Immunefi Island 3: A Guide to the Virtual Hacking Adventure of the Year

The Summary

Immunefi Island is a semi-quarterly event hosted by Immunefi.com that pits security researchers from all over the globe against one another in a fictional universe battle-royale, submitting valid reports to gain points. The individuals (and team) with the highest collective points at the end of the 8–9 week event gain champion status and win the grand prize, which is also a surprise reveal each time an Immunefi Island event is conducted.

The mechanics can be summed up as this:

Submit reports -> Get points.

Stay ahead of the last X spots to avoid elimination.

Win if you have the most points and survive by the end of the event.

Immunefi Island 3 (current iteration)

The third iteration of the Island event has grown in complexity over the previous two, as you’ll learn reading below about Immunefi Island 1 and 2.

Immunefi Island 3 has a pirate theme, and is more of an interactive board game. However, the essential principles remain the same:

1. SRs sign up for the event (via registration form).
2. SRs are split into teams (called ships). Each ship elects a Captain who acts as a leader. The rest of the SRs are called Crew.
3. Both Crew and Captains submit reports on immunefi.com Bug Bounty Programs, Audit Competitions, or Attackathons.
4. Every real life $1 dollar earned on valid reports and payouts adds $1 dollar of in-game cash to your ship’s war chest (which are team funds).
5. Rolling dice and taking actions on the board also grant you money, or opportunities to earn more in-game money for the ship’s war chest.
6. The first team to use their war chest to buy the Treasure Island Tile (valued at a minimum bid of $1.5M) wins the game.

How it started with Immunefi Island 1

Immunefi Island started out as a simple concept:

What if we put Security Researchers on a virtual “island”, and narrate their survival based on the outcome of their reports? 

The first “reality TV show” for whitehats kicked off in October of 2024, as a 100% experimental initiative, and 42 SRs found themselves virtually stranded on an island with nothing but their wits to save them.

A weekly chopping block was designated to remove the 5 worst performing SRs per week, in order to leave only the best 7 survivors at the end of 9 weeks. 

Nobody knew how the SRs would react. They might not even take notice. Perhaps nothing would change.

Or they might lock in and participate in the single, craziest virtual SR competition we’ve ever put together for the first time.

In the end, it was well-received by the SRs who decided to engage and fully threw themselves into the virtual roleplay and storytelling of the event, making memes, sharing jokes, and genuinely putting in effort to submit reports.

The SRs who managed to get confirmed reports saw their daily achievements immortalized as events on the Island, narrated as part of its collective story. We saw surprises, rewards, traps, betrayals, and more! Everyone had a part to play and their story changed the overall direction of the main plot as well (yes, there was a main plot).

When it finally came time for elimination, there was no shying away from it. Some heads would have to roll. But immediately before that, a one-time “immunity” challenge was issued, giving SRs on the chopping block a chance to save themselves:

The result was definitely entertaining, and memorable, as at least one SR took it upon themselves to post the “bathwater” image on X. The rest of them however, did not survive the first week’s elimination:

Eventually, the first island event ended after 8 weeks of eliminations, and SRs were given the storied ending to an event of a lifetime. The grand prize, won by LonelySloth, was an DJI Avata 2 FPV Drone, and custom island pattern board shorts for the Runner-Ups who made Top 5.

More than 80 reports were submitted, with a total value of $220,000+ paid out to the SRs who participated, making this not just a fun side-event but also equivalent to having two $100k+ competitions that ran over 8 weeks. 

Everyone was asking the same questions: When is the next event, and can I join?

Immunefi Island 2

The second Immunefi Island event was by far our biggest yet. Held within three months after the first event had ended, we had already started designing a completely new vibe and story from the get go, transportings SRs from sandy beaches into a new cyberpunk world of Death City.

As soon as sign-ups opened, we were greeted by a flood of responses resulting in 109 final registrants for the Immunefi Island 2 event. Our first cyberpunk adventure was ready to begin with the biggest audience yet.

Teasers and giveaways had been going out weeks before, introducing SRs to the concepts of “factions”, basically large teams that every SR will belong to and contribute their points towards. The idea was to give everyone a shared identity, while also creating allies and opponents as a result.

Each faction was given a private chat channel where they could meet other members of their faction, strategize, or just talk about their current hunting experiences and methods. There is far too much gold in these channels to be fully shared, but here are a few excerpts:

These above were only taken from the Froge faction chat alone. There are also examples of in-depth strategy and security discussion in this and the other faction channels, where SRs were not only sharing advice but also mentally supporting and encouraging one another, and sometimes even mentoring with their experiences.

Elite whitehat Nnez (now an Allstar) was particularly commended at the end of the event by their fellow SRs for being a present and helpful mentor to his teammates. After the event, many participants noted that private faction chats encouraged more open conversations and yielded better responses from other SRs, as the participants for these spaces were more curated than in the open channels.

Overall, the event featured higher production value, with more coordinated visuals and challenges compared to the previous one. It presented a more complex yet coherent narrative, complete with defined characters, canon events, and structured challenges. However, this shift also led to a more serious tone, sacrificing some of the humor that was more part of the previous Island event.

One of the main differences with Immunefi Island 2 came in the form of a dedicated online leaderboard where everyone could check their current points, standing, and how their faction was doing. 

The leaderboard was updated once a day and also showed who was going to be eliminated that week, along with a timer. Some interactive features were also build in for cosmetic effect near the end of the event. SRs were happy to be able to see their progress in near real-time.

The leaderboard was initially dominated by Loyalists, the faction led by Nnez. But in the final weeks of evaluation, after submission had stopped, confirmations started coming in and propelled the PUGS faction directly into the lead, with more valid reports than the other two factions combined. This led to Nnez clinching the #1 Champion spot, but the Best Faction was won by the PUGS instead, both the results of valiant efforts.

As for the grand prize, Nnez was awarded an all-expenses-paid vacation to a real-life destination of his choice, courtesy of Immunefi. 🏝