Sony Rewards User $50,000 for Reporting Critical PS5 Security Flaw

Sony has reportedly awarded $50,000 to a security researcher who discovered and reported a critical vulnerability in the PlayStation 5, marking one of the largest payouts available through the company’s PlayStation bug bounty programme.

The researcher, known as Jordy or 2tonejordy on HackerOne, received the reward after reporting a security flaw classified as critical. The payment represents the programme’s maximum reported bounty, according to reports published on October 15 and 16, 2026.

Jordy celebrated the payout on social media with a joke about being able to afford Grand Theft Auto VI. The announcement attracted attention from gaming and cybersecurity communities, particularly because of the size of the reward and the growing interest in PS5 security research.

Sony has not publicly disclosed the exact technical details of the vulnerability that earned the $50,000 payment. As a result, it remains unclear precisely what weakness was identified or what potential attack it could enable.

The news comes amid increased attention on attempts to jailbreak the PS5 and investigate its underlying security systems. Jordy was previously involved in a separate controversy surrounding the reporting of a PS5 hypervisor vulnerability, but publicly available information does not confirm that the earlier issue was the one associated with this latest payout.

Keeping the technical details confidential can be an important part of responsible vulnerability disclosure. Releasing information about an unpatched flaw too early could give malicious actors an opportunity to exploit it before a fix is available.

Sony operates its PlayStation bug bounty programme through HackerOne, a platform that allows security researchers to report vulnerabilities directly to participating companies.

The programme was opened to the public in June 2020. It encourages researchers to identify weaknesses in eligible PlayStation products and services and report them through authorised channels rather than exploit them or disclose sensitive details prematurely.

Rewards depend on the seriousness of a vulnerability and its potential impact. Critical findings can qualify for the programme’s highest payments, with the reported $50,000 award representing the maximum payout in this case. Such programmes help technology companies benefit from independent security expertise and identify problems that might otherwise remain undetected.

Modern gaming consoles are complex systems that combine hardware protections, operating systems, online services and digital storefronts. A serious vulnerability could potentially threaten the integrity of some of these systems, depending on its nature and the conditions required to exploit it.

By offering financial incentives for responsible reporting, Sony encourages researchers to share their findings privately so the company can investigate and address security issues.

The payment also highlights the value of specialised cybersecurity research. Finding a critical vulnerability can require extensive technical knowledge, experimentation and careful documentation.

However, because the details of this particular flaw remain undisclosed, its precise impact on PS5 users cannot yet be independently assessed.

Sony’s reported $50,000 reward demonstrates how bug bounty programmes can encourage cooperation between technology companies and independent researchers.

For Sony, the goal is to identify security weaknesses before they can be widely exploited. For researchers, the programme offers a legitimate way to receive recognition and financial compensation for helping improve product security.

Until more information is released, the vulnerability behind Jordy’s payout remains unknown. What is clear is that the reward has renewed attention on PlayStation’s efforts to protect its consoles and services.