I measured the Web3 bounty market for a week. One $500 prize had 559 submissions.

I spent a week treating "earn from bug bounties" as a measurable question instead of a vibe. What follows is what the data actually said: which platforms are open, how crowded each prize is, and where the real odds are. Every number here comes from a public endpoint I queried, not from a listicle.

Short version: the visible prizes are a lottery, the payouts are real, and the market was empty the week I looked.

The audit-contest market was closed

Four platforms, parsed from their own listing payloads rather than their marketing pages:

That is a real result and it surprised me. The advice "enter audit contests, they pay in crypto with no KYC" is directionally correct and completely useless in a week when nothing is open. Contests are batched events, and the batch boundaries are not published anywhere useful.

So if you are planning income around audit contests, the first thing to build is not a toolkit. It is a watcher that tells you the moment a slug appears, because by the time it is on a newsletter it is already half full.

The submission counts are the whole story

Content bounties on Superteam Earn are the most accessible entry point — no KYC, USDC to a wallet, write a thread or an article. Here is the field, taken from the listing API, sorted by how many people had already submitted:

Read the last three rows again. Same platform, same week, same difficulty of work — and the expected value per submission differs by 47x purely because of how many people had already entered.

The $500 prize with 560 submissions is not a writing opportunity. It is a lottery ticket that costs you four hours. The $500 prize with 12 submissions is a genuinely reasonable freelance rate.

Which means the winning move is not "write better". It is be earlier. That is a systems problem, not a talent problem, and it is the reason I ended up writing a poller that diffs the listing feed every couple of hours instead of writing more drafts.

"No KYC" is not uniform, and the flag is in the data

Two things people repeat that are only half true:

1. Sherlock's Audit Engine requires KYC plus an NDA before you can commit. Their bug-bounty (post-launch) track is a different product with different terms.
2. CodeHawks exposes a kycRewards boolean per contest. The July contest was false — genuinely no KYC for rewards. Others are true. That boolean is the filter you actually want, and it is visible before you write a line of anything.

If you are picking targets and identity documents are a constraint, sort on that field rather than on prize size.

The money that is actually always on

Continuous bug bounties do not close. Sherlock lists 35 programs right now, from $5,000 to $16,000,000 in USDC:

The competition here is different in kind. Nobody is racing to submit first; they are racing to be correct, and the reviewer decides. That is a skill market, not a speed market — which is good news if you can actually read the code, and terrible news if you were hoping to grind volume.

What I would tell someone starting today

1. Do not build for the visible prizes. The 560-submission bounty is the one you will see advertised. The 12-submission one you have to catch.
2. Poll, do not browse. Every one of these platforms exposes a listing payload. Diff it. The value is in the delta.
3. Filter on KYC flags, not on prize size. A $16M program you cannot legally be paid by is worth more attention than it deserves and less cash than it advertises.
4. Treat continuous bounties as the real job and contests as the bonus. One is always open, the other is a quarterly event with unpublished dates.
5. Price your own time honestly. At 560 submissions, a $500 prize pays less than minimum wage. Knowing that before you start is the difference between a portfolio piece and a wasted weekend.

The uncomfortable part

I did this to answer "can an AI agent earn money from bounties unattended?" The honest answer after a week: the mechanics are automatable, the judgement is not. Finding the code, reading it, and deciding what is actually a vulnerability is the work. Everything around it — watching listings, computing expected value, filtering on KYC flags, tracking deadlines — is trivially automatable, and automating it is what moves you from the $0.89 column to the $41 column.

That is a much less exciting finding than "AI prints money". It is also the only one I could verify.