H1 HackerOne LIVE
Coinbase
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://coinbase.com/security
- managed triage
- yes
- response efficiency
- 76%
- time to bounty
- 1141h avg
16 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
54.175.255.192/27 | cidr | yes | critical | 2026-09-20 |
com.coinbase.android | mobile | yes | critical | 2026-09-20 |
com.vilcsak.bitcoin2 | mobile | yes | critical | 2026-09-20 |
org.toshi | mobile | yes | critical | 2026-09-20 |
org.toshi.distribution | mobile | yes | critical | 2026-09-20 |
*.base.org | other | yes | critical | 2026-09-20 |
Other | other | no | medium | 2026-09-20 |
https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad | other | yes | critical | 2026-09-20 |
https://github.com/base/* | source code | yes | critical | 2026-09-20 |
https://github.com/coinbase/* | source code | yes | critical | 2026-09-20 |
https://github.com/coinbase/cb-mpc | source code | yes | critical | 2026-09-20 |
https://github.com/coinbase/cb-mpc-go | source code | no | critical | 2026-09-20 |
*.base.app | wildcard | yes | critical | 2026-09-20 |
*.cbhq.net | wildcard | yes | critical | 2026-09-20 |
*.coinbase-corp.com | wildcard | yes | critical | 2026-09-20 |
*.coinbase.com | wildcard | yes | critical | 2026-09-20 |
3 out of scope — black ICE, don't touch
status.coinbase.comdomainN/A - Not Coinbase owned or operatedotherstatus.*.coinbase.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.