https://xitter.gq/t.co/PRRBHBXzsR Username was autogenerated lmao I'm not that Grumpy! Where's my hoodie at Immunefi hahaha?
Joined December 2025
- Tweets57
- Following77
- Followers546
- Likes134
GrumpyLord retweeted
Quick thoughts on the events I missed over the past two months:
- The XRP bug is a great finding, but the reward was low. But even Ethereum had a $250k max bounty a few months ago, so I wouldn’t criticize Ripple too hard.
- The max cap wasn’t specified in the XRP bounty program, so most hunters didn’t even bother checking it.
- The $50k Vercel bounty is too low. They advertised a $1 million bounty, which is misleading, since there's a $50k max cap. Are they expecting 20 Criticals?
- Other projects continue lowering their bounties or closing programs while hacks increase. I understand that it hurts to pay so many reports, but there’s no coming back from a hack.
- The “Duplicates” problem hasn’t been solved. You can still report a Critical issue, prevent major damage to a project and its users, and they will still try to find a way to pay you nothing while pointing to some non-impactful report as sharing the same root cause. Platforms should address this scam immediately.
- The LLM decompilation movement is pretty cool. It's the end of the era of closed-source code.
- People building security tools that depend on LLM tokens should try to make a profit today, or have a clear plan to sell their company before models get better. There's no long-term plan.
- LLM spam continues to be the main trend for getting bounty rewards. It feels like buying lottery tickets. The more tokens people spend, the more chances they have of landing an actual exploit. Having a unique approach seems to help too. But nobody is performing much better than the model they use, since there's no clear outstanding winner in the leaderboards.
- We’re getting to the end of 2026, and bounty rewards paid haven’t increased 10x with AI. According to Grok, for the top 100 on Immunefi the total earnings were:
* 2026 $16M, 1364 reports
* 2025 $11M, 820 reports
* 2024 $21M, 775 reports
* 2023 $17M , 559 reports
* 2022 $57M, 443 reports
- What happened with Ledger is worrisome. Keep improving your OpSec, whitehats.
Personal thoughts:
We keep seeing more and more bugs in all kind of software. That's not because of superhuman AI capabilities. It's because how bad we've been building software over decades in terms of security.
Nobody cared about exploits because they were difficult for the average hackers. Now everyone has a low-level-IQ tool that can crack neglected code, and we see the results.
We're in a transition phase, where LLMs trained with human bugs are outperforming the average guys. We'll probably get to an era of LLMs-code-first, with LLM bugs that with unprecedented vulnerabilities.
Yes, LLMs are just that bad at coding, and the current models might not be able to see some obvious errors, since they also have "cognition bias".
I see a bright future for bounty hunters, full of vulnerabilities waiting to be found and prevented. We just need to solve the bug-pocalypse first if we don’t want blackhats to win.
Kinda feeling the same way lately. This isn't really a regular job... If you do this seriously, it will consume every single ounce of time you have. There are no breaks really. This is a competitive hustling grind culture.
At some point of being "locked" in for so long, you'll zone back out, touch the hair on your arm and realize "Damn.... I'm alive".
You can make a lot of money but if you have no time and nothing truly fulfilling in your life, you'll just feel empty
It's important to be able to let go sometimes and go enjoy life a little. Life is not just bugs.
If you make bugs your whole life, eventually the biggest bug won't be in the code, it’ll be thinking life can wait.
Man, I feel so tired of everything *doing bug hunting*. It’s gotten to the point where I could find a vulnerability right now and not even feel excited enough to report it. Funny thing is, I can’t even quit or walk away from this. I don’t even know what’s still keeping me going. Yeah, maybe it’s the goals I set for myself, but honestly I think it’s something deeper than that. Something I probably haven’t seen yet that’ll come unexpectedly someday. Until then, I just keep hacking and don’t really give a fuck about anything else going on.
GrumpyLord retweeted
i am hiring a BD lead at @therealgregoAI
DM if interested
$1.6M prevented from Theft
He's back.
@GrumpyLord36678 just got a $50,000 payout.
Their total earnings are now $171,633.
At what threshold should they finally drop the Grumpy and become CheerfulLaurie?
Pledge $IMU on their profile: immunefi.com/pledge/GrumpyLo…
I just found a confirmed bug on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…
Podium?
Soon (;
1
64
1,914
Top ranked hits different ahaha
The leaderboard as to update again lmao
I've surpassed that by a good margin
Projects take the time to read your reports when you have reputation. The beginning was rough... Projects used to not even read my reports and just close them!
I used to dream of this moment and it finally happened
After so much hard work and perseverance, I finally made it in the top 100 of whitehats of all time on Immunefi @immunefi
I am 4th place in the past 90 days (:
It's been a long rough ride. I'd like to personally thank Immunefi for giving me the opportunity and making all this possible! I'm forever grateful to have had the chance to have an impact and to have contributed positively to the space!
No dream is ever impossible. it's only impossible if you give up
KEEP working hard, be patient and let time do its thing
Next goal is top 40 on Immunefi all times and 1st place next quarter
I just found a confirmed bug on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…
This is my first audit contest, not bad... Another high duplicate except for this one and we'll see how it'll end! Hope I make podium
I just found a confirmed bug on @immunefi #immunefitribe immunefi.com/s/ss/?severity=…
Another High bites the dust
1
7
932
Coming back to the “What’s the biggest thing bug bounties gave you?” Question,
Money aside, BB taught me the art of not giving up and the art of not giving a fuck. Hunting for bugs has been a spiritual journey more than anything else...
If you are in the beginning of your journey, you probably see other people making it big. Making big dollars like @Ehsan1579. You sit there and ask yourself just “How”. What do they have that I don’t? As rejections roll out and your reports get closed one after the other one, all you ever feel like is giving up.
You might feel defeated, unsatisfied, all the small chatter in your head is telling you to give up… But your EGO won’t let you. EGO isn’t all bad, as society likes to condemn it. I’d go as far as to say that ego is the key ingredient in an industry as cut-throat as BB.
In moments like these, your family, your friends and whoever you consider close will try to tell you that maybe it’s just not for you.
Solution? -> cut everyone. Don’t let anyone get to you and put your head down, analyze what is going wrong, how to get better and try new strategies. That’s the only difference between the ones who make it and the ones who don’t.
Do not take “no” for an answer. If a project closes your report but you know you are right, make sure you are right and then ask for mediation with all the facts you have. You’d be surprised how many projects close valid in-scope issues. Same thing applies if they try to reduce the severity or pay you “peanuts” for what it’s worth.
I’ve been working in DEFI for years now, learning the ropes, building projects. All of them were a fluke until I tried Immunefi. I worked every waking minute for 8 months straight without any payout.
Then… in September I got my first bug confirmed. A “Low” for $2000. I was ecstatic, I was excited. For literally 3 days, I was listening to music just staring and the “Confirmed” ticket.
You see bug bounty is a bit like the casino, the difference is instead of betting money, you bet time (sometimes it does cost money too) and the payouts hit like a truck and you never quite expect it fully.
It’s like a drug. And like a drug, you want more of it and you soon become accustomed to a certain level (“the tolerance”). They say you always chase the first high and it’s very true for bug bounty as well.
The months following I was finally averaging at least 1 paid report per month. That was until January. I’ll never forget it, I had 9 confirmed reports in a row. The “High” hit soooo strongly. But with every high comes a low. Doubts cripple in, you start rationalizing it. You tell yourself that “I just got lucky”. The bug Immunefi posted on their page was from January.
This cycle repeats endlessly. Turns out that February was an even better month for me. The thrill of the unknown and the unexpected is what makes it fun. I do not think I would be doing this if you took that out of the picture.
It was a journey, a very difficult one I’d might add. But in the end, it was worth it. It built me into a stronger more resilient person. It thought me patience.
Reports being closed hurt. Probably one of the worst types of rejection out there. But at some point in time you get used to it and have to learn how to detach yourself from the emotions and trust the process. It’s a numbers game after all.
I am waiting for the leaderboard to update now (long due)! I’m curious to see if I finally made it into the top 100 of whitehats of all times. (Currently sitting at $175k in earnings from 22 reports)
It’s all just a matter of time after all (;
GrumpyLord retweeted
There is a man somewhere right now who have;
- No girlfriend
- No side chics
- No sneaky links
- No cheating at all
- Almost no friends
Just him and his grind.
If you're this man, how's life bro?
GrumpyLord retweeted
Top 3 Hardest things in life:
1. Trying to get a girlfriend.
2. Preventing the protocol from lowballing your critical finding.
3. Trying to buy and recharge a sim card as a tourist in Buenos Aires Argentina.
