july 2026

immunefi bug bounty, recipient guide

Verify your identity to receive your payment

Before we can send your payment, we need to confirm who you are. Verification takes about 5 to 10 minutes and is handled by SumSub, a specialist identity verification (KYC) provider trusted by financial companies worldwide.

Have these ready before you start

  • A government-issued ID (passport, national ID, driver's license, or residence permit)
  • A phone or computer with a working camera
  • A proof of address document (utility bill, bank statement, or government letter)
  • Your USDC wallet address (Ethereum / ERC-20)

Seven short steps. You can pause and come back; your link keeps your progress.

Open your secure link and give consent

You will receive a verification link by email from Cosmos. Open it on a phone or computer with a camera; a phone is usually easiest for the photo steps.

The first screen asks for your consent to process your data for verification. Read it, tick the consent box, and press Continue.

good to know

The link is personal to you. Do not forward it; anyone who opens it would be verifying as you.

Scan your identity document

Choose the country that issued your document, then the document type: passport, national ID, driver's license, or residence permit.

Capture clear photos of the document when prompted. For two-sided documents you will photograph both sides.

tip

Use good lighting, keep the whole document inside the frame, and avoid glare on the photo page. Blurry or cropped photos are the most common reason a document needs to be redone.

Take a selfie (liveness check)

Allow camera access when your browser asks. Center your face in the oval and follow the on-screen prompts; you may be asked to turn your head slowly.

This confirms you are a real, present person and matches your face to the photo on your ID. It takes under a minute.

good to know

Remove sunglasses and hats, and find even lighting with no strong backlight. Glasses are usually fine.

Upload proof of address

Upload a document that shows your name and home address together, usually dated within the last 3 months. Accepted documents include:

  • A utility bill (electricity, water, gas, internet)
  • A bank or card statement
  • A government or tax office letter

A clear photo or a PDF download from your provider both work.

tip

Screenshots that crop out your name or the date are usually rejected. Use the full page.

Verify your email

Enter your email address and we will send you a 6-digit code. Type the code into the boxes to confirm the address belongs to you.

good to know

Use an inbox you check often. Review updates, and the separate tax form request described in step 7, go to this address.

Complete the payment questionnaire

The last step is a short questionnaire about your payment. It adapts to your answers, so you only see questions that apply to you.

  • recipient
    Choose individual or company. If a company, you add the company's legal name, registration number, and country, and upload a register extract showing you as a director or authorised signatory. You also confirm whether you are the ultimate beneficial owner; if you are not, you provide the real recipient's details.
  • payment
    Your Immunefi handle and the report reference for the finding being paid.
  • u.s. status
    You answer whether you are a U.S. citizen or green card holder (or otherwise a U.S. person for tax purposes). This one answer decides which tax form you are asked for.
  • tax
    If you answered yes, you acknowledge that a Form W-9 request will be emailed to you separately, and that your payment completes once it is received. If you answered no, you acknowledge the same for a Form W-8BEN.
  • payout
    Your USDC wallet address on Ethereum (ERC-20), plus a box confirming the wallet is yours and under your control.
  • declarations
    You confirm your information is accurate, consent to screening, and acknowledge that payment can be withheld for failed screening or false information.
important

Double-check the wallet address before you submit. Payments sent to the address you provide cannot be recalled.

Submit, then watch your inbox

After you submit, you will see a confirmation that your information is under review. Review typically takes 1 to 3 business days.

Two things happen next:

  • You will receive a separate email requesting your tax form: a W-9 if you are a U.S. citizen or green card holder, or a W-8BEN if you are not. Complete it promptly; your payment is released only after your verification is approved and that form is received.
  • If any step needs redoing (for example, a blurry document photo), you will get an email with a link to just that step. This is normal and quick to fix.
what "approved" means

Once verification is approved and your tax form is on file, Cosmos releases your payment to the wallet you provided.

help & faq

What device do I need?
Any modern phone or computer with a camera and an up-to-date browser. A phone is easiest for the document and selfie steps. Camera access is only used during those steps.
Can I verify more than once?
One verification profile per person. If you are paid again later, your existing profile is reused and you usually will not repeat these steps.
What happens to my data?
Your documents are processed securely by SumSub on behalf of Cosmos, used only for verification and compliance, and handled under data protection law. They are never used for marketing.
Who do I contact for help?
Reply to the email that contained your verification link, or contact your Cosmos point of contact. Include your name and the email address you used to verify.