H1 HackerOne LIVE
Exodus
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.exodus.com
- managed triage
- no
- response efficiency
- 96%
- first response
- 21h avg
- time to bounty
- 401h avg
27 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
ctr.a.exodus.io | domain | yes | critical | 2026-09-20 |
fiat-p.a.exodus.io | domain | yes | critical | 2026-09-20 |
fiat-prod-fallback.a.exodus.io | domain | yes | critical | 2026-09-20 |
fiat.a.exodus.io | domain | yes | critical | 2026-09-20 |
kyc.a.exodus.io | domain | yes | critical | 2026-09-20 |
login.exodus.com | domain | yes | critical | 2026-09-20 |
nexotrack-p.exodus.io | domain | yes | critical | 2026-09-20 |
nexotrack.exodus.io | domain | yes | critical | 2026-09-20 |
pay-admin.exodus.io | domain | yes | critical | 2026-09-20 |
pay.exodus.io | domain | yes | critical | 2026-09-20 |
turing.exodus.io | domain | yes | critical | 2026-09-20 |
Exodus Desktop Wallet | executable | yes | critical | 2026-09-20 |
exodus-movement.exodus | mobile | yes | critical | 2026-09-20 |
https://apps.apple.com/us/app/exodus-crypto-bitcoin-wallet/id1414384820 | mobile | yes | critical | 2026-09-20 |
https://play.google.com/store/apps/details?id=exodusmovement.exodus&hl=en_IN | mobile | yes | critical | 2026-09-20 |
Smart Contract: Solana - EQYRmLmkE7G7a2WQyojwrXg4SeguypCdnbm3ecncizsd | other | yes | critical | 2026-09-20 |
Smart Contract: Solana mainnet - xoUSDq85Rjsb6SbUwJyreFgeWQvxdkT7R3c3g7s6p5Y | other | yes | critical | 2026-09-20 |
https://github.com/ExodusOSS/bytes | source code | yes | critical | 2026-09-20 |
https://github.com/ExodusOSS/crypto | source code | yes | critical | 2026-09-20 |
https://github.com/ExodusOSS/hydra | source code | yes | critical | 2026-09-20 |
https://www.npmjs.com/package/@exodus/errors | source code | yes | critical | 2026-09-20 |
https://www.npmjs.com/package/@exodus/keychain | source code | yes | critical | 2026-09-20 |
https://www.npmjs.com/package/@exodus/safe-string | source code | yes | critical | 2026-09-20 |
https://www.npmjs.com/package/@exodus/sentry-client | source code | yes | critical | 2026-09-20 |
*.a.exodus.io | wildcard | yes | high | 2026-09-20 |
*.exodus.com | wildcard | yes | high | 2026-09-20 |
*.exodus.io | wildcard | yes | high | 2026-09-20 |
34 out of scope — black ICE, don't touch
api-p.xoswap.comdomainapi.passkeys.networkdomainapi.xoswap.comdomaindashboard-p.xoswap.comdomaindashboard.xoswap.comdomainembedded.passkeys.foundationdomainexchange-p.exodus.iodomainexchange-server-p.exodus.iodomainexchange-server.exodus.iodomainexodus.atlassian.netdomainexodusstore.blob.core.windows.netdomainhttp://exchange-server.exodus.iodomainhttp://exodus.com/keybase.txtdomainhttp://www.exodus.com/contact-supportdomainhttps://exodus.atlassian.netdomainmy.passkeys.networkdomainpasskeys.foundationdomainrelay.passkeys.foundationdomainsafeguard.a.exodus.iodomainslack-invite.exodus.comdomainsupport-helpers.a.exodus.iodomainsupport.exodus.comdomainwallet.passkeys.foundationdomainxoswap-graphql-p.a.exodus.iodomainxoswap-graphql.a.exodus.iodomainExodus Browser Extensionexecutablehttps://apps.apple.com/us/app/grateful-by-exodus/id6754093889mobilehttps://play.google.com/store/apps/details?id=com.exodus.gratefulmobileExodus Mobile App Browser and Wallet ConnectotherPasskey Walletother*.atp-exodus.comwildcard*.grateful.mewildcardget.exodus.*wildcardwww.exodus.com/job-application/*wildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.