---
title: "Sony pays a record $50,000 to hacker for critical PlayStation 5 hypervisor vulnerability"
description: "Sony paid a record $50,000 to researcher 2tonejordy for a critical PlayStation 5 hypervisor vulnerability. This is only the second maximum payout in the history of the Bug Bounty program since 2020."
date: 2026-10-16T22:54:08.206Z
lang: en
url: https://xab.info/en/posts/sony-pays-50000-hacker-playstation-5-vulnerability
tags: [sony, playstation-5, bug-bounty, cybersecurity, hackerone]
author: "Roman V."
publisher: "XAB.info"
---

# Sony pays a record $50,000 to hacker for critical PlayStation 5 hypervisor vulnerability

![Sony headquarters building and PlayStation logo against a blue sky with clouds](https://xab.info/media/2026/10/16/sony-vyplatila-50000-hakeru-za-uyazvimost-playstation-5/sony-vyplatila-50000-hakeru-za-uyazvimost-playstation-5-1.webp)

## Key Points

- Sony paid $50,000—the maximum amount in the PlayStation Bug Bounty program—to researcher 2tonejordy.
- This is only the second maximum payout in the program's history since 2020, with an average bounty of around $400.
- The discovered vulnerability affected the PlayStation 5 hypervisor and was previously used by modder theflow0 to run Linux.
- Official notification to Sony sparked community controversy and led to theflow0's announcement of leaving the hacking scene.
- Over the past three months, Sony has paid out over $228,000, with total rewards exceeding $1.15 million.

Sony has paid the maximum possible reward of $50,000 to a security researcher known as 2tonejordy under the PlayStation Bug Bounty program hosted on HackerOne. According to public statistics, this is only the second time the company has reached the upper limit of the payout in the entire history of the program, which launched in 2020. For comparison, the average payout within the initiative is around $400, making the record sum anomalously high against typical bonuses.

### A record payout amid modest average statistics

The gap between the average and maximum payout illustrates how rare findings are that Sony considers critical. The Bug Bounty program has existed since 2020 and has established steady statistics dominated by small rewards for common errors. Reaching the $50,000 ceiling has only occurred twice, indicating that the company reserves the maximum amount for vulnerabilities affecting fundamental console security mechanisms rather than local bugs.

### Critical PlayStation 5 hypervisor vulnerability

According to sources, the researcher discovered a critical vulnerability in the PlayStation 5 hypervisor—the software layer responsible for isolating and managing the console's computing environments. The discovered exploit, according to materials, had previously been used by the well-known modder theflow0 to run the Linux operating system on the latest-generation console. Thus, this was not a theoretical possibility, but a practically implemented bypass of the standard PlayStation 5 environment.

### Conflict with modder theflow0 and exit from the hacking scene

According to the recount of events, theflow0 asked not to submit the report to Sony before the release of GTA VI. However, after third parties also began closing in on discovering the same flaw, 2tonejordy decided to officially notify the company's engineers. This decision, sources say, triggered a wave of controversy in the modding community and led to theflow0 announcing his retirement from the hacking scene. Thus, a conflict formed around a single vulnerability between the researcher's interest in official compensation and the modder's desire to maintain control over the disclosure timing.

### Scale of Sony's payouts over recent months

In total, over the past three months, Sony has paid out more than $228,000 for discovered bugs, and the cumulative reward amount under the program has exceeded $1.15 million. These figures confirm that the company is consistently investing in its vulnerability reward program, and 2tonejordy's record payout has become a prominent, though not isolated, part of it. For security researchers, this is a signal that critical findings in console infrastructure are still valued at the top of the scale.

## Fact-Check & Sources

- [Рекордный баг-баунти: Sony выплатила $50,000 хакеру за найденную критическую уязвимость в PlayStation 5](https://www.goha.ru/rekordnyj-bag-baunti-sony-vyplatila-50000-hakeru-za-najdennuyu-kriticheskuyu-uyazvimost-v-playstation-5-4Ve1A0) - Primary source. Confirms the $50,000 amount, the status of the second maximum payout since 2020, average bounty ~$400, PS5 hypervisor vulnerability, connection with modder theflow0, and total payouts ($228,000 in 3 months, >$1.15M total). The narrative about the conflict and theflow0's departure is a recounting of the source.

## FAQ

### How much did Sony pay researcher 2tonejordy?

Sony paid $50,000, the maximum possible reward in the PlayStation Bug Bounty program on HackerOne.

### How rare is such a payout?

According to public statistics, this is only the second time the maximum amount has been reached in the program's history since 2020, while the average bounty is around $400.

### What was the discovered vulnerability?

The researcher discovered a critical PlayStation 5 hypervisor vulnerability; the exploit was previously used by modder theflow0 to run Linux on the console.

### What is the total volume of Sony's program payouts?

Over the past three months, Sony has paid out over $228,000, and the total amount of rewards has exceeded $1.15 million.