# Crypto.com: bug bounty program on HackerOne

> Crypto.com is a bug bounty program on HackerOne. Its critical reports have paid an average of $2,400 across 18 reports (HackerOne figures, November 7, 2026). It received 1,475 reports in the 90 days to November 7, 2026, about 43 per in-scope asset.

- **Company:** Crypto.com
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/crypto
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** May 2, 2018
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/crypto

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $2,400 | 18 |
| High | $2,116 | 61 |
| Medium | $318 | 189 |
| Low | $234 | 135 |

- Reports received in the last 90 days: 1,475 (about 43 per in-scope asset)
- Bounties paid in the last 90 days: $16,100
- Bounties paid in total: $1,635,359
- Researchers participating: 619
- Response efficiency: 100%
- First-response target: 3 days
- Triage target: 5 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 34 assets in scope (34 bounty-eligible), 7 out of scope. The policy page is the authority.

- `*.crypto.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.mona.co` (WILDCARD): in scope, bounty-eligible, max severity critical
- `app.mona.co` (URL): in scope, bounty-eligible, max severity critical
- `auth.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `co.mona.android` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity high
- `com.monaco.mobile` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity high
- `Crypto.com Exchange APIs that require an account` (API): in scope, bounty-eligible, max severity critical
- `Crypto.com mobile app APIs that require an account` (API): in scope, bounty-eligible, max severity critical
- `crypto.org` (URL): in scope, bounty-eligible, max severity critical
- `developer-api.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `developer-platform-api.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `developer.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `experiences.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `https://crypto.com/defi/` (URL): in scope, bounty-eligible, max severity critical
- `https://crypto.com/exchange` (URL): in scope, bounty-eligible, max severity critical
- `https://crypto.com/nft` (URL): in scope, bounty-eligible, max severity critical
- `https://crypto.com/price` (URL): in scope, bounty-eligible, max severity medium
- `https://crypto.org/desktopwallet` (URL): in scope, bounty-eligible, max severity critical
- `https://etherscan.io/token/0xfe18ae03741a5b84e39c295ac9c856ed7991c38e` (SMART_CONTRACT): in scope, bounty-eligible, max severity critical
- `https://explorer.cronos.org/token/0x2e53c5586e12a99d4CAE366E9Fc5C14fE9c6495d` (SMART_CONTRACT): in scope, bounty-eligible, max severity critical
- `https://github.com/crypto-com/chain-tx-enclave` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/crypto-org-chain/chain-main` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `js.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `mco.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `merchant.crypto.com` (URL): in scope, bounty-eligible, max severity medium
- `nadex.com` (URL): in scope, bounty-eligible, max severity medium
- `og.com` (URL): in scope, bounty-eligible, max severity critical
- `pay.crypto.com` (URL): in scope, bounty-eligible, max severity high
- `tax.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `testnet-croeseid-4.crypto.org` (URL): in scope, bounty-eligible, max severity critical
- `tickets.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `travel.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `web.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `www.crypto.com` (URL): in scope, bounty-eligible, max severity critical
- `com.defi.wallet` (APPLE_STORE_APP_ID): out of scope, max severity none
- `Crypto.com Wallet Extension` (OTHER): out of scope, max severity none
- `https://github.com/crypto-com/chain-desktop-wallet` (SOURCE_CODE): out of scope, max severity none
- `https://github.com/crypto-com/cro-staking` (SOURCE_CODE): out of scope, max severity none
- `https://github.com/crypto-com/sample-chain-wallet` (URL): out of scope, max severity none
- `https://github.com/crypto-com/swap-contracts-core` (SOURCE_CODE): out of scope, max severity none
- and 1 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.