Latin America’s biggest hacker conference once again proved a happy hunting ground for Bug Bounty hunters, as YesWeHack and Banco Galicia reunited for another live hacking event at Ekoparty.
Argentina’s largest private-sector bank returned to Ekoparty after successfully strengthening the security of its digital assets during the 2024 edition. Once again, the event was supported by Bug Bounty Argentina, a Buenos Aires-based community of security researchers.
The marathon bug hunt took place across three days, 7-9 October, and spanned 45 hours, outlasting the 29-hour running time of the 2024 edition.
As before, participation was open to all YesWeHack-registered hunters attending the Ekoparty conference.
“The main reason we’re doing again a live hacking event is because we patched lots of vulnerabilities that were discovered in the previous event, so we want to test the platform once again. Also, with the new technologies and artificial intelligence, we want to test our response team and how we can manage all the new reports submitted in a timely manner.”
Sebastián Wilke, cybersecurity manager, Banco Galicia
Points and prizes
After a hard-fought but good-natured contest, 14 hunters earned points, financial rewards and a place on the final leaderboard. As for the podium positions and special awards, particular praise goes to:
🥇 Javier Rieiro aka PyUs3r
🥈 Alejandro Bofill aka bofill3
🥉 Antonio Rivera Poblete aka tonysec
🌈 Full Spectrum (the widest variety of bugs): Eduardo Zamorano Jara aka deb_security
💥 Biggest Impact: Alejandro Bofill aka bofill3
Camaraderie and collaboration
While the hunters competed against each other for points and financial prizes, they also displayed the camaraderie and teamwork that always characterises live hacking events.
The benefits of an in-person hunt arose not just from amiable interactions between hunters, but also constructive collaboration between the hunters, YesWeHack’s onsite triagers and customer success managers, and the security team of Banco Galicia.
“It’s very helpful for our team to have different perspectives, different techniques, different AI algorithms. If I had to describe the event in one word, I would say ‘feedback’. Because we receive the hunters’ feedback, we deliver them feedback, and in that way we can create a good community where both sides can win.”
Christian Gehmlich, cybersecurity specialist leader, Banco Galicia
What the winners had to say
“What I enjoyed most about the event was the atmosphere. It never felt like a rivalry, and there was a great sense of camaraderie among the hackers. The scopes were a highlight, with more targets than I expected, several wildcards, and solid bounties.
“Our strategy was key to the victory: we worked together to identify a recurring SQL injection pattern across multiple targets. YesWeHack did an excellent job organising the event, especially the triage team, who kept up with a huge number of reports, and I'm particularly proud of what we achieved as a team of Spanish hackers rather than seeing this as an individual win.”
Javier Rieiro aka PyUs3r, #1 on the final leaderboard
“This was the first YesWeHack event I've ever attended, and it was a very rewarding experience. Getting to meet people from the community is definitely worth it, especially for someone like me who hasn't been around for long.
“The rewards and the scope on offer were also a big plus. Being able to test parts of the organisation that no hunter had looked at before is a game changer when it comes to finding big vulns. I'd do it again without hesitation.”
Alejandro Bofill aka bofill3, #2 on the final leaderboard & Biggest Impact
“What made this event special for me was how well we worked together as a team. Communication and sharing findings were key to our strategy, and by combining our skills and perspectives, we were able to discover several critical vulnerabilities that we might not have found working individually.
“The atmosphere was fantastic, with a strong sense of camaraderie among the hackers. I'm especially proud of what we achieved together as Spanish researchers, and finishing on the podium made the experience even more rewarding.”
Antonio Rivera Poblete aka tonysec, #3 on the final leaderboard
Thank you to all participating hackers for helping to further harden Banco Galicia’s assets and, in doing so, protect its five million customers. 👏 Thanks also to Banco Galicia, Bug Bounty Argentina and Ekoparty for making the sequel to the 2024 event another success. 🚀🤘
“Organising this Live Bug Bounty in Argentina was a fantastic experience. Bringing together Banco Galicia teams, security researchers and our triage experts in the same room created an atmosphere of trust, transparency and shared purpose that accelerated learning and delivered real security value for our customer.”
Clément Lalance, customer success manager, YesWeHack
Highlights from 2024
We’ll release video highlights from the 2026 event soon. In the meantime, here’s some highlights from the 2024 edition:
We also conducted an interview at the 2024 event, in which two senior members of the bank’s security team reflected on the success of their continuous, private Bug Bounty Program. Among other things, the pair discussed how YesWeHack’s triage team helps to eliminate bottlenecks from the remediation process, the results achieved and challenges overcome, and their best practices for running a successful program.
What could a live hacking event uncover in your organisation?
Interested in exploring what a Live Bug Bounty could achieve for your organisation? Let's discuss whether it's the right fit for your security objectives.
