Help us secure the future of cryptocurrency storage. Find vulnerabilities, earn rewards.
Minor bugs with limited impact on security or functionality
Moderate vulnerabilities that could affect user experience or data
Serious vulnerabilities that could compromise device security
Critical vulnerabilities that could lead to key extraction or loss of funds
What's eligible for our bug bounty program
How to report vulnerabilities and claim your reward
Find a vulnerability and document it thoroughly with proof of concept, steps to reproduce, and potential impact assessment.
Submit your detailed report through our secure submission portal or encrypted email with all necessary documentation.
Our security team reviews your submission within 48 hours and provides initial feedback and severity assessment.
We validate and reproduce the vulnerability in our testing environment, working with you if additional information is needed.
Receive your bounty reward and recognition while we develop and deploy a fix for the vulnerability.
Guidelines for responsible disclosure and participation
Do not publicly disclose vulnerabilities until we've released a fix and notified users.
Provide detailed steps to reproduce, including environment, tools, and configuration.
Testing must not harm other users, compromise data, or disrupt our services.
Rewards go to the first person to report a unique, previously unknown vulnerability.
All testing must comply with applicable laws and regulations in your jurisdiction.
Act in good faith to avoid privacy violations and destruction of data or equipment.
Recognizing our top security researchers
Critical vulnerability in firmware v2.1
Side-channel attack discovery
PIN bypass vulnerability
Help us build the most secure hardware wallet in the world
Submit Vulnerability
For encrypted submissions, use our PGP key available on our website
Email: contact@lumpaxwallet.co.com | Subject: Bug Bounty Submission