19-Year-Old Makes Over $1 Million Hunting Software Bugs

You can make a lot of money as an ethical hacker. Just ask 19-year-old Argentina native Santiago Lopez.

Lopez is the first person to surpass $1 million in rewards on HackerOne, a bug bounty platform that offers money in exchange for finding security vulnerabilities in IT systems from participating companies.

Since joining HackerOne, he's found more than 1,670 security flaws in products and services from Verizon, Twitter, WordPress, and government offices.

He's a self-taught hacker who only got started three years ago by reading blogs and watching YouTube videos. But what got him interested in the field was a 90s movie.

"I didn't even know it existed until I saw the movie Hackers, which opened up a whole new world for me," he said in a Q&A with HackerOne. "As I learned more, I realized that I was naturally drawn to the types of challenges and problem-solving opportunities associated with hacking."

Lopez didn't find his first software bug until he was 17, and even then he was only awarded $50. But over time, he refined his skills and focused on "finding as many bugs as I can in a short period of time," he told HackerOne.

"I know they say quality before quantity, but quantity is what I like," he said. "I see hacking as a normal job, so I tend to hack between 6 to 7 hours per day."

The largest bounty he's ever been awarded was $9,000 for a server-related vulnerability that could allow remote takeover. However, he specialises in finding software bugs that can let hackers bypass normal application processes to access protected resources, such as files and database records.

"Yes, my friends and family know that I am a hacker," Lopez added. "The first time I told them, they could not believe it. They viewed the hacker as a bad person who robbed people. They did not think it was possible that a hacker could be good and make money legally."

So far, HackerOne has awarded over $45 million in bug bounties. Days after Lopez became the first person to surpass the $1 million mark, another hacker on the platform, Mark Litchfield, also passed the $1 million bug bounty reward totals as well.

About Our Expert

Michael Kan

Principal Reporter

My Experience

I've been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I'm currently based in San Francisco, but previously spent over five years in China, covering the country's technology sector.

Since 2020, I've covered the launch and explosive growth of SpaceX's Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I've combed through FCC filings for the latest news and driven to remote corners of California to test Starlink's cellular service.

I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.

I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I'm now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I'm always eager to learn more, so please jump in the comments with feedback and send me tips.

The Best Tech I've Had:

My first video game console: a Nintendo Famicom
I loved my Sega Saturn despite PlayStation's popularity.
The iPod Video I received as a gift in college
Xbox 360 FTW
The Galaxy Nexus was the first smartphone I was proud to own.
The PC desktop I built in 2013, which still works to this day.

Read the latest from Michael Kan

Read full bio