Sony has paid the maximum possible reward of $50,000 to a security researcher known as 2tonejordy under the PlayStation Bug Bounty program hosted on HackerOne. According to public statistics, this is only the second time the company has reached the upper limit of the payout in the entire history of the program, which launched in 2020. For comparison, the average payout within the initiative is around $400, making the record sum anomalously high against typical bonuses.
A record payout amid modest average statistics
The gap between the average and maximum payout illustrates how rare findings are that Sony considers critical. The Bug Bounty program has existed since 2020 and has established steady statistics dominated by small rewards for common errors. Reaching the $50,000 ceiling has only occurred twice, indicating that the company reserves the maximum amount for vulnerabilities affecting fundamental console security mechanisms rather than local bugs.
Critical PlayStation 5 hypervisor vulnerability
According to sources, the researcher discovered a critical vulnerability in the PlayStation 5 hypervisor—the software layer responsible for isolating and managing the console's computing environments. The discovered exploit, according to materials, had previously been used by the well-known modder theflow0 to run the Linux operating system on the latest-generation console. Thus, this was not a theoretical possibility, but a practically implemented bypass of the standard PlayStation 5 environment.
Conflict with modder theflow0 and exit from the hacking scene
According to the recount of events, theflow0 asked not to submit the report to Sony before the release of GTA VI. However, after third parties also began closing in on discovering the same flaw, 2tonejordy decided to officially notify the company's engineers. This decision, sources say, triggered a wave of controversy in the modding community and led to theflow0 announcing his retirement from the hacking scene. Thus, a conflict formed around a single vulnerability between the researcher's interest in official compensation and the modder's desire to maintain control over the disclosure timing.
Scale of Sony's payouts over recent months
In total, over the past three months, Sony has paid out more than $228,000 for discovered bugs, and the cumulative reward amount under the program has exceeded $1.15 million. These figures confirm that the company is consistently investing in its vulnerability reward program, and 2tonejordy's record payout has become a prominent, though not isolated, part of it. For security researchers, this is a signal that critical findings in console infrastructure are still valued at the top of the scale.
