Zerodium
| Company type | Private |
|---|---|
| Industry | Information security |
| Founded | July 25, 2015 |
| Headquarters | Washington, D.C. , United States |
Area served | Worldwide |
| Products | Zero-day exploits procurement and enhancement |
Zerodium was a United States-based information security firm established in 2015, operating out of Washington, D.C. and various locations across Europe. The company focused on procuring and enhancing zero-day exploits sourced from cybersecurity researchers.
History
Founded on July 25, 2015, by the creators of Vupen, Zerodium offered financial rewards for zero-day vulnerabilities—cyberattacks exploiting previously unknown flaws in hardware, software, or firmware. It was among the first to release a comprehensive pricing list for zero-day exploits, with compensation ranging between $5,000 and $1,500,000 per discovered vulnerability. In its inaugural year, Zerodium reportedly allocated between $400,000 and $600,000 monthly towards acquiring these security flaws.
By 2016, the firm had elevated its ongoing bounty for iOS-related exploits to $1.5 million. In September 2019, Zerodium further raised its reward for Android vulnerabilities to $2.5 million—exceeding the amounts offered for iOS—and simultaneously increased payouts for exploits targeting WhatsApp and iMessage. During this period, monthly spending on vulnerability procurement was estimated to be between $1 million and $3 million.
In May 2024, Intelligence Online noted the company's withdrawal from the market; by January 2025, Zerodium had taken down its website and replaced it with a single page featuring their PGP key.
Criticism
Reporters Without Borders condemned Zerodium for distributing exploit data that foreign governments allegedly used to conduct surveillance on journalists.