In brief. BlockFi is a bug bounty program on HackerOne. It received 0 reports in the 90 days to November 7, 2026, about 0 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

BlockFi

BlockFi HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at BlockFi? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical amount not published 4 reports

High amount not published 4 reports

Medium amount not published 4 reports

Low amount not published 24 reports

$18,750 paid to researchers in total. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

in 90 days

Resolved

all time, last one today

Participants

hunters engaged

Response efficiency

not published

HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 29 days 0–0

9 Oct 0 reports 7 Nov

Response targets it sets itself

First response

1 day

Triage

2 days

Bounty

30 days

Resolution

30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

submissions disabled

Over 77 days (53 snapshots): no change in the main figures.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

57 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	ehshahid	100	4 / 4 100%
2	bughacher	57	1 / 1 100%
2	todayisnew	54	2 / 2 100%
3	golu_369	39	1 / 5 20%
4	gohan1	36	3 / 5 60%
5	joren485	32	1 / 5 20%
5	m0chan	32	1 / 1 100%
5	mrghannu0x01	32	1 / 1 100%
5	tcbutler320	32	1 / 2 50%
9	pallabjyoti_218	29	3 / 10 30%
10	4auvar	22	1 / 1 100%
10	akitech	22	1 / 2 50%
10	caon	22	1 / 2 50%
10	d0xing	22	1 / 1 100%
10	dimm3r	22	1 / 1 100%
10	emperor	22	2 / 3 67%
10	kadir12	22	1 / 4 25%
10	lawsoul	22	1 / 1 100%
10	niemand_sec	22	1 / 1 100%
10	noddyn12	22	1 / 2 50%
10	s1r1u5	22	1 / 1 100%
10	s5s	22	1 / 1 100%
10	sawmj	22	1 / 1 100%
10	securityteacher	22	1 / 2 50%
10	sundaed	22	1 / 1 100%

Showing the top 25 of 57 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 5 Nov 2026.

Swag

Currency

USD

Submissions

Disabled

Launched

Mar 2021

Scope entries

3 HackerOne’s count

Scope

3 assets

Asset	Type	Eligibility	Max severity
*.blockfi.com	WILDCARD	✓ bounty	Critical
com.blockfi.mobile	GOOGLE PLAY APP ID	✓ bounty	Critical
1506274532	APPLE STORE APP ID	✓ bounty	Critical