Zero-Day Economics: Why Exploits Sell for Millions
Zero-day exploits can sell for millions on underground markets. Learn why governments, criminals, and corporations compete for them—and the ethical dilemmas researchers face when deciding whether to sell or disclose.
Introduction
Zero-day exploits—vulnerabilities unknown to software vendors and the public—have long been one of the most powerful weapons in cybersecurity. In 2025, they’ve also become one of the most lucrative commodities in the underground economy. Governments, cybercriminals, corporations, and researchers all play roles in a high-stakes marketplace where a single browser exploit can sell for more than a luxury home.
This post examines the economics of zero-days, who drives demand, how markets function, and the ethical dilemmas facing security researchers today.
Why Zero-Days Are So Valuable
Zero-days are valuable because they represent unpatched flaws. Until a vendor releases a patch, attackers can exploit them without fear of easy detection. The scarcity of these vulnerabilities, combined with their destructive potential, makes them extremely profitable.
Pricing is shaped by:
- Target scope – Exploits in Chrome, Safari, or iOS fetch high prices due to their broad user base.
- Impact level – Remote code execution (RCE) or SYSTEM-level privilege escalations are the crown jewels.
- Persistence – Exploits that bypass mitigations (DEP, ASLR) or survive reboots are highly sought after.
- Detection evasion – The stealthier, the more expensive.
Players in the Zero-Day Market
- Nation-States – Intelligence agencies stockpile zero-days for espionage, cyberwarfare, or sabotage. For instance, the U.S. NSA’s leaked “EternalBlue” exploit was weaponized by WannaCry.
- Cybercriminal Syndicates – Groups buy zero-days to power ransomware, banking trojans, or mass phishing campaigns.
- Corporations – Some companies legally purchase exploits via bug bounty programs or gray-market brokers.
- Researchers – Security researchers often find themselves at a crossroads: disclose responsibly, sell legally to a vendor, or cash out on the black market.
Case Studies in Zero-Day Economics
- Stuxnet (2010): Used four zero-days in tandem to sabotage Iranian centrifuges.
- Pegasus Spyware (2016–2021): NSO Group exploited iOS zero-days to spy on journalists, politicians, and activists.
- Chrome Exploit Auctions (2024): Browser zero-days were auctioned for over $1.5 million.
Ethical Dilemmas
Researchers who discover zero-days often face an ethical bind:
- Responsible disclosure helps patch vulnerabilities but usually pays less.
- Selling to brokers or nation-states can yield life-changing payouts but fuels offensive cyber operations.
- Black market sales provide huge financial rewards but carry legal risks and potential harm to innocent victims.
ThreatGrid Perspective
The zero-day economy isn’t slowing down. As more systems become interconnected—from critical infrastructure to IoT devices—the demand for exploits will only grow. Defenders must adopt vulnerability intelligence and rapid patch cycles to stay ahead.
