ZachXBT Criticizes Cetus Hacker Bounty Program for Unfair Terms

In Brief:

Blockchain investigator ZachXBT called Cetus' $5M hacker bounty "unrealistic and unfair."

He claims the structure discourages genuine efforts by offering zero upfront compensation.

On May 24, blockchain sleuth ZachXBT publicly criticized Cetus’ bounty program for soliciting information about the recent hack affecting its protocol. The program promised a $5 million reward for successful recovery of funds but offered no upfront payment or compensation for investigative efforts that don’t lead to results.

ZachXBT argued that this model places all the burden on investigators while shielding victims from any risk. “There’s a severe imbalance between risk and reward,” he said, noting that serious contributors may be discouraged from participating due to the unclear structure.

He also pointed out that many top-tier security firms and researchers follow a two-part compensation system: an initial payment for time and effort, and a success-based bonus. By contrast, Cetus’ approach offers nothing until full recovery, which he says could waste valuable time and resources.

Further complicating matters, ZachXBT questioned the practicality of the bounty if the hackers are in regions with weak law enforcement or outside major jurisdictions. In such cases, he says, even partial fund recovery becomes uncertain—making the bounty even less credible.

His comments have sparked debate about how protocols should structure bounty programs to ensure fairness while effectively incentivizing white-hat contributors.

‍