apple pays $2 million. the plug pays $7 million

The price list went up on September 3, 2019. Zerodium, a firm in Washington, D.C. that buys ways into software and sells them on, posts its rates the way a pawn shop posts the price of gold. The new sheet had one line that made the news: a way into any iPhone with zero clicks and persistence, meaning it survives a reboot, now bought at $2 million. It had another line that made the people who actually read these sheets sit up. An Android chain of the same kind was now $2.5 million. For the first time, Android paid more than iPhone.

Chaouki Bekrar, the founder, explained it in plain language. The market was flooded with iOS exploits. Too many people were showing up at the counter with the same product. On the same sheet, the one-click iPhone chain, where the target has to tap something, was cut from $1.5 million to $1 million. Supply and demand, in a market you are not allowed to see.

In May 2020 it got worse for the sellers. Zerodium announced it would stop buying three kinds of iPhone exploit for the next two to three months, local privilege escalation, Safari remote code execution, sandbox escapes, due to the high number of submissions. They had more product than they could move. Hit us back in the summer.

three corners

There are three ways to move a bug once you have found one.

White. You tell Apple. Apple's Security Bounty, after its October 2025 overhaul, pays up to $2 million for a zero-click chain of the kind spyware vendors use, and the company says it has paid out more than $35 million since the program opened. The bug gets fixed. Your name goes in the security notes, if you want it there.

Gray. You sell to a broker. Zerodium is one. Crowdfense, out of Abu Dhabi, is another, and in April 2024 Crowdfense published its own sheet: $5 to $7 million for an iPhone zero-day. The brokers sell to governments. Crowdfense will tell you it does not sell to countries under US sanctions, and that is the whole of the public ethics policy. The bug does not get fixed, by design. It gets used on somebody's phone, which is what the last story was about.

Black. Whoever pays.

The economics are the same at every corner, and they are the economics of a secret. A zero-day is worth the most on the day only you know it. Every person who learns it takes something off the price. A second seller means the broker can haggle. A leak means the vendor can patch. A patch means the product is now a story about something that used to work, and the word for that is burned.

When Apple put the Lockdown Mode bounty at $2 million in July 2022, I posted it to the group chat the same day, because I had been watching the white-market price creep up for years and $2 million was the first number that looked like it was trying to compete with the gray one. It was not, really. Crowdfense is paying three and a half times that.

zero days, hero pay, here he lays

That is the epitaph. A bug gets found, somebody gets paid, and then it is a line in a changelog.

your sheet

You run the same economy, and you have never seen your own price list.

Somebody has a zero-day on you. The password you have reused since college. The real reason you left the last job. The thing you said about a friend to another friend at 2 a.m. in 2019. It is worth the most on the night they hear it, and it loses value the way an exploit does, by being told. Tell one more person and it is half off. Tell five and it is patched, everyone knows, there is nothing left to sell.

The people in your life who could have cashed out and did not are the only plug that matters. There is no sheet for that.

Everybody you know is holding one on you. Most of them never sold.

The painting: Marinus van Reymerswaele, The Tax Collectors (16th century), National Museum in Warsaw. Public domain.

Sources