immunefi

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

Quantus founder and CEO Yuvi Lightman posted on X that the anti-quantum blockchain Quantus mainnet will go live on September 9 (Wednesday). The only way to acquire tokens at the launch is through mining, and liquidity and tradability will be available a few weeks later.The team has merged Immunefi security work into the public code repository and completed all fixes from the audit competition. The chain supports ML-DSA-65 and ML-DSA-87, binding each signature to its context according to FIPS 204 standards, failing and closing multi-signature transactions that cannot be decoded, and strengthening the network stack to resist denial-of-service attacks. The team has completed a full-process drill on the global rehearsal mainnet covering the Americas, Asia, Europe, and Australia, producing signed binaries through an automated pipeline, deploying multi-region bootnodes and dedicated RPC nodes as infrastructure as code, and reducing indexer memory usage from over 90% to about 26%.In addition, Quantus has launched a registration page, completed a website redesign, Keystone hardware wallet supports multiple accounts, and released CLI v2.1.3 and miner v4.0.2. Quantum & Privacy Day will be co-hosted with NEAR in Singapore on October 8, coinciding with Token2049.

According to The Block, Immunefi's latest data shows that the cryptocurrency industry lost approximately $110 million due to hacker attacks in July.During the same period, the platform paid researchers $2.32 million for confirmed vulnerability reports, with the number of confirmed and completed bounty reports increasing by 18% month-over-month.The report indicates that its audit competitions can average 6.2 critical vulnerabilities per event, compared to 1.5 for first-level audits; in July, a total of 374 threats were mitigated through the bounty program.

According to The Block, a report from Immunefi shows that in the first half of 2026, cryptocurrency projects suffered cumulative losses of approximately $972 million due to 207 hacking incidents. Although the number of attacks reached a historic high, the total losses remained below $1 billion and were less than half of the losses in the first half of 2025.The report pointed out that losses from attacks in the DeFi sector have decreased by 74% from the peak of $2.62 billion in 2022, dropping to about $680.3 million, with the median single loss decreasing by 75% during the same period. Immunefi believes that this decline is related to ongoing security coverage, bug bounty programs, audit competitions, and more researchers discovering vulnerabilities early.In addition, the sources of risk are shifting from purely smart contract vulnerabilities to infrastructure failures, private key leaks, cross-chain configuration errors, and weak points in privileged access.

According to The Block, the latest "2026 Ecosystem Vulnerability Audit Report" released by Web3 security company Immunefi shows that losses from DeFi protocols due to hacker attacks have decreased by 74% from the peak of $2.62 billion in 2022 to approximately $680.3 million in 2025.The report points out that the median loss per attack has also significantly decreased, from $6 million in 2022 to $1.5 million in 2025, reflecting an overall improvement in security levels.At the same time, the proportion of losses from bridge exploits has dramatically decreased from 73% in 2022 to 3% in 2025, and the share of flash loan attacks has dropped from 54% to less than 1%. Risks at the infrastructure level (such as private key leaks and database attacks) have also decreased from 30.7% in 2022 to 10.3% in 2025. Immunefi stated that this reflects the ongoing optimization of oracle design, reentrancy attack protection, and access control standards, indicating that the overall DeFi ecosystem "is becoming safer."However, the report also notes that losses slightly rebounded to $680.3 million in 2025, mainly due to the increasing complexity of multi-chain systems and a few high-severity incidents. Meanwhile, the number of independent security incidents continues to rise, reflecting an expanding attack surface.

According to official news, the smart contract auditing platform Code4rena has announced that it will gradually cease operations, and the Web3 security company Immunefi will take over its clients and security researchers. Code4rena posted on social media that it has made the decision to shut down and stated that all ongoing competitions and bounty activities will be completed as usual, and existing collaborations will be "properly concluded." Immunefi stated that it will assist in migrating Code4rena's bounty projects, reward structures, and researchers to its platform.Code4rena is known for its "competitive auditing" model, where independent researchers compete to find vulnerabilities in smart contracts for rewards. This shutdown comes less than two years after blockchain security company Zellic acquired Code4rena in 2024. Previously, Code4rena raised $6 million from Paradigm in 2023 for auditing incentives and platform expansion.This shutdown comes at a difficult time for DeFi protocols and the security sector. Data from DefiLlama shows that there were over 20 crypto vulnerability incidents in April alone, setting a monthly record. JPMorgan analysts believe that ongoing DeFi security incidents are limiting major institutional investors from entering the market. Meanwhile, the total value locked in DeFi has decreased from about $160 billion in October to approximately $83 billion currently.

The Web3 security platform Immunefi announced on the X platform that the DeFi protocol Alchemix has relaunched its bug bounty program based on its latest v3 contract, with a maximum reward of $300,000.This program aims to encourage security researchers to review the new version of the contract code and identify potential vulnerabilities in advance to enhance the overall security of the protocol. Immunefi stated that this is currently a critical window for auditing the relevant code and participating in the bounty program.

According to Cointelegraph, Immunefi's latest security report shows that cryptocurrency hacking attacks are still steadily occurring, with losses increasingly concentrated in a few large-scale attack events.The report states that between 2021 and 2025, there were 425 publicly known hacking incidents, with an estimated average loss of about $25 million per incident. In just 2024 and 2025, 191 hacking incidents caused losses of $4.67 billion, with only 5 incidents accounting for 62% of the total losses.Additionally, the study tracked 82 tokens that were hacked, of which 83.9% saw their median price drop by 61% within six months, and during this period, the price remained below the price on the day of the attack.

According to the on-chain security report released by Immunefi, there were a total of 191 publicly disclosed attack incidents from 2024 to 2025, with total losses reaching $4.67 billion and cumulative losses over five years amounting to $11.9 billion, involving 425 attacks. In 2024, 94 attacks were recorded, while 97 occurred in 2025, with an overall frequency tending to stabilize.The median loss per attack decreased from the previous $4.5 million to about $2.2 million, but the average loss still reached approximately $24.5 million. The five largest incidents between 2024 and 2025 accounted for 62% of the total stolen funds, while the top ten accounted for 73%. Among them, the $1.5 billion attack on Bybit accounted for 44% of all losses in 2025 and 32% of the total losses over the two years. Although centralized exchanges were involved in only 20 of the 191 incidents, they bore more than half of the total losses, amounting to $2.55 billion. The tokens of the attacked projects averaged a decline of about 10% within two days of the incident, and the median decline reached 61% six months later, with approximately 84% of the affected tokens still below pre-attack levels after six months.

According to The Block, cryptocurrency financial service provider Anchorage Digital, the first federally chartered crypto bank in the U.S., is making a strategic investment in Immunefi and purchasing the native token IMU of the security infrastructure company.Immunefi will also provide security services for Anchorage's non-custodial wallet Porto, enabling institutional clients to directly participate in DeFi protocols and on-chain investment strategies. Currently, Immunefi has protected over $180 billion in TVL for on-chain protocols and has paid out over $130 million in bug bounties to white hat hackers.

According to the official announcement, Coinbase will launch spot trading for ImmuneFi (IMU). If liquidity conditions are met and trading is supported, the IMU-USD trading pair will begin to open later today.

According to official news, Bybit will launch Immunefi (IMU) in the spot area.Immunefi is a leading on-chain security platform. By identifying vulnerabilities, it helps teams mitigate risks before an attack occurs.

According to CoinDesk, Immunefi CEO Mitchell Amador stated in a recent interview that despite the ongoing rise in cryptocurrency losses, on-chain security is improving. The year 2025 is recorded as the year with the most severe hacking attacks, but the biggest security failures did not stem from on-chain code, but rather from operational mistakes in Web2, such as passwords, private keys, infected devices, and human errors.As code becomes increasingly difficult to exploit, the main attack surface for crypto security in 2026 will be people, with human factors becoming the weak link that Web3 participants must prioritize. This view aligns with findings from a report by Chainalysis.The report indicates that cryptocurrency losses due to scams and fraud amounted to approximately $17 billion in 2025. Among these, identity impersonation scams increased by 1400% year-on-year, while AI-driven scams were 450% more profitable than traditional schemes.

According to Cointelegraph, Immunefi CEO Mitchell Amador stated that nearly 80% of crypto projects that suffered significant hacks never fully recover. The main reason is not the initial financial loss, but rather the collapse of operations and trust during the response process.Most protocols go into a state of paralysis the moment a vulnerability is exploited, leading to additional losses due to the lack of a predefined emergency plan. Data shows that crypto-related hacks will result in total losses of $3.4 billion in 2025, the highest level since 2022, with three incidents, including the $1.4 billion hack of Bybit, accounting for 69% of all losses as of early December.

The crypto vulnerability bounty platform Immunefi announced on X platform that its native token IMU will officially launch on January 22.

Coinbase Markets announced today that it will add two crypto assets, ImmuneFi (IMU) and Sentient (SENT), to its roadmap and has released the Ethereum network (ERC-20) contract addresses for both.

According to a CoinList announcement, the token sale for the crypto bug bounty platform Immunefi (IMU) will officially launch on November 12, 2025, at 17:00 UTC on CoinList. The token price is set at $0.01337, corresponding to an FDV of $133.7 million. A total of 373,971,578 IMU tokens will be distributed (accounting for 3.74% of the total supply), with 100% unlocked at TGE; the minimum purchase is $100, supporting USDT/USDC. Registration is currently open.It is reported that Immunefi is a bug bounty platform focused on Web3 and smart contract security, providing vulnerability reward escrow, consulting, vulnerability classification, and program management services for blockchain and smart contract projects. Previously, the project has received support from several crypto and traditional tech capital firms, including Framework Ventures, Electric Capital (leading), P2 Ventures, and Bitscale Capital, with a total funding amount of $29 million.

ChainCatcher message, former Immunefi smart contract developer and security engineer Vladimir posted on the X platform, stating that with the Ethereum Pectra upgrade, users only need to sign a message to fully withdraw, so extra caution must be taken when signing transactions.