Alchemix keeps 89% of reports off its team, and its bug bounty still caught a critical

• Client: Alchemix, a self-repaying loans protocol, on Immunefi since 2021
• Challenge: from 2022 to 2024, about 7 in 10 bug reports went straight to the engineering team, and only about 1 in 7 of those was valid
• What Immunefi does: runs the bug bounty, with the highest level of Managed Triage in front of Alchemix's team
• Result: a critical in V3 reached the team about 3 hours after it was reported, and 89% of reports were closed before reaching the team in the 12 months to October 2026

Alchemix offers self-repaying loans. Users borrow against a deposit, and the yield on that deposit pays the loan back. Its bug bounty has run on Immunefi since 2021. Alchemix launched V3 in April 2026, after an Immunefi audit competition, and runs a new bug bounty program for it.

From 2022 to 2024, about 7 in 10 reports went straight to Alchemix's team, and only about 1 in 7 of those was valid. Each invalid report still took an engineer's time to read, check and answer. While Alchemix built V3, it still had to keep V2 secure, and early in that period reports came in so often that one developer worked on triage full time.

Before triage, a submission filter decides who can report at all, keeping out accounts with no track record and most bots. Researchers it blocked who then sent reports to Alchemix outside the platform have never had a valid bug.

Both of Alchemix's programs, V2 and V3, run on the highest level of Managed Triage, so Alchemix's engineers no longer read every report. The process behind that level has changed since the V2 program started, and today triage removes spam, duplicates and out-of-scope reports, then checks each remaining report against Alchemix's code, known issues and documentation, verifies the claimed impact, runs the proof of concept where it can and proposes a severity. A report that reaches the team arrives as a brief an engineer can act on.

Alchemix's team still decides which reports are valid, and Immunefi mediates when a researcher disputes a decision. Every report that triage closes stays visible to the team, so it can check triage's decisions at any time.

Ov3rKoalafied says the improved signal-to-noise on Immunefi freed up many more hours for V3 development and brought the launch forward by months. With V3 live, the team is building new products, and it no longer spends full weeks reviewing submissions, even as AI has pushed report volume up.

In the 12 months to October 2026, 89% of the reports submitted to Alchemix were closed by Immunefi's triage before they reached the team. That figure counts only the reports that got past the submission filter. Of the reports that do reach the team, 1 in 4 is valid.

Source: Immunefi platform data for Alchemix's programs, October 17, 2025 to October 17, 2026. A report counts as reaching the team if it was escalated to Alchemix at any point.

Alchemix renewed in September 2026 for another year, on the same level of Managed Triage.