Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.