A ten-year-old Finnish boy received a $10,000 bounty from Facebook for finding a flaw in Instagram’s code. The image posting service was acquired by Facebook 4 years ago for $1bn and currently participates in the Facebook “bug bounty” program launched in 2011, where people who find bugs in Facebook’s software are given a money reward. According to Instagram’s spokesperson, in the past 5 years the bounty program has paid out $4.3 million to more than 800 people who have found bugs in Facebook’s programming.


Although the company receives reports from teenagers quite often, the 10-year-old Finnish schoolboy became the youngest person ever to receive the reward from Facebook. He found a bug that allowed other people’s comments to be deleted (though not in bulk) and reported it to the company. Facebook quickly fixed it 3 months ago and paid out the boy a reward in March.

The boy, along with his twin brother, has been into coding and video games for 2 years now. The boys have been learning together, and he became interested in information security and watched instructional videos on YouTube. The boy decided to check whether the comments section of Instagram was able to handle harmful code. It turned out that it wasn’t. The boy noticed that he could delete other people’s (anyone’s) comments from there. Instagram quickly fixed the issue.

According to local media reports, the boy’s classmates were “surprised and astonished” by the reward, as well as his father, to whom it had come as a total surprise that his son has gone this far with it. The boy said that he was going to spend the award on a football and a new bicycle.