Cryptocurrencies are unregulated in the UK. Cryptocurrency profits may be subject to Capital Gains Tax. The value of investments is variable and can go down as well as up.

Bug Bounty

We take security seriously. Our bug bounty program offers Bitcoin rewards to anyone who discovers a new vulnerability in our code.

Find our flaws

What are we looking for?

Bug Bounty - Cross Site Scripting.svg

Cross-site scripting

Bug Bounty - Cross Site Request Forgery.svg

Cross-site request forgery

Bug Bounty - Remote Code Execution.svg

Remote code execution

Bug Bounty - Click Jacking.svg


Bug Bounty - Code Injection.svg

Code injection

Bug Bounty - Leaks of Sensitive Data.svg

Leaks of sensitive data

How it works

In order to claim a bug bounty, you must:

  • Discover an entirely unknown vulnerability.
  • Alert us before posting the bug anywhere else – and give us sufficient time to patch the issue.
  • Not use the exploit to steal money or data from CoinJar or its customers. If the exploit requires account access, you must use your own.

If you have any doubts or questions, email us at

Ineligible bounties

We don’t reward bounties for any vulnerabilities not under our direct control. For example:

  • Social engineering
  • Issues requiring physical access to hardware
  • Vulnerabilities in 3rd party software (Ruby, nginx, etc)
  • Denial of Service
  • Usability issues

Report a bug

Please fill out the form below to report an issue. Include as much detail about the exploit as you can and a BTC address for us to send the reward to. Our Security Team will get back to you as soon as possible.
App storeApp store

CoinJar’s digital currency exchange services are operated by CoinJar UK Limited (company number 8905988), registered by the Financial Conduct Authority as a Cryptoasset Exchange Provider and Custodian Wallet Provider in the United Kingdom under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended (Firm Reference No. 928767).

Like all investments, cryptoassets carry risk. Due to the potential volatility of the cryptoasset markets, the value of your investments may fall significantly and lead to total loss. Cryptoassets are complex and are unregulated in the UK, and you are unable to access the Financial Service Compensation Scheme or the Financial Ombudsman Service. We use third party banking, safekeeping and payment providers, and the failure of any of these providers could also lead to a loss of your assets. We recommend you obtain financial advice before making a decision to use your credit card to purchase cryptoassets or to invest in cryptoassets. Capital Gains Tax may be payable on profits.

CoinJar Card is a prepaid Mastercard® issued by EML Money DAC pursuant to licence by Mastercard International Inc. The e-money associated with your card is issued by EML Money DAC, authorised by the Central Bank of Ireland under the European Union (Payment Services) Regulations 2018 (Ref C95957). We recommend you consider the CoinJar Card Terms and Conditions before making any decision to acquire the product. Mastercard the circles design are registered trademarks of Mastercard International Incorporated.

Google Pay is a trademark of Google LLC. Apple Pay and Apple Watch are trademarks of Apple Inc.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

CoinJar logo
CoinJarGet the app.