Ethereum Foundation Quadruples Its Maximum Bug Bounty to $1 Million — Funded by the $220M DAO Security Reserve
Critical vulnerabilities that could affect the entire Ethereum blockchain now qualify for payouts up to $1 million, backed by $220 million in unclaimed funds from the 2016 DAO hack.
A Million-Dollar Incentive to Break Ethereum Safely
The Ethereum Foundation announced on March 10 that it has quadrupled its maximum bug bounty payout from $250,000 to $1 million for critical vulnerabilities that could affect the entire blockchain. The increase is funded in part by the DAO Security Fund, established in January 2026 with $220 million in unclaimed funds recovered from the infamous 2016 DAO hack.
The new payout structure is the most aggressive bug bounty program in the blockchain industry. For context, the previous $250,000 maximum was already among the highest in crypto — but as Ethereum's total value locked has grown past $100 billion across DeFi protocols, the economic incentive for attackers has grown proportionally. A $1 million bounty needs to be large enough that finding and responsibly disclosing a vulnerability is more attractive than exploiting it.
What Qualifies for the Maximum Payout
The $1 million tier is reserved for the most severe class of vulnerabilities: flaws that could cause a consensus failure, enable unauthorized minting, allow double-spending, or compromise the integrity of the beacon chain. These are the kind of bugs that could theoretically put the entire Ethereum network at risk — and the Ethereum Foundation wants researchers to know that finding one is worth a career-defining payday.
Lower-severity vulnerabilities still qualify for substantial payouts. High-severity bugs in execution clients, consensus clients, or the Solidity compiler can earn up to $500,000. Medium-severity issues in peripheral infrastructure start at $50,000. The tiered structure ensures that even less dramatic findings are worth a researcher's time.
The DAO Fund's Poetic Justice
There's a fitting irony in using recovered DAO funds to secure Ethereum's future. The 2016 DAO hack — which exploited a reentrancy vulnerability to drain 3.6 million ETH — was the defining security crisis of Ethereum's early years and led to the controversial hard fork that split Ethereum and Ethereum Classic. Nearly a decade later, those recovered funds are now being deployed to prevent the next generation of exploits.
The $220 million DAO Security Fund also supports security auditing grants, formal verification research, and the development of automated vulnerability detection tools for smart contracts. The bug bounty increase is the most visible component, but the fund's broader mission is to build security infrastructure for the entire Ethereum ecosystem.
Sources: Ethereum Foundation Blog (March 10, 2026), Cybernews (March 11, 2026), CoinDesk (March 10, 2026)