issues that require unlikely user interaction
-
12W secret seed phrases found in source code within Exodus attack surface.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
agents.exodus.com
-
Scope added
www.exodus.com/job-application/* (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-28269 | Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. | Critical 9.8 | 12 Nov 2020 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.
==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==
==DO NOT test Exodus Exchange and XOSWAP features, endpoints and hosts or anything related to it, Do not conduct any testing that leads to creating an order, exchange or swap, Your report will be closed as Not Applicable==
#Known Findings but not limited to:
| Asset | Out of scope finding class |
|---|---|
fiat.a.exodus.io |
Unauthenticated HMAC signing oracle on /api/v1/sign and /api/sign-url, including forged MoonPay, Ramp, Onramper and Blockchain.com partner signatures |
exchange.exodus.io, api.xoswap.com |
Unauthenticated read, enumeration or write on swap order endpoints under /v3 and /v4, including App-Name header spoofing and order ID enumeration |
api.passkeys.network |
Unauthenticated access to the relay and pairing message bus at /api/v1/messages, including message read, write, delete, interception and credential ID or wallet UUID lookup |
*.a.exodus.io |
Unauthenticated access to Substrate API sidecar and public blockchain RPC node endpoints, including chain data, node version, internal IP and stack trace disclosure |
@exodus/errors |
Incomplete redaction in sanitizeErrorMessage(), including 15, 18 and 21 word mnemonics, non English wordlists, base58 values and non whitespace separators |
@exodus/keychain |
Race between lock() and a pending unlock() or import that restores key material, signing or private key export after lock returns |
my.passkeys.network |
postMessage origin validation weaknesses and referrer trusted origins, including session ID overwrite, session fixation and cross origin identity disclosure |
fetch-n-cache.a.exodus.io |
Open fetch proxy and outbound SSRF reachable with the publicly distributed client API key |
*.a.exodus.io |
OAuth2 redirect_uri validation bypass and authorization code interception |
Response Targets
Exodus will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | < 5 days |
| Time to Triage | < 15 days |
| Time to Bounty | < 40 days |
| Time to Resolution | depends on severity and complexity |
We are dealing with large influx of AI based reports, both valid and invalid and we are running internal tooling as well which will take time to de-dupe external findings against internal findings and we will only reward once the report is marked fixed . We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Add
h1-<Your-HackerOne-Username>in theUser-Agentheader to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.
Report submission
- When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability.
- Submit one vulnerability per report. WARNING: If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission. Do NOT file multiple reports for the same exploit.
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder. If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly [email protected] and please include the subject title "HackerOne Outage: " for the alert to trigger.
Rewards
Reward decisions are up to the discretion of Exodus.
- Minimum reward for a vulnerability report: $100
- Maximum reward for a vulnerability report: $100,000
In scope vulnerabilities
- Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)
- Technical vulnerabilities or security-related problems in our company's Desktop Wallet application.
External Dependencies
Exodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in an open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor. We will not pay bounties on undisclosed vulnerabilities in dependent components. However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.
Out of scope vulnerabilities
If you find a vulnerability that is not part of the In scope vulnerabilities, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.
Note: We are aware of a few Browser Address Bar Spoofing vulnerabilities and are planning to patch them under upcoming releases with no definitive timeline, For the time being we will be not paying out for these.
The following issues are currently considered out of scope:
- Weaknesses that would require Email Phishing or Social Engineering
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company. Eg: Constant Contact, Zendesk, etc.
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
- Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]
- Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
- Package include/dependency vulnerabilities without demonstrating a vulnerability.
- Issues that require unlikely user interaction
- (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface.
The following issues are currently considered do not attempt without permission:
- Extended testing/attacks of Exodus servers or infrastructure
- Rate limiting or brute-force attacks on exodus backend infrastructure
- Any activity that could lead to the disruption of our service (DoS).
To request permission, please email [email protected] and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve. We will respond within 2 working days, ideally less to your request. As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Exodus and our users safe!