19-Year-Old Makes Over $1 Million Hunting Software Bugs

(Image: HackerOne YouTube)

You can make a lot of money as an ethical hacker. Just ask 19-year-old Argentina native Santiago Lopez.

Lopez is the first person to surpass $1 million in rewards on HackerOne, a bug bounty platform that offers money in exchange for finding security vulnerabilities in IT systems from participating companies.

Since joining HackerOne, he's found more than 1,670 security flaws in products and services from Verizon, Twitter, WordPress, and government offices.

He's a self-taught hacker who only got started three years ago by reading blogs and watching YouTube videos. But what got him interested in the field was a 90s movie.

"I didn't even know it existed until I saw the movie Hackers, which opened up a whole new world for me," he said in a Q&A with HackerOne. "As I learned more, I realized that I was naturally drawn to the types of challenges and problem-solving opportunities associated with hacking."

Lopez didn't find his first software bug until he was 17, and even then he was only awarded $50. But over time, he refined his skills and focused on "finding as many bugs as I can in a short period of time," he told HackerOne.

"I know they say quality before quantity, but quantity is what I like," he said. "I see hacking as a normal job, so I tend to hack between 6 to 7 hours per day."

Recommended by Our Editors

FaceTime Bug Teenager Is Eligible for Bug Bounty Payout

What to Expect at RSAC 2019

The largest bounty he's ever been awarded was $9,000 for a server-related vulnerability that could allow remote takeover. However, he specializes in finding software bugs that can let hackers bypass normal application processes to access protected resources, such as files and database records.

"Yes, my friends and family know that I am a hacker," Lopez added. "The first time I told them, they could not believe it. They viewed the hacker as a bad person who robbed people. They did not think it was possible that a hacker could be good and make money legally."

So far, HackerOne has awarded over $45 million in bug bounties. Days after Lopez became the first person to surpass the $1 million mark, another hacker on the platform, Mark Litchfield, also passed the $1 million bug bounty reward totals as well.