You found the vulnerability at 1 a.m., wrote it up, and three weeks later a four-figure payout lands in your account for work you did in your pajamas. It feels like found money — until you realize the IRS sees it as income like any other, and the platform that paid you may already have told them about it.
Bug bounty hunting has grown into serious money. HackerOne paid out $81 million to researchers in a single twelve-month stretch, a 13% year-over-year increase, with the average active program paying roughly $42,000 a year. Most individual payouts are modest — the median disclosed bounty sits around $500 — but top researchers now earn six and seven figures annually. Whether you collected one $300 payout or a steady stream of criticals, here is how to handle the tax side correctly: what the platforms report, which forms to expect, when you owe self-employment tax, and how the hobby-versus-business distinction decides whether your tooling costs are deductible.
Every Dollar of Bounty Income Is Taxable
Start with the rule that surprises the most first-time hunters: bounty payouts are ordinary income from the first dollar. There is no de minimis exception for "small" payouts, no "it was just a hobby so it doesn't count" exclusion, and no special capital-gains-style treatment because the work felt like a game. If a payout hit your bank account, PayPal, or crypto wallet, it belongs on your return.
This trips people up because bounty income arrives without the familiar machinery of a paycheck — no withholding, no W-2, no employer reminding you that taxes exist. The platforms pay you gross and leave the tax math entirely to you. Treat every payout notification as a pay stub you have to settle up on yourself, and you will never be caught off guard in April.
What HackerOne and Bugcrowd Actually Report
The tax forms you submit before you can get paid
Both major platforms collect tax documentation from you as part of payment setup, before money can flow. US-based researchers submit Form W-9 (name, address, taxpayer identification number); researchers outside the US submit the appropriate W-8 form to document their foreign status. Bugcrowd's researcher payment documentation walks through separate W-9 and W-8 submission paths for US persons, non-US individuals, and non-US entities. If you skip this step, your payouts sit in limbo — the platforms will not release funds without a tax form on file.
Take the W-9 seriously even as a casual hunter: a missing or incorrect taxpayer ID can trigger 24% backup withholding on your payouts, which means the platform withholds nearly a quarter of every bounty and sends it to the IRS. You eventually reconcile it on your return, but it is an interest-free loan to the Treasury you never needed to make.
The 1099 threshold changed in 2026
For years, the rule was simple: earn $600 or more through a platform in a calendar year and you would receive an information return (platforms have historically used Form 1099-MISC for researcher payouts). For 2026, the reporting threshold jumped. Under the One Big Beautiful Bill Act, the threshold for issuing Forms 1099-NEC and most 1099-MISC payments rose from $600 to $2,000 for payments made after December 31, 2025, with annual inflation adjustments beginning in 2027.
In practical terms: if your total 2026 payouts from one platform stay under $2,000, you probably will not receive a 1099 from them. That does not make the income tax-free. The reporting threshold governs the platform's paperwork obligation, not your obligation to report. The $1,400 you earned across three medium-severity reports is still taxable income even with no form in the mail, and the IRS receives enough third-party data these days that "nobody reported it" is not a plan. Report everything; keep your own ledger rather than waiting for forms to tell you what you earned.
Non-US researchers
If you hunt from outside the United States, the W-8 series forms document your foreign status so the platform can apply the correct withholding treatment. Tax treaties and source-of-income rules — payments for services you perform from your own country are generally foreign-source — determine whether any US withholding applies at all. Your home country will almost certainly tax the income regardless, so track payouts in your local currency equivalent at the time of receipt. This guide focuses on US tax treatment; if you are abroad, confirm the details with a local adviser.
Hobby or Business? The Question That Decides Your Deductions
The single most consequential tax question for a bounty hunter is whether the IRS would classify your hunting as a business or a hobby. The income is taxable either way — but only a business gets to deduct its expenses.
How the IRS draws the line
The IRS looks at whether you pursue the activity with a genuine intention of making a profit, weighing factors such as:
- Do you carry on the activity in a businesslike manner — keeping books, tracking time and expenses, maintaining separate accounts?
- Do you invest real time and effort with the goal of earning income?
- Do you depend on the income for your livelihood, or is it incidental?
- Have you changed your methods to improve profitability — specializing in higher-paying bug classes, targeting programs with better reward tables?
- Do you have the expertise, training, or study history of someone working toward profit?
- Have you made a profit in prior years, and can you reasonably expect future profit?
A hunter who tracks submissions in a spreadsheet, specializes in high-value targets, reinvests in tooling, and earns steadily increasing payouts looks like a business. Someone who pokes at a weekend program twice a year for fun looks like a hobby. Most serious hunters fall clearly on the business side — and the IRS's own guidance notes that an activity earning side income year after year with profit-seeking behavior is a business even if you also have a day job.
There is also a bright-line presumption in your favor: if your activity shows a profit in three of the last five tax years, the IRS presumes it is a business. Most bounty hunters, whose costs are modest relative to payouts, clear that bar easily once they are earning consistently.
Why the distinction matters more than ever
Before 2018, hobbyists could at least deduct hobby expenses up to the amount of hobby income as a miscellaneous itemized deduction. The Tax Cuts and Jobs Act suspended all miscellaneous itemized deductions for 2018 through 2025 — and the One Big Beautiful Bill Act made that suspension permanent. Hobby expenses are now nondeductible, full stop.
So if your hunting is a hobby, your VPS subscriptions, Burp Suite license, VPN, training courses, and conference travel are personal spending as far as the tax code is concerned. If it is a business, those same costs are ordinary and necessary business expenses deductible on Schedule C. For a hunter spending a few thousand dollars a year on tooling and infrastructure, the classification alone can swing the tax bill by hundreds of dollars.
The catch: business treatment means self-employment tax
There is no free lunch. Business income reported on Schedule C is subject to self-employment tax — 15.3% on 92.35% of net earnings (up to the Social Security wage base, plus the 2.9% Medicare portion beyond it) — once your net earnings from self-employment reach $400 for the year. Hobby income escapes self-employment tax entirely; you pay only income tax on it.
Do the math for your situation rather than assuming one outcome is better. A hunter with $8,000 in payouts and $1,500 in deductible expenses as a business pays income tax plus self-employment tax on $6,500 of net profit. The same hunter as a hobbyist pays income tax on the full $8,000 with no deductions and no self-employment tax. Which wins depends on your marginal income-tax rate — but note that you do not get to choose freely. The facts decide the classification; your job is to document whichever one the facts support. Deliberately misclassifying business income as hobby income to dodge self-employment tax is the kind of position that fails the moment anyone asks for your books.
Deductions Worth Tracking as a Business Hunter
If your hunting qualifies as a business, keep receipts for everything genuinely connected to earning bounty income:
- Infrastructure: VPS and cloud instances for scanning and testing, domains for callback servers, VPN subscriptions.
- Tooling: commercial security tools and licenses, wordlists and datasets, API credits for reconnaissance services.
- Learning: training courses, certifications, books, and conference tickets that maintain or improve your hunting skills.
- Home office: if you use part of your home regularly and exclusively for hunting work, the simplified $5-per-square-foot deduction (up to 300 square feet) is easy money most hunters leave on the table.
- Fees: payment-platform fees and currency-conversion spreads that eat into gross payouts — the difference between the bounty amount and what actually lands is a real cost.
The key discipline is separation. Run bounty income and expenses through a dedicated account or at minimum a dedicated tracking system, and log each payout with its date, program, platform, report ID, and gross-versus-net amount. That log is what turns a shoebox of PayPal notifications into businesslike books — which, circularly, is itself evidence that you are running a business.
Quarterly Estimated Taxes: The Bill Nobody Withholds
Because no employer withholds from bounty payouts, business hunters generally must pay quarterly estimated taxes (Form 1040-ES) once they expect to owe $1,000 or more for the year. The deadlines — roughly mid-April, mid-June, mid-September, and mid-January — surprise first-year earners who assumed taxes were an April problem. Miss them and you can owe an underpayment penalty on top of the tax itself.
Two safe harbors protect you: pay at least 90% of the current year's tax, or at least 100% of last year's total tax (110% if your adjusted gross income exceeds $150,000), spread across the four quarters. If you also hold a W-2 job, the simplest move is often to increase paycheck withholding enough to cover the bounty income instead of filing separate quarterlies — withholding is treated as paid evenly throughout the year no matter when it is actually withheld, which makes it the most forgiving way to stay inside a safe harbor.
Common Mistakes That Cost Hunters Real Money
Ignoring payouts under the 1099 threshold. The most common error in bounty-land. No form does not mean no income. The IRS matches what it can and audits what it must; unreported income discovered later brings tax plus penalties plus interest.
Deducting expenses as a hobbyist. Post-2018 returns claiming hobby expenses are simply wrong, and the permanent suspension means this is never coming back. If your tooling spend is significant, that is an argument for running your hunting as a real business — with books to prove it — not for deducting anyway.
Forgetting self-employment tax in the budget. First-year business hunters routinely set aside 22% for income tax and forget the additional ~15% for Social Security and Medicare. A good rule of thumb: set aside 25–30% of every net payout the day it arrives, in a separate account, before you spend any of it.
Mixing personal and hunting finances. Paying for scanning infrastructure from the same card as groceries makes clean books impossible and weakens your business-classification evidence. One dedicated account costs nothing and pays for itself at tax time.
Treating swag and non-cash rewards as free. Conference passes, hardware, and gift cards awarded through programs are income at fair market value, same as cash. Log them when received.
Keep Your Bounty Books Audit-Ready From Day One
Your payout history is scattered across platforms, PayPal notifications, and bank deposits — which is exactly why hunters underreport income and overpay tax on expenses they forgot. Maintaining clear financial records is what turns a fun side activity into a defensible business at tax time. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
