[Exclusive] Hacking Attacks Persist... White-Hat Hacker Reward Budget of KRW 300 Million Already Depleted

Over 203 Million Won Spent in the First Half of the Year Out of a 300 Million Won Budget
Concerns Over a 'Security Gap' After Suspension of Reward Payments

The budget for the “Security Vulnerability Reporting Reward Program,” run by the Korea Internet & Security Agency (KISA), which provides rewards to white hat hackers for reporting cybersecurity vulnerabilities, has effectively been depleted. As a result, reward payments have been suspended since September.

According to data on “the execution of the security vulnerability reporting reward program budget for the past three years (2024 to the second quarter of 2026)” submitted by Lee Joohee, a member of the National Assembly’s Science, ICT, Broadcasting and Communications Committee, KISA executed KRW 203.45 million out of this year’s second-quarter budget of KRW 300 million for the program. This means that more than two-thirds of the annual budget was spent in the first half alone.

The speed at which the budget is being used up is also faster than in previous years. Of the annual KRW 300 million budget, KISA spent KRW 262.01 million in 2024, and last year executed a total of KRW 257.47 million.

A KISA official commented, “Since the relevant budget has nearly been exhausted, we have notified that reward payments will be suspended starting in September.” The official cited several reasons for the accelerated depletion of funds, explaining, “Advancement in artificial intelligence (AI) may have led to more vulnerabilities being discovered, or white hat hackers may have reported more actively. There could be multiple factors involved.”

Concerns have been raised that a gap in cybersecurity may emerge as KISA halts reward payments. In fact, during the three months prior to the suspension (June to August), there were over 400 reports submitted on average each month, but last month, the number fell to just over 200 cases.

Lee Juhee, a member of the Democratic Party of Korea, is being interviewed by The Asia Business Daily. Photo by Yoon Dongjoo

An industry insider stated, “Public sector entities like KISA cannot identify all security vulnerabilities on their own, so they essentially receive private-sector volunteer efforts. If the rewards are reduced or eliminated, reporting of vulnerabilities will inevitably weaken.”

Assemblywoman Lee stated, “As threats from AI hacking increase, the role of white hat hackers in identifying vulnerabilities first, and the need for the reporting reward program that incentivizes them, are becoming more important. There needs to be enough budget allocated to ensure the program operates without interruption.”

This content was produced with the assistance of AI translation services.