Since 2018, security researchers around the world have helped us protect the people and businesses who rely on Block's products, including Square, Cash App, Afterpay, and TIDAL, as well as our open source projects. We’re deeply grateful for that partnership. Researchers have earned more than $1 million through our programs for finding and responsibly disclosing vulnerabilities, and those payouts reflect meaningful reports that helped us identify and address security issues. To everyone who has ever sent us a report, thank you.
Today we're sharing the next chapter of that partnership: Block's bug bounty program is moving to HackerOne.
What's changing
As of October 7, 2026, our bug bounty program operates on HackerOne as a private, invite-only program. This move also consolidates our five separate bug bounty programs into a single Block-wide program, giving researchers one front door for every Block brand. All five programs on Bugcrowd stopped accepting new submissions on September 30, 2026, and reports submitted before the cutoff will continue to be triaged and remain eligible for rewards under the existing program terms.
We're launching privately on purpose. Starting with a focused group of researchers helps us improve response times, communication, and reward decisions. Invitations are extended through HackerOne, and we plan to grow the program in waves over time.
If you've worked with us before
The researchers who submitted valid findings through our previous programs are the reason for that success, and we want you with us on HackerOne. If you’ve previously submitted an accepted finding, contact us at bugbounty@block.xyz and we'll extend an invitation to the new program.
What isn't changing
Our commitment to security researchers. The researchers who participate in our program are an extension of our security team. You've found the bugs our tools missed and made our products safer for millions of people. We will continue to pay bounties for eligible, impactful findings under the program terms, aim to respond promptly as reports move through our pipeline, and provide safe harbor consistent with our disclosure policy and program terms.
We’re grateful to Bugcrowd for its partnership since 2018. This move reflects where we want to take the program next.
As the program grows, we look forward to welcoming more of the researcher community. Keep an eye on this blog for updates.
Here's to the next million.