A researcher identified as Jordy, known on HackerOne as “2tonejordy,” reportedly received the full $50,000 payout after submitting a critical flaw affecting PlayStation systems, according to Dexerto. The associated report is marked resolved, and the vulnerability’s identity has not been publicly disclosed. This kind of security research highlights how bounty programs incentivize responsible disclosure across the industry.
How the Program Works
PlayStation has run a public bug bounty program through HackerOne since 2020, open to security researchers, gamers, and anyone with the skills to find qualifying flaws. The program covers PS4 and PS5 hardware, their operating systems, accessories, and PlayStation Network assets.
Rewards follow a four-tier structure based on severity:
- Low severity: $500–$2,499
- Medium severity: $2,500–$9,999
- High severity: $10,000–$49,999
- Critical severity: up to $50,000
Sony treats those figures as minimums within each category, not guaranteed amounts. Final payment depends on the vulnerability’s impact, its potential “blast radius” (how many users it could affect), and the quality of the submitted report. Only the first researcher to report a qualifying flaw is eligible for the reward.
What Actually Happened, and What Is Still Unknown
Secondary reporting, including coverage from Dexerto, identifies Jordy’s resolved report as the source of the $50,000 payment. The timing has drawn attention because recent PS5 security research has focused heavily on the console’s hypervisor. The hypervisor is the low-level software layer that enforces system integrity and blocks unauthorized code from running outside Sony’s restrictions.
That connection, however, remains unconfirmed. The public record of Jordy’s report does not identify the specific vulnerability. No such statement was identified in the sources reviewed that links this payout to hypervisor research or any jailbreak technique currently circulating online. Treat claims connecting those dots as speculation until Sony or Jordy provide verified technical details.
Report Privately, Get Paid
Responsible disclosure, the model PlayStation’s HackerOne program is built on, works in a clear sequence. You find the flaw, report it privately through HackerOne, and let Sony investigate and patch it before any technical details become widely known.
The alternative is not worth considering. Unauthorized PS5 modification can void your warranty and cut off PlayStation Network access. It can also trigger hardware or account enforcement, regardless of how the exploit was found. The HackerOne program does not authorize unauthorized access, and the program’s own rules require researchers to follow applicable law.
What This Means for Your PS5
Sony has paid real money to keep its platform secure, and the program remains open. If you have the security research background to find the next qualifying flaw through legitimate means, the submission pathway is public on HackerOne’s PlayStation page.
For everyone else, the practical reality is this: the program is designed to encourage private reporting and remediation before technical details become widely known. That is the system working as intended.
