I previously posted about Deribit shadow-patching 3 Critical vulnerabilities and ghosting me for 70+ days, violating their own "Fast Payment" SLA. (I am bound by NDA and cannot share technical details of the bugs).

After my posts went viral (71k+ views), Deribit's H1 response rate magically jumped from 54% to 58%. I called it out as stat-padding by closing easy, low-level reports.

Well, the rate just dropped back to 57%. Why? Because a report by another researcher (`n3s7l3`) was just resolved 4 days ago.

This is undeniable proof of **Selective Triage.** [**https://hackerone.com/deribit/hacktivity**](https://hackerone.com/deribit/hacktivity)

Deribit’s security team is actively logging into HackerOne, reading reports, and resolving them. They are not too busy. They are not on holiday. They are actively choosing to resolve other reports while deliberately leaving my 76-day-old Critical reports in "New" status because they don't want to pay the $30k-$50k bounties they advertise.

They are using the HackerOne platform to get free security fixes for high-impact flaws, while manipulating their metrics and paying out only the cheap bugs to keep their dashboard looking active.

If you are hunting on Deribit, be warned: The "Fast Payment" and "Gold Standard Safe Harbor" badges are fraudulent. If you find a high-severity bug, expect them to shadow-patch it and freeze you out.

Action on H1 speaks louder than PR.

Deribit resolving other H1 reports while ghosting Critical researcher for 76+ days