Hey everyone,

I recently reported what I believe was a serious account takeover vulnerability affecting a major cryptocurrency exchange through HackerOne.

I tested everything on my own verified account and recorded a full PoC video demonstrating the impact.

I'll admit I made a mistake in the written reproduction steps of my first report. However, the video showed the actual behavior correctly. The report was closed as Informative based on an explanation that contradicted what happened in the recording.

I realized my mistake and submitted a second report with corrected steps, another uncut video, and additional evidence of account takeover impact.

That one was closed as Duplicate of the first report.

Here's what makes this even more frustrating.

After both reports were closed, I tried reproducing the same vulnerability again, and the behavior had changed.…