Skip to content
Connect AISign inSign up free

Bug bounty program

CO

Coinbase

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
16
Disclosed reports
80
Subdomains
1,045

Most upvoted reports80

All reports
Most upvoted reports of Coinbase
ReportWeaknessDisclosedBountyVotes
Double Payout via PayPalAnalysed#307239Input Validation and Logic2018-04-04$10,000324
Ethereum account balance manipulationAnalysed#300748Input Validation and Logic2018-03-21–276
ETH contract handling errorsAnalysed#328526Input Validation and Logic2018-04-04–208
HTML injection in apps user reviewAnalysed#104543No weakness recorded2015-12-21$20031
Authentication Issue#176979Access Control2017-01-05$20027
[buy.coinbase.com]Content Injection#218680No weakness recorded2017-05-25–26
Captcha Bypass in Coinbase SignUp Form#246801Misconfiguration and Insecure Design2017-09-05$10023
Bypassing 2FA for BTC transfers#10554Authentication2014-09-25$1,00018
OAuth authorization page vulnerable to clickjacking#65825Authentication2016-02-07–16
Prepopulation of email address and name leaks information provided to other merchants#316290Misconfiguration and Insecure Design2018-04-02–16

Subdomains1,045

Root
Scope
Name suggests
First seen
Text file1,045 names
Subdomains of Coinbase
NameScopeFirst seen
braintree-webhooks.coinbase.comIn scope2026-11-14
broadcast.coinbase.comIn scope2026-11-14
buy.coinbase.comIn scope2026-11-14
card.coinbase.comIn scope2026-11-14
careers.coinbase.comIn scope2026-11-14
cbam.coinbase.comIn scope2026-11-14
cbs.coinbase.comIn scope2026-11-14
cca-lite.coinbase.comIn scope2026-11-14
ccm.coinbase.comIn scope2026-11-14
apidocs.teamup.ccommerce.coinbase.comIn scope2026-11-14
cde.coinbase.comIn scope2026-11-14
status.cde.coinbase.commonitoringListed out of scope2026-11-14
cdp.coinbase.comIn scope2026-11-14
cdp-webhook.coinbase.comIn scope2026-11-14
cdp-webhook-sandbox.coinbase.comtestIn scope2026-11-14
demo.cdp.coinbase.comtestIn scope2026-11-14
docs.cdp.coinbase.comIn scope2026-11-14
portal.cdp.coinbase.comIn scope2026-11-14
private-beta-docs.cdp.coinbase.cominternal, stagingIn scope2026-11-14
proxy.cdp.coinbase.comIn scope2026-11-14
support.cdp.coinbase.comIn scope2026-11-14
cdpstatus.coinbase.comIn scope2026-11-14
cf-ssl28641-protected.coinbase.comIn scope2026-11-14
cf-ssl28641-protected-www.coinbase.comIn scope2026-11-14
chain-proxy-wallet.coinbase.comIn scope2026-11-14
chd.coinbase.comIn scope2026-11-14
ci-bny.coinbase.comciIn scope2026-11-14
ci-bny-dev.coinbase.comci, devIn scope2026-11-14
citi-intl-callback.coinbase.comIn scope2026-11-14
citi-intl-sign.coinbase.comIn scope2026-11-14
citi-intl-sign-dev.coinbase.comdevIn scope2026-11-14
citi-intl-transport.coinbase.comIn scope2026-11-14
citi-intl-transport-dev.coinbase.comdevIn scope2026-11-14
citi-v2-sign.coinbase.comIn scope2026-11-14
citi-v2-sign-dev.coinbase.comdevIn scope2026-11-14
citi-v2-sign-staging.coinbase.comstagingIn scope2026-11-14
citi-v2-transport.coinbase.comIn scope2026-11-14
citi-v2-transport-dev.coinbase.comdevIn scope2026-11-14
citi-v2-transport-staging.coinbase.comstagingIn scope2026-11-14
claims.coinbase.comIn scope2026-11-14
cloud.coinbase.comIn scope2026-11-14
cloud-api.coinbase.comapiIn scope2026-11-14
assets.cloud.coinbase.comIn scope2026-11-14
console.cloud.coinbase.comadminIn scope2026-11-14
docs.cloud.coinbase.comIn scope2026-11-14
portal.cloud.coinbase.comIn scope2026-11-14
comm.coinbase.comIn scope2026-11-14
commerce.coinbase.comIn scope2026-11-14
api.commerce.coinbase.comapiIn scope2026-11-14
beta.commerce.coinbase.comstagingIn scope2026-11-14
status.commerce.coinbase.commonitoringListed out of scope2026-11-14
wallet.commerce.coinbase.comIn scope2026-11-14
community.coinbase.comIn scope2026-11-14
staging.community.coinbase.comstagingIn scope2026-11-14
consumer.coinbase.comIn scope2026-11-14
contentful.coinbase.comIn scope2026-11-14
corporate.crl.coinbase.cominternalIn scope2026-11-14
development-device.crl.coinbase.comdevIn scope2026-11-14
sandbox.crl.coinbase.comtestIn scope2026-11-14
crypto.coinbase.comIn scope2026-11-14
cohort-service.crypto.coinbase.comIn scope2026-11-14
compute-service.crypto.coinbase.comIn scope2026-11-14
coordinator.crypto.coinbase.comIn scope2026-11-14
coordinator1.crypto.coinbase.comIn scope2026-11-14
operations-service.crypto.coinbase.comIn scope2026-11-14
operations-service1.crypto.coinbase.comIn scope2026-11-14
custody.coinbase.comIn scope2026-11-14
api.custody.coinbase.comapiIn scope2026-11-14
docs.custody.coinbase.comIn scope2026-11-14
www.docs.custody.coinbase.comIn scope2026-11-14
status.custody.coinbase.commonitoringListed out of scope2026-11-14
d1a598d2-dc7f-48bc-8c73-c067bcc8776e.coinbase.comIn scope2026-11-14
data.coinbase.comIn scope2026-11-14
dev.coinbase.comdevIn scope2026-11-14
claims.dev.coinbase.comdevIn scope2026-11-14
pg-sign-key-coinbase-006.dev.coinbase.comdevIn scope2026-11-14
developer.coinbase.comIn scope2026-11-14
api.developer.coinbase.comapiIn scope2026-11-14
developers.coinbase.comIn scope2026-11-14
dns.coinbase.comIn scope2026-11-14
documents.coinbase.comIn scope2026-11-14
doh.coinbase.comIn scope2026-11-14
dns.doh.coinbase.comIn scope2026-11-14
dns.dns.doh.coinbase.comIn scope2026-11-14
dns.dns.dns.doh.coinbase.comIn scope2026-11-14
dns.dns.dns.dns.doh.coinbase.comIn scope2026-11-14
doh.dns.dns.dns.doh.coinbase.comIn scope2026-11-14
doh.doh.dns.dns.dns.doh.coinbase.comIn scope2026-11-14
doh.dns.dns.doh.coinbase.comIn scope2026-11-14
doh.dns.doh.coinbase.comIn scope2026-11-14
doh.doh.coinbase.comIn scope2026-11-14
dp.coinbase.comIn scope2026-11-14
drops.coinbase.comIn scope2026-11-14
dynamic-assets.coinbase.comIn scope2026-11-14
eaa-dev-integrations.coinbase.comdevIn scope2026-11-14
em.coinbase.comIn scope2026-11-14
o1.em.coinbase.comIn scope2026-11-14
o4891.abmail.email.coinbase.comIn scope2026-11-14
emails.coinbase.comIn scope2026-11-14
embedded-wallet.coinbase.comIn scope2026-11-14

1,037 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated