Bug Bounty
A bug bounty is a company's standing offer to pay independent researchers who find security vulnerabilities in its products and report them privately.
What Is Bug Bounty?
A bug bounty is a standing offer by a company to pay independent security researchers who find and privately report vulnerabilities in its products. The program publishes its rules: which products are in scope, how to report, how long the vendor has to fix an issue before details are made public, and how rewards scale with severity.
For hardware wallets, the scope usually covers the firmware, the companion app and sometimes the hardware itself. Ledger, Trezor and BitBox are among the manufacturers that run public programs. Researchers who follow the rules are paid and credited; the vendor gets time to ship a fix before attackers learn of the flaw. This arrangement is called coordinated or responsible disclosure.
A bounty program gives outsiders a reason to look and a safe channel to report. A track record of published reports and fixes says more about a vendor than the absence of any known issue.
It does not replace other measures. A bounty finds only what someone chooses to look for, closed-source code is harder for outsiders to examine, and rewards that are small compared with what a flaw would fetch elsewhere attract little attention. Security audits, open-source firmware and an internal security team cover ground that a bounty alone does not.
A hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definition: FirmwareA companion app is the phone or desktop software paired with a hardware wallet: it shows balances, prepares transactions for the device to sign and installs updates.
Read full definition: Companion AppLedger is a brand of hardware wallets that securely store cryptocurrency private keys offline, such as the Ledger Nano series.
Read full definition: LedgerTrezor is a hardware wallet by SatoshiLabs. It stores private keys offline to secure cryptocurrencies.
Read full definition: TrezorBitBox is a hardware wallet brand by Shift Crypto, including the BitBox02 model, for securely storing cryptocurrency private keys offline.
Read full definition: BitBoxA security audit is an independent review of blockchain code or smart contracts by experts to identify vulnerabilities and ensure robustness.
Read full definition: Security AuditOpen Source Firmware refers to firmware in hardware devices, like wallets, where the source code is publicly available, allowing transparency, auditability, and customization.
Read full definition: Open Source FirmwareReal-World Examples
Example 1: A researcher finds a flaw in the way a wallet's firmware parses a transaction and reports it through the bounty program. The vendor releases a firmware update, then publishes an advisory that credits the researcher.
Example 2: Before buying a hardware wallet, a user checks whether the manufacturer has a public disclosure policy and a list of past security advisories with the fixes that followed.
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definition: FirmwareA firmware update installs a new version of the software that runs on a hardware wallet, to close security holes, fix bugs or add coins and features.
Read full definition: Firmware UpdateA hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
Frequently Asked Questions
Does a hardware wallet with no known vulnerabilities mean it is more secure?
Not necessarily. The absence of known issues can simply mean that few people have looked. A track record of published reports and fixes says more about a vendor, because it shows that outsiders examine the product, that flaws reach the vendor through a safe channel and that updates follow.
Why do researchers report a flaw privately instead of publishing it right away?
Under coordinated or responsible disclosure, the vendor gets time to ship a fix before attackers learn of the flaw. The program's rules set how long that window is. Researchers who follow the rules are paid and credited, and users can install the update before the details become public.
Is a bug bounty program enough to trust a wallet's security?
No. A bounty finds only what someone chooses to look for, closed-source code is harder for outsiders to examine, and small rewards attract little attention. Security audits, open-source firmware and an internal security team cover ground that a bounty alone does not, so look at all of them together.
Ready to Choose a Secure Wallet?
Use our tools to find the right hardware wallet for your needs.