VeChain launches a $200K Attackathon on Immunefi to secure the Hayabusa Upgrade

VeChain has partnered with Immunefi to launch an Attackathon focused on one of the most significant blockchain upgrades of the year: the Hayabusa Upgrade. 

This Attackathon invites security researchers to explore, test, and strengthen VeChainThor’s live infrastructure during its transition to a more decentralized and dynamic model.

Rewards of up to $200,000 USD are available for impactful findings. 

What is the VeChain Hayabusa Upgrade?

The VeChain Hayabusa Upgrade brings major changes to VeChainThor’s core. It replaces the previous Proof-of-Authority consensus with Delegated Proof-of-Stake, allowing token holders to delegate to validators and participate directly in securing the network. This shift increases decentralization while maintaining performance.

Alongside this, VeChain is introducing dynamic VTHO generation. Instead of fixed rates, VTHO is now generated by staking VET and contributing to securing the VeChainThor network, then distributed as block rewards to both validators and delegators. This adds complexity to incentive structures and network behavior and creates new areas for security review.  

Upgrades like this introduce new logic and new attack surfaces. Every change in consensus, reward structure, or validator behavior opens the door to unexpected vulnerabilities.

The VeChain Hayabusa Upgrade Attackathon brings this updated code under live scrutiny. Security researchers are invited to probe its codebase, find vulnerabilities, and help reinforce the network before these changes go fully into production.

In parallel, VeChain may fix vulnerabilities during the competition. When this happens, the Mitigation Audit unlocks. This additional reward track incentivizes researchers to review fixes, rewarding fast, coordinated response and deeper coverage.

Key details of the VeChain Hayabusa Attackathon

The VeChain Attackathon is a time-boxed competition designed to surface real vulnerabilities in the upgraded protocol. Here’s everything you need to know to get started.

Attackathon timeline

• Start date: September 29, 2025
• End date: October 26, 2025

Overview of rewards

• Maximum reward pool: $200,000 USD
• Rewards are based on the highest severity vulnerability submitted during the competition:
  • Critical: $160,000
  • High: $100,000
  • Medium: $70,000
  • Low: $40,000
  • If no qualifying submissions: $24,000 

Mitigation Audit

An additional $40,000 USD in rewards is available through the Mitigation Audit. This pool is unlocked as in-scope vulnerabilities are resolved during the Attackathon window. 

It rewards researchers who help validate fixes and strengthen protocol defenses in real time.

Full rules, scope, and eligibility requirements are listed on the VeChain Hayabusa Upgrade Attackathon page.

Get ready for the VeChain Hayabusa Upgrade Attackathon 

VeChain and Immunefi have created an Academy of educational resources to help security researchers prepare for hunting success. 

Whether you're new to VeChain or already experienced with EVM chains, the materials will help you ramp up quickly and hunt effectively.

Topics include:

• Core protocol and tokenomics design
• Smart contract operations and safety patterns
• Validator and node infrastructure
• How to deploy a Thor Solo Node and test custom network behavior
• Deep dive on VeChain’s DPoS consensus and dynamic VTHO logic

This is your opportunity to secure a high-impact protocol upgrade and earn life-changing rewards in return. Get started on the VeChain Hayabusa Upgrade Attackathon today.

Happy hunting!