HackerOne blocking payouts
Ukrainian hackers and security researchers say bug bounty platform HackerOne is withholding their bug bounty rewards, in some cases thousands of dollars, and refusing to let hackers withdraw their earnings.
Several hackers and researchers with affected HackerOne accounts said in tweets that HackerOne is blocking payouts, citing economic sanctions and export controls following the Russian invasion of Ukraine in late February, but that the sanctions don’t apply to them.
Bug bounty company HackerOne acts as an intermediary between the hackers and security researchers who find and report security bugs and the companies that ask for help fixing their products and services. In 2020, HackerOne paid out more than $107 million in bug bounty rewards to researchers, many of whom rely on their earnings as a source of income.
Russia-Ukraine War Heavily Using Telegram for Disinformation and Hacktivism
Other hackers and researchers who are still in Ukraine are reporting similar circumstances, that their accounts are frozen or that they cannot withdraw funds. Bob Diachenko, a Ukrainian security researcher whose findings have been periodically reported on TechCrunch, said in a tweet that he had $3,000 in earnings since February currently withheld from his account.
The move to block payouts across Ukraine has been met with anger and confusion and without any apparent official communication from the bug bounty company. It’s not clear what sanctions or export controls HackerOne is referring to. The U.S., the European Union, and several other allied nations have imposed stiff economic sanctions against Russia and Belarus, as well as an embargo on territory in the eastern Donbas region of Ukraine currently held by separatist groups and Crimea, which was annexed by Russia in 2014. But Ukraine is not subject to those sanctions.
One affected Ukrainian hacker who goes by the handle kazan71p said in a tweet that they are “not from Crimea or Donbas … you just suspended all Ukrainian accounts, you just put the whole country under sanctions,” referring to HackerOne.
HackerOne has not said why it blocked payouts to Ukrainian hackers and researchers or cited the specific sanctions it believes apply. When reached several hours before publication, a HackerOne spokesperson was unable to immediately comment or answer our questions. TechCrunch will update if and when we learn more.
The account freezes appeared to come into effect around the time that HackerOne chief executive Marten Mickos said in a since-deleted tweet thread that HackerOne would “re-route” earnings for hackers living in sanctioned countries — notably Russia and Belarus — to charity since sanctions prevent the company from transacting with those residents.
HackerOne blocking payouts
