In November 2015, exploit broker Zerodium publicly listed the maximum amounts it said it would pay to acquire selected zero-day exploits. The figures—such as up to $500,000 for an iOS attack—were historical, conditional offers, not guaranteed researcher earnings or current rates.
What Zerodium revealed in 2015
WIRED reported the disclosure on November 18, 2015. Zerodium published a chart of maximum acquisition prices organized by exploit type and software target. CEO Chaouki Bekrar framed the move as an exception to the usual secrecy: “The first rule of the 0days biz is to never discuss prices publicly,” he told WIRED, before adding, “So guess what: We’re going to publish our acquisition price list.” WIRED’s November 2015 report describes the announcement and the figures.
The reported examples were:
| Target or exploit | Maximum listed offer in WIRED’s 2015 report |
|---|---|
| Remote browser takeover through Safari or Internet Explorer | Up to $50,000 |
| Chrome remote browser takeover | Up to $80,000 |
| Android or Windows Phone exploit | Up to $100,000 |
| iOS attack | Up to $500,000 |
These are amounts reported in 2015, not a current Zerodium price list. “Up to” matters: the chart stated ceilings for qualifying submissions, rather than a promise that every researcher—or every exploit in a category—would receive that sum.
Why the listed maximum was not a guaranteed payout
A 2022 analysis in the U.S. Army Cyber Defense Review explains that advertised maximums depended on the exploit’s technical scope and quality. Assessment could turn on how complete the exploit was, which systems and versions it supported, its reliability, what mitigations it bypassed, and other technical details. The Army Cyber Defense Review article discusses these factors and the wider exploit market.
Recommended Free Tools
#1 Best Overall
That makes headline comparisons incomplete. A browser takeover, a mobile exploit, and a full-chain compromise are not interchangeable deliverables. When comparing offers, readers need to account for the target and supported versions, the outcome achieved, whether user interaction is required, chain completeness, persistence, reliability, and mitigations bypassed—not just the largest number in a chart.
How later published figures compare
CERT-EU’s 2019 memo reported higher maxima for substantially specified mobile exploit chains: up to $2.5 million for an Android full-chain exploit with persistence and up to $2 million for a comparable iOS exploit. These are 2019 figures, not revised versions of the 2015 chart and not evidence of Zerodium’s present rates. CERT-EU’s 2019 memo provides that dated snapshot.
The difference in stated scope is important: the 2019 amounts explicitly concerned full chains with persistence, while the 2015 WIRED examples were described by target and attack type. Treating them as direct like-for-like price changes would overstate what the reports establish.
What the 2015 report said Zerodium did with exploits
WIRED described Zerodium as buying exploit techniques and reselling them through a subscription service to customers that included government agencies. The report also said Zerodium required the exploits it purchased to remain exclusive to the company. That is an account of the business model and stated terms in the 2015 article; it should not be read as confirmation of the company’s current policy or operating status.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
Are these Zerodium’s current prices?
No current 2026 Zerodium price figure is established by the cited material. The 2015 and 2019 amounts are dated snapshots, and a 2024 TechCrunch report about Crowdfense and broader market offers does not establish Zerodium’s current rates, whether its acquisition program is open, or its present eligibility terms. TechCrunch’s 2024 coverage concerns Crowdfense, so its offers should not be substituted for Zerodium’s.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
