Coinbase cuts bug bounty payouts for lower-severity security issues, citing AI-driven focus

Coinbase has changed the rewards structure for its external security bug bounty program, dropping payments for lower-severity vulnerabilities and reducing rewards for its highest-severity category, effective immediately, according to a July 29 report.

The update was made to Coinbase’s publicly listed HackerOne program, a platform that coordinates vulnerability disclosures and pays bounties to researchers who report security weaknesses responsibly. Bug bounty programs are often used by large online platforms to supplement internal security testing, with the expectation that paying for timely reports can reduce the time attackers have to exploit known issues.

Under the revised structure described in the report, rewards for low- and medium-severity vulnerabilities were removed. At the same time, the reported top-tier payout was reduced, with high-severity rewards falling from $15,000 to $6,000. The reporting also said Coinbase attributed the change to “AI,” though it did not provide further operational detail on how AI affected the company’s risk model or reward economics.

The timing matters, because the program adjustments were described as taking effect immediately on July 29. That means researchers who submit vulnerability reports after the change would be subject to the updated reward schedule, rather than the prior payouts.

Coinbase has not disclosed in the reported account the precise criteria it uses to classify severity levels, nor did it describe any new testing thresholds or internal process changes tied to AI. Companies sometimes adjust bug bounty policies when they believe the likelihood of certain classes of vulnerabilities is declining, or when automation is improving detection and triage. In this case, however, the report does not specify which of those explanations is driving the decision beyond citing AI.

For the broader industry, the move indicates that bug bounty programs are not static. As vendors change their security posture, move to new technology stacks, or refine how they prioritize vulnerabilities, the reward schedule can shift. For researchers, those changes can affect the economics of disclosure work, especially if they reduce the chance of a paid outcome for some categories of findings.

Still, key details remain unclear from the public reporting. The report does not specify whether Coinbase changed the scope of what is eligible for testing, whether there are exceptions for certain high-impact classes of issues, or whether the company’s internal severity rubric changed alongside the payout changes. It also does not explain whether the AI reference relates to how Coinbase triages reports, how it detects vulnerabilities, or how it forecasts attacker behavior.

What to watch next is whether Coinbase publishes an expanded explanation or updated terms on its HackerOne program page, including how severity is defined after the change and whether the company will adjust payouts again in response to researcher feedback. Researchers may also look for any guidance on which vulnerability types Coinbase now deems most urgent enough to qualify for rewards under the new structure.