Hackers Wanted! Crypto.com Puts Its Security To A $2 Million Test

by

As a seasoned cybersecurity analyst with over two decades of experience in the field, I find it impressive to see the efforts companies like Crypto.com are taking to ensure the security and safety of their platforms. The $2 million bug bounty program is a clear indication that they are serious about addressing potential vulnerabilities, and this level of commitment is commendable.

Crypto.com, headquartered in Singapore, is providing a reward of $2 million to individuals who can identify and disclose security weaknesses. This gesture underscores their faith in the robustness and cutting-edge nature of their security infrastructure. The bounty program, in collaboration with HackerOne, is the largest to date for the platform, boasting an expansive scope, swift payouts, and complete adherence to industry standards.

On December 2nd, Crypto.com announced their collaboration with HackerOne and a $2 million bounty program, as stated in a Twitter post and company update. This initiative is an extension of the company’s dedication to upholding security and compliance standards. The program is supported by various certifications such as ISO 27001, ISO 27017, ISO 27019, ISO 22301, ISO 27701, SOC2 Type 2, and PCI DSS 4.0.

Besides the listed international certifications, Crypto.com also holds regional badges such as Singapore’s Cyber Security Trust Mark and Data Protection Trust Mark.

Crypto.com Upgrades Security, Bounty Program

Crypto.com expands its security collaboration with HackerOne, announcing an enhancement to their existing vulnerability reward program this month. This upgrade increases potential rewards to as much as $2 million. For the first time, the company’s bounty program has reached such a high amount, making it the largest bug bounty program on HackerOne not just in the crypto sphere, but also beyond it.

Today we launch a groundbreaking $2 million bug bounty program with @Hacker0x01.

Safety and security are of paramount importance at – we’re proud to support the largest bug bounty program available through HackerOne.

Learn more

— Crypto.com (@cryptocom) December 2, 2024

The company’s incentive program gives out tiered rewards for various levels of vulnerabilities depending on their severity. For instance, Low-level vulnerabilities (scoring between 0.1 and 3.9), which account for approximately 41.67%, offer a reward ranging from $200 to $500. Medium-level vulnerabilities (scoring 4.0 to 6.9) earn rewards of $500 to $5,000. High-level vulnerabilities (scoring 7.0 to 8.9) yield a reward of $5,000 to $40,000. Lastly, Critical or Extreme vulnerabilities (scoring 9.0 and above) receive rewards ranging from $40,000 to as much as $2 million.

Crypto.com encourages its users to spot any weaknesses and fix them before they’re taken advantage of by cybercriminals. Just like other tech firms, Crypto.com participates in rewarding individuals for finding and reporting security loopholes through a process called bug bounties. This approach helps tackle online threats more effectively.

Finding Critical Security Gaps Crucial For Companies

Being a major player in the world of cryptocurrency, Crypto.com caters to over 100 million users across 90 different nations. Yet, this widespread popularity comes with potential security risks. Recognizing this vulnerability is why the company teams up with HackerOne.

At its core, Crypto.com emphasizes trust as being fundamental, constructing it upon the pillars of confidentiality and safety. The organization proudly highlights their “zero-trust” and “defense-in-depth” security approaches, consistently pouring resources into educational programs that strengthen privacy and security skills.

As per Kara Sprague, the CEO of HackerOne, identifying significant security vulnerabilities is essential for a firm like Crypto.com. Sprague noted that the substantial reward amount demonstrates Crypto.com’s dedication to ensuring user safety and advocacy for responsible hacking practices.

Other Web 3.0 Companies Also Run Bounty Programs

Besides Crypto.com, several prominent Web 3.0 entities, such as Facebook, Atomic Wallet, Uniswap, and others, have conducted bug bounty programs to uncover and rectify any security vulnerabilities. These tech giants leverage ethical hacking practices.

Example: Uniswap initiated a substantial bug bounty within DeFi, promising rewards of up to $15.5 million for individuals who can detect potential security issues in its v4 smart contract. Following the announcement of this attractive incentive program, the value of their UNI token has significantly increased.

Read More

2024-12-05 04:12