[smabie]

I mean if you're offering much more money for the bounty than could be earned on the blackmarket the hacker probably won't want to take the risk of double dipping.

[_8j50]

You'd be surprised, risk is worth it.

But, twitter still gets to find out and fix it before even more damage was done. Your dips don't have to be double they can be many.