Binance
The world's largest cryptocurrency exchange by trading volume, offering spot, futures, staking, and DeFi services globally.
https://binance.comMax Reward
$100,000
Total Paid
$4,800,000
Resolved
567
Avg Response
3 days
In-Scope Assets
binance.com
Exchange platform, P2P, and Launchpad
Binance API
REST and WebSocket trading APIs
BNB Chain
BNB Smart Chain core infrastructure
Trust Wallet
Mobile wallet application and browser extension
Out of Scope
- ✕ Third-party dApps
- ✕ Binance Academy content
- ✕ Marketing materials
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| BNB-001 | API key privilege escalation via permission bitmask overflow | Critical | Open | $25,000–$100,000 | 0 |
| BNB-002 | Order book manipulation via WebSocket message injection | High | In Review | $10,000–$25,000 | 1 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.