immunefi

Immunefi is a crowdsourced security platform for Web3, founded in 2020 with the stated mission of making web3 safe for onboarding the world. Its original product is the onchain bug bounty program (BBP): protocols publish scopes, assets, impacts and reward tiers, and independent security researchers submit vulnerability reports with proof of concept for validation and payment. The company developed a scaling bounty standard under which projects reward critical vulnerabilities at a rate equivalent to roughly 10% of funds at risk, which produced unusually large payouts in software security, including $10 million for a Wormhole vulnerability and $6 million for a vulnerability in Aurora.

Since 2024 Immunefi has broadened beyond bug bounties across the web3 software development lifecycle with Audit Competitions (time-bound code reviews), Attackathons (large-scale education-based competitions with a shared reward pool), Invite-Only Programs (curated researcher groups), matchmade security Audits, and continuous PR (pull request) reviews embedded in client development processes. Commercial packages around bug bounties include a BBP subscription (annual flat fee that removes the 10% platform fee on payouts and adds Slack, Discord and PagerDuty integrations), an Enterprise subscription with a dedicated account manager and end-to-end program operation, Premium BBP restricting submissions to vetted senior researchers, and Managed Triage combining AI triage agents with human triagers plus pay-to-submit pricing to reduce spam.

In 2025 the company announced Immunefi Magnus, described as a unified security operations command center for the onchain economy, organized around four pillars: Aggregate (integrating third-party tooling for CI/CD pipeline security, audits and audit competitions, bug bounty and Safe Harbor programs, onchain monitoring and threat detection, and onchain firewalls), Orchestrate (Security Swarm automations engine for autonomous detection and mitigation), Agentify (role-specific security agents), and Evolve (Codexa, a proprietary dataset of onchain vulnerabilities, exploits, bug reports and fixes used to train Immunefi AI).

Founding story

Immunefi was founded in 2020 by CEO Mitchell Amador and launched in December 2020, premised on the view that security is the primary blocker to web3 adoption given billions lost to hacks each year. Before Immunefi, Amador was CMO of SingularityNET, worked on the Steemit social platform, and founded Instituto New Economy in Portugal. [2][6][7]

Business model

Immunefi operates a two-sided platform connecting protocols that need code reviewed with independent security researchers who are paid for validated disclosures. Protocols fund the reward pools; Immunefi provides program design, launch and co-marketing, a bug reporting dashboard, triage and validation, and communications support.

Sources describe a 10% platform fee on bug bounty payouts, which an annual flat-fee BBP subscription removes; other paid tiers include an Enterprise subscription (managed programs, dedicated account manager, multi-program support), Premium BBP as an add-on, and Managed Triage with pay-to-submit pricing for submitters. Audits, audit competitions, invite-only programs and PR reviews are additional service lines. [2][4]

Traction

Company-reported figures include $190B+ in assets under protection, $25B+ in hack damage averted, 650+ secured protocols (500+ cited elsewhere), 60,000+ whitehats in the ecosystem and 83,000+ registered security researchers, 1,600+ critical mainnet bugs found (about one critical per business day), and $116M-$125M+ paid in rewards. Immunefi states 93.9% of bug bounty programs running five years or longer surface a confirmed critical. Cited clients and testimonials include Aave, zkSync, Lido on Polygon, USDT0, ether.fi, Puffer, Synthetix, Chainlink, SushiSwap, MakerDAO, Wormhole, GMX, Alchemix, Nexus Mutual, The Graph, Polygon and Optimism. At the time of its 2022 Series A the company reported $60 million paid to whitehats. [0][2][3][4][6]

Latest developments

In 2025 Immunefi announced Immunefi Magnus, a unified onchain security operations platform with early-access registration, spanning aggregation of third-party security tooling, the Security Swarm automations engine, role-specific security agents and the Codexa vulnerability dataset. The company also publishes The Web3 Security Playbook, operational guidance for protocol teams on custody, governance, infrastructure and monitoring. [0][2]