Mitchell Amador Immunefi CEO Reveals Why Crypto Hacks Are Changing Forever | Bybit, AI & North Korea

Sure. So I'm Mitchell Amador. I'm the founder of Immunefi. Immunefi is crypto's most effective and widely used tool for preventing hacks typically executed by threat actors like North Korean hackers, but also hacking groups all around the world to steal billions and billions of dollars. And the vast majority of major projects in the industry are using Immunefi in order to prevent these hacks. And specifically how they do that is leveraging the global security committee for crypto to find and disclose vulnerabilities before they can become exploits. This happens of course via bug bounties on mainnet, but also before in the audit process and at the level of code review in a company or project's development pipeline. So in all these places, our job is to come in to find every possible attack vector, to find every possible bug that could lead to people losing money, and to stop it before it can be used by nefarious actors for theft.

Sure. Great question. So, we were alerted to the potential of the wind-down of the C4 platform and the C4 team and the Zelic team, ever being upstanding actors in the community, they asked us if we could help if there was a way that we could arrange for an excellent quality of service for their customers, if there's a way that we could handle that burden, to which we said absolutely yes, of course, happy to do whatever we can to support them and their users. And we stepped in to take over those relationships wherever they might be desired by those customers. So this is the major part of it. Now of course what that became is the kind of influx of many wardens who were working on bug bounties on C4 to come and work on the Immunefi platform as well and a lot of attention as we go and continue on their legacy of good work in the industry or how they're operating about things. So that is the major parts of it. It's really about ensuring the best possible handoff. I think C4 realized they created incredible value over this space over the years, but it wasn't clear how they could keep going forward with that. They wanted to ensure that every single customer had the best possible experience and the best possible security. And so they tapped us on our shoulder to take over that mantle of responsibility for them and continue securing their customers.

So the major cause, so let's take a step back. Right now a number of security firms in the industry have shut down and that's because the industry is in this period of consolidation. There's a ton of crypto growth happening that is primarily going on in the new institutional market as opposed to the traditional DeFi or decentralized financial market which was the key historical driver for audits and where a lot of these firms were most powerful and most relevant. The security bar for these new institutional players is generally not as high and they do not have as much standing understanding of what types of solutions are effective. And so for example, audit competitions are less popular with them since they don't know better. And this was all exacerbated last year when some players entered the market and effectively tried to give the product away at a loss and undercut the margins of the business as a whole. This posed a big, big problem to players like Code4rena. I mean Code4rena's primary business was audit competitions and they found that basically a number of other players in the industry were offering that product for free, okay, or less than free, taking out a cost to themselves effectively in order to win customers on other products. And this is what made Code4rena, I think, into a difficult, difficult spot. It wasn't for a lack of execution. I mean they built some of the best audit contest products, they innovated on the model in the first place. A very strong team with a lot of user loyalty, a lot of brand loyalty, but ultimately when everybody else around you is offering to pay you to work for you and you are demanding that you be paid at, you know, a fair wage or a fair price of some kind for your work, you can only survive that so long. Now, this state of affairs has come to an end. The players who did that have gone out of business in various ways or they have sidelined those business lines. They recognized that it is not feasible and affordable to run those products at a loss that was never sustainable. And so that period of the industry is over. Okay. But even though it's over, you know, that doesn't mean that things have returned to their previous status quo. They're only gradually getting back to there and into a more sustainable long-term place. And this has pushed the security industry and crypto into this period of consolidation where firms are working together, where firms are merging with one another, where firms are partnering more aggressively with another, firms are focusing on the specific things that they're best at. So, for example, this C4 case is just as much a case of the Zelic team deciding what they're best at and what they want to focus on and that they don't want to focus on this bug bounties area. And so, by extension, they wanted to pass it to us and we are focused, right? We're the world leader in onchain bug bounties. So, they're passing it to us in order to get the best possible experience for their customers. And this phenomena is happening across the whole industry. It's not a failure of execution. It's more like the winds of the entire industry are changing and we're discovering what the new normal is going to be like and not all of us are going to make it through this stormy period. Okay, some of the boats are going to go down in the process.

Sure. So I think that the challenge that you got with that model is that you had a very long tail of payouts. And so you might have a, you know, a 100 or 200 auditors participate in a particular contest and a few people will take most of the pot and then a very large number of people get 20 bucks or equivalent which is better than nothing really. The approach that we did in Immunefi was a little bit different and it accounts for I think the superior effectiveness of a model. First of all, we took a different approach to securing payouts. Instead of doing this kind of everybody gets a piece of the pie approach, we focused on finding ways to increase the overall bounty rewards in terms of criticals in order to create value for customers. And as a result, this resulted in more money to go around and minimized the pain and the annoyance of these small payout members. Number two, we created conditions and constraints for participation. So there wasn't just one audit competition model. We had a variety of things where you could say you could have your top 10 guys come, your top five guys come, whoever they might be. And in this way, everybody who's coming to participate in that contest knows that if they're going to put aside a week or two to work on this, they're going to be amply compensated. Even if they don't find that much, they're going to do well. And we still get say 90, 95% of the benefit of having the open crowd source model in the proceeds. And the third thing that we did is we very deliberately charge, I mean we have a general policy nowadays. We just charge money. We say look it costs money to run these. There's never a case where we can afford to run this at cost for you guys or less than cost. If you want this service, you know, we have to make this make credible businesses. And that was a I think a bold and risky decision, but our customers have empathized and they have chosen us time and time again and they've accepted that. And so while various of our competitors have ended up bleeding themselves out against this, we have not. We have continued to have our audit competition product be more and more lucrative and in addition to that it has become more and more sustainable. We are now the biggest player in audit contests in the market today. In addition to focusing on these where we already are we are also the biggest player when it comes to audit contests in crypto.

That question no longer makes sense in the way that it once did because it's no longer correct to say that reports are AI generated. Everybody uses AI in creating the reports and structure. But that doesn't mean they're AI slop, right? There's another kind of...

Exactly. So our approach, and we thought about this for years. We've been struggling against not just AI slop but then before that spam. How do you deal with spam reports? And the conclusion that we got to is the only way to do that is to create a fairly high bar for report submission in the first place. And number two to create the tooling around the white hats and the researchers that are going to result in their reports being effective and high quality. And so this is what we've done. There are two examples of this. First of all, in terms of our proof of humanness or our proof of anti-spammer systems, we have the most comprehensive and demanding systems in the industry for this problem. You have to go and prove and hit a fairly high bar that you are a real human being in order to hunt and disclose on Immunefi. And then your reports are going to go through several layers of automated analysis that are going to in turn be scanning for validity. Fundamentally, it's not just a matter of looking for is it, you know, AI generated. We don't mind AI generated reports anymore. We think they're great, provided they're real, provided they're valid. And we've created the world's most advanced systems for detecting that validity. Today, we get the vast majority of bug bounty and responsible disclosure reports in the industry. The vast majority of them are flowing through us every single day. But we have the anti-spam systems in order to handle that load. And just as our colleagues are using AI systems, we are using them too in order to process. Probably the most exciting thing that we're doing on this problem today is what we're doing for Security Researcher Summer 2026. So we call it SR Summer. There's been this depression I think in the community about where AI is taking things but we don't agree with that at all. We think this is the golden age of white hat hackers and we know because we're seeing it. We're seeing bigger payouts than we've had in years. We're seeing more payouts than we had in years. People are earning millions and millions of dollars per month doing this kind of work right now. It's really, really exciting. And what we've done is we've created a new corpus of tools that we call Immunefi Studio. And it combines a lot of the most AI-assisted tooling and workflows that we've built for ourselves and that we've understood in the industry into a platform that we're going to give to every single white hat in the industry. And anything that comes out of that, we're already going to know that it's likely to be valid. We're already going to know that the report is built with best names. We're already going to know that the testing process on the validity of the report was very, very, very thorough. So yes, this has been a historical problem, but the new world we're going into is AI assisted on every which way to the point that we believe this AI slop problem will become a thing of the past.