1⃣ Protocols are now investing heavily in pre-launch audits, formal verification, and proactive security (like ~$1M audits for Uniswap V4).
This shifts the discovery curve earlier, catching critical bugs before they reach mainnet and qualify for a live bounty.
Fewer catastrophic bugs in production = lower bounty totals.
2⃣ The low-hanging fruit has been picked.
Early DeFi had rampant re-entrancy and oracle flaws. Today's systems are more complex, battle-tested, and built with safer frameworks. The remaining vulnerabilities are subtle, cross-protocol, or economic, harder to find, and often outside traditional bug bounty scope (e.g., governance manipulation, MEV extractable value, systemic risk).
3⃣ Token prices have crashed significantly.
Most of the big bounties you see on CT are paid in project's native token, which is subject to heavy volatility, which reduces the value of a the bounty paid to the white hat.
For example:
1.) Check out @auroraisnear's native token. The project has a FDV of $46.11M. A