Zerodium publishes hack price list: cracking an Android or Windows Phone could cost $100K, but expect to pay $500K to crack iOS
Here's a Spy Firm's Price List for Secret Hacker Techniques — The trade in the secret hacker techniques known as “zero day exploits” has long taken place in the dark …
Context & Ripple Effects
Two months after dangling a $1M bounty for an exclusive iOS9 browser-based jailbreak, Zerodium has published a full price list that turns its ad-hoc offers into a standing menu: roughly $100K for an Android or Windows Phone crack versus about $500K for iOS. Publishing the rates matters because it converts the zero-day trade from opaque brokering into something closer to a quoted commodity market, with governments and corporations as the stated buyers.
The list is also a snapshot at the start of an escalation the related coverage traces directly: Zerodium later tripled its iOS bounty to $1.5M and doubled Android to $200K within a year, and by 2019 paid more for a zero-click Android chain than for anything on iOS for the first time.
First-order effects
- Security researchers selling exploits now have transparent reference prices, and the five-fold premium on iOS tells them exactly where Apple's platform is hardest — and therefore most valuable — to break.
Second-order effects
- Broker payouts set the bar vendor bug-bounty programs must beat to keep flaws out of government hands, and buyers downstream absorb those costs: leaked NSO documents show Pegasus contracts running a $500K setup fee plus $650K to surveil just 10 iPhone or Android users, pricing that only makes sense atop expensive acquired exploits.
Third-order effects
- The pattern holds across the corpus — bounties climbing year over year and the same exploit chains reused against iOS, Windows, and Android (Project Zero documented one crew burning seven more zero-days after four in February 2020) — pointing toward zero-days functioning as a persistent, priced supply chain for state-adjacent surveillance rather than one-off sales.
The trend: Zero-day exploitation is shifting from a shadowy gray market into a formally priced brokerage industry, with published rate cards tracking the escalating cost of breaking mobile platforms.