The underground market for zero-day exploits has reached unprecedented price levels in 2024, with brokers now offering up to $7 million for tools that can break into iPhones. The soaring costs, detailed in an updated price list published by exploit broker Crowdfense on April 6, 2024, reflect a fundamental shift in the cybersecurity landscape where improved defenses are making attacks progressively more expensive and difficult to execute.
The Threat Landscape
Zero-day exploits, named for the fact that they target vulnerabilities unknown to the software maker and therefore unpatched on “day zero,” have become a critical commodity in the global cybersecurity ecosystem. Crowdfense’s updated pricing reveals a market that has more than doubled in value over five years. The broker now offers between $5 million and $7 million for zero-days targeting iPhones, up to $5 million for Android exploits, $3 million to $3.5 million for Chrome and Safari browser zero-days, and $3 million to $5 million for WhatsApp and iMessage zero-days.
For context, the highest payouts Crowdfense offered in its 2019 price list were $3 million for Android and iOS zero-days. The dramatic price increase tells a clear story: breaking into modern devices and applications requires significantly more resources, expertise, and time than it did just five years ago.
This trend carries direct implications for cryptocurrency users. As hardware and software platforms become harder to compromise through technical exploits, attackers are increasingly pivoting toward social engineering, phishing, and targeting the human element in the security chain. Crypto holders who rely on mobile devices for wallet management and exchange access face a shifting threat landscape where the attack vectors evolve as quickly as the defenses improve.
Core Principles
The rising cost of zero-days validates a core security principle: layered defense works. As Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, explained, it should be harder year over year to exploit the software and devices we use. This progression occurs because companies like Apple, Google, and Microsoft have invested heavily in security mitigations at the operating system and application levels.
Google reported that it tracked 97 zero-day vulnerabilities exploited in the wild throughout 2023. Spyware vendors, who frequently work with zero-day brokers, were responsible for 75 percent of zero-days targeting Google products and Android. Shane Huntley, head of Google’s Threat Analysis Group, noted that as more zero-day vulnerabilities are discovered by threat intelligence teams and platform protections continue to improve, the time and effort required from attackers increases, resulting in higher costs for their findings.
For cryptocurrency users, this means that device-level security is improving, but the threat is not disappearing. It is migrating. As direct technical exploitation becomes prohibitively expensive, attackers invest more in tricking users into compromising their own security through fake applications, fraudulent recovery services, and sophisticated phishing campaigns.
Tooling and Setup
Understanding the zero-day market helps crypto users calibrate their security practices. With Bitcoin trading at approximately $68,900 and Ethereum near $3,350 on April 6, 2024, the value secured by crypto wallets makes them attractive targets. The following security measures directly address the current threat landscape.
Hardware wallets remain the strongest defense against both technical exploits and social engineering. By keeping private keys on a dedicated device that never exposes them to internet-connected systems, hardware wallets eliminate the attack surface that zero-day exploits target. For users with significant crypto holdings, a hardware wallet is not optional; it is essential infrastructure.
Multi-factor authentication on exchange accounts provides a critical second layer. Even if an attacker gains access to your device through a zero-day or phishing attack, they still cannot access exchange accounts without the second factor. Authenticator apps are preferable to SMS-based 2FA, which is vulnerable to SIM-swapping attacks.
Regular software updates are your frontline defense. The entire zero-day market exists because of unpatched vulnerabilities. By keeping your operating system, browser, and applications updated, you ensure that once a vulnerability is discovered and patched, you are no longer exposed.
Ongoing Vigilance
The zero-day market’s evolution teaches an important lesson about security adaptability. Paolo Stagno, director of research at Crowdfense, explained that in 2015 or 2016, a single researcher could find zero-days and develop them into full exploits targeting iPhones or Android devices. Today, that approach is nearly impossible, requiring teams of researchers working together, which directly drives up costs.
This professionalization of the exploit market means that attacks, when they occur, are more sophisticated and harder to detect. Crypto users should be skeptical of unsolicited messages, verify the authenticity of software downloads through multiple channels, and monitor their wallets and exchange accounts for unusual activity. The shift from opportunistic technical attacks to targeted social engineering campaigns means that awareness and skepticism are as important as technical defenses.
Final Takeaway
The surge in zero-day prices is ultimately a positive signal for everyday users. It means the tech industry’s security investments are working, and the barrier to entry for attackers is rising. However, this does not mean the threat is diminishing; it is transforming. Cryptocurrency users must evolve their security practices in parallel, combining hardware security with digital hygiene and informed skepticism. The cost of a zero-day exploit may have reached $7 million, but the cost of losing your private keys remains incalculable.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any investment decisions.
7 million for an iPhone zero day is insane. apple really locked things down if attackers are paying that much just to get in
3-5M for a WhatsApp zero day tho. imagine what nation states are paying for stuff that never hits the open market
whatsapp zero days are the real scary ones. encrypted messaging compromised and the target never even knows
iphone zero day at 7M doubled from 3.5M in 2019. apple locked things down hard but demand side grew faster than the defenses
zero_day_watch 5M for Android vs 7M for iOS means Google Play Protect is closing the gap. the premium for iOS exploits is shrinking
280650 Android at 5M vs iOS at 7M. the gap shrinking means Google is catching up on hardening but Apple still has the harder target
You are looking at this the right way — Apple has made extraordinary progress with their security architecture. Between Lockdown Mode, BLASTDoor for iMessage, and the constant hardening of the XNU kernel, the attack surface has shrunk dramatically. What people do not realize is that this creates a perverse incentive structure. When Apple patches a vulnerability, the remaining unpatched zero-days become exponentially more valuable because they are now rarer and harder to chain into a full exploit. So ironically, every security improvement Apple ships makes the underground market for the remaining exploits even more lucrative. It is a cat-and-mouse dynamic where the mouse keeps getting richer.
doubled in 5 years and still going up. hardening defenses is working, but the demand side is growing faster than the supply is shrinking
doubling in 5 years is just inflation adjusted at this point. the real question is what happens when AI finds zero-days autonomously
demand is growing because nation state budgets expanded massively. when your adversary has a 10 figure cyber budget, 7M for an exploit is a rounding error
redteam_alex a 10 figure cyber budget makes 7M for an iOS exploit chain genuinely trivial. DoD alone spends more on offensive cyber annually than Crowdfense has paid out in its entire existence
The demand dynamics you described are accelerating even faster than most people realize. Our threat intelligence feeds show that the number of nation-state actors actively shopping for iOS and Android zero-days has tripled since 2023. These are not just the usual suspects like NSO Group or Candiru anymore — we are seeing new players emerge from Southeast Asia, the Middle East, and Eastern Europe with substantial funding. The supply side is constrained because the technical bar for a modern iPhone zero-day exploit chain is incredibly high. You need at least two or three distinct vulnerabilities chained together: a remote initial access bug, a sandbox escape, and then a kernel privilege escalation. Finding all three that work on the same iOS version and bypass all mitigations is the work of a small team over many months. That scarcity is what is pushing prices into the stratosphere, and I do not see it reversing anytime soon.
Crowdfense is just one broker. The real question is how many of these exploits end up used against journalists and dissidents instead of actual security testing.
crowdfense is just the visible tip. NSO group and similar firms operate completely in the shadows with zero transparency
crowdfense is just the public price list. NSO group and a dozen others operate completely in the shadows with zero disclosure
273988 NSO group operating with zero disclosure while Crowdfense publishes a public price list. the shadow market for zero days is probably 10x bigger
NSO group is just the one we know about. there are at least a dozen similar firms operating out of jurisdictions where disclosure requirements dont exist
The troubling part is that we have almost no visibility into the end users of these exploits. When a broker like Crowdfense sells to so-called vetted government clients, the vetting process is entirely opaque. We know from the Pegasus Project disclosures that these tools end up targeting human rights defenders, journalists, and opposition politicians far more often than legitimate criminal investigations. The $7M price tag is just the market clearing price for a weaponized intrusion capability — the real cost is measured in silenced voices and compromised civil liberties across dozens of countries where rule of law is weak.
Elena Vasquez is right about Pegasus being the tip of the iceberg. less than 12% of NSO Group clients were ever publicly identified. the end user transparency issue is the actual scandal here
Crowdfense offering 7M for iPhone zero-days. the fact that attack prices doubled in 5 years tells you Apple is actually getting better at defense
5M for Android vs 7M for iOS tells you everything about which platform is harder to crack. apple tax applies to exploit markets too lol
$7M for iOS zero day but only $3-3.5M for Chrome/Safari. browser exploits are getting cheaper because the attack surface keeps moving to the JS engine layer where mitigations are weaker
zero-day prices surge to $7 million
iphone zero-days now worth $5-7 million