# 1win: bug bounty program on HackerOne

> 1win is a bug bounty program on HackerOne. Its critical reports have paid an average of $1,950 across 3 reports (HackerOne figures, November 7, 2026). It received 383 reports in the 90 days to November 7, 2026, about 26 per in-scope asset.

- **Company:** 1win
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/1win_com
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** April 1, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/1win-com

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $1,950 | 3 |
| High | $1,194 | 9 |
| Medium | $250 | 4 |
| Low | not published | 3 |

- Reports received in the last 90 days: 383 (about 26 per in-scope asset)
- Bounties paid in the last 90 days: $20,300
- Bounties paid in total: $54,450
- Researchers participating: 109
- Response efficiency: 100%
- First-response target: 2 days
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 15 assets in scope (15 bounty-eligible), 0 out of scope. The policy page is the authority.

- `1w.cash` (URL): in scope, bounty-eligible, max severity critical
- `1w.run` (URL): in scope, bounty-eligible, max severity critical
- `1win-partners.com` (URL): in scope, bounty-eligible, max severity critical
- `1win.com` (URL): in scope, bounty-eligible, max severity critical
- `1win.io` (URL): in scope, bounty-eligible, max severity critical
- `1wintoken.com` (URL): in scope, bounty-eligible, max severity critical
- `1wtoken.com` (URL): in scope, bounty-eligible, max severity critical
- `Deposit/Withdraw` (OTHER): in scope, bounty-eligible, max severity critical
- `forum.1win.io` (URL): in scope, bounty-eligible, max severity critical
- `https://1win.com/betting` (URL): in scope, bounty-eligible, max severity critical
- `https://1win.com/casino` (URL): in scope, bounty-eligible, max severity critical
- `https://1win.com/casino/list/64` (URL): in scope, bounty-eligible, max severity critical
- `https://solscan.io/account/B2RFzpckwjtHXHMrPMKarg6Cj6xkSdT6mru4gJiJE87L` (SMART_CONTRACT): in scope, bounty-eligible, max severity critical
- `https://solscan.io/account/GWvQinGBRa7ZUzhXY23MrLjdsx3KfRGxH8yXURBwrz1R` (SMART_CONTRACT): in scope, bounty-eligible, max severity critical
- `https://solscan.io/account/sxzuA7TuRvjVbrXkJUgrYq2hfjVf3RFd8WFaSxt2rYm` (SMART_CONTRACT): in scope, bounty-eligible, max severity critical

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.