Cost/benefit analysis? What is the chance I would someday get a $500k payout, starting from near zero experience today, with the help of a little bit of luck?

Can't comment on the cost (varies depending on who you are and what you do in your life) but the benefit is really high.

source: I started from 0 and the very first bounty I submitted (related to CEX) was valued to $100k+

How long did that take? How long was the 0 to reward process, and how much time did you spend?

Or you can spend your short life doing something actually useful.

I’m not a fan of crypto, but it’s not like non-crypto tech (which is mostly about collecting people’s personal data and wasting their time with ads) is any more useful.

Crypto at least is easy to ignore as a user. Every other company out there that wants me to handover my personal data and “engage” is less so.

Crypto skeptics probably don't trust crypto firms to pay the "rewards up to $15,000,000" bounties advertised at places like https://immunefi.com/.

Immunefi has a similar payouts table to h1's at https://immunefi.com/bug-bounty/ implying people are getting paid, but it could boost credibility by linking to write-ups and findings from researchers if any exist.

Whenevrt i see a crypto disxussion with dollar signs, im forced to ask if thw payment is in actual dollars or dollar equivelents. Aftetall, bitcoin isnt a currency and is more like a stockmarket as when you try to extract large value from it you typically cause its real price to decline.

Unless they are paying multi-billion dollar bounties in BTC, USDC, USDT or ETH it's not big enough to really move the market.

Payments seem to be in Ethereum, based on the description of the "Immunefi vault platform":

> This project utilizes a decentralized vault for their bounty rewards to ensure trust by showing that they have the collateral to cover their bounties. Payments are processed directly on-chain inside the Immunefi webapp.

https://immunefi.com/bug-bounty/beanstalk/

An interesting side-effect is that you can view payments from the public vault for each project, for example:

https://etherscan.io/address/0x66Efac6e6d58D4058CF017E66a003...

Top payment so far is 3 payments of about 8,500 USD to the same recipient. The maximum claimed achievable payment is 1.1m USD.

It does at least imply that they've set aside magic beans to pay researchers, and that someone is being paid from the bean fund, for whatever that's worth.

The real sketch ones is when the payout is in their custom altcoin since if you find a truly show stopper bug, their altcoin might end up going to 0 once you report it.

More and more process in USDC

the hackernews post a few months ago had someone earn $2,000,000 which was paid instantly in USDC. this is freely redeemable for USD on Circle and Coinbase

some other firms pay out in a vesting schedule of their own tokens, so you rely on the exchange rate and liquidity just as with RSUs.

Nobody should trust these companies to do that.

I bet you this was lots of persuasion for them to pay out this bounty. You wouldn't have gotten this bounty if you had this bug.

> make a massive killing from the payouts

do you have, you know, like some data on those massive payouts? other than one data point?

Here’s a list of vulnerability writeups with what they were paid

https://github.com/sayan011/Immunefi-bug-bounty-writeups-lis...

If I hated crypto companies, why would I help find bugs for them?

I think the OP was obvious. To make money.

You can believe that crypto is "secure" and still be a crypto-skeptic.