How are bug bounty rewards taxed in Belgium?
- Aeacus Lawyers
- May 1
- 7 min read
Updated: May 17
Short answer:Bounty rewards are generally taxable in Belgium miscellaneous income (33% or depending on the circumstances as professional income taxed at progressive rates up to 50%. The tax authorities mainly look at the frequency of the activities, the professional nature, the expertise involved, the level of organization, and the profit motive. For crypto bounty rewards, the later tax treatment of the received crypto assets is also relevant. |
Concept | Explanation |
Bug bounty | Reward for reporting security vulnerabilities to companies or platforms such as HackerOne, Intigriti, or Immunefi. |
Bounty reward | General term for online rewards paid in fiat or crypto in exchange for specific tasks, contributions, or achievements. |
Miscellaneous income | Income outside a professional activity but beyond the normal management of private wealth; taxable at 33% (+ municipal taxes). |
Professional income | Regular, organized, or professional activity; taxable at progressive rates up to 50%. |
Crypto reward | Reward paid in crypto assets instead of euros or dollars. |
Testnet reward | Reward for participating in blockchain test networks or protocol testing. |
DAO reward | Compensation for contributions to a decentralized protocol or web3 project. |
Taxable moment | The moment at which the reward is received or becomes realizable. |
I. What are bounty rewards?
The term “bounty rewards” covers a broad range of online rewards granted in exchange for specific achievements, contributions, or technical activities. This includes not only traditional bug bounty programs, but also rewards within the broader crypto and technology sector.
In short, companies, platforms, or blockchain projects allow external individuals to legally identify and report vulnerabilities in their systems, applications, or smart contracts. This is a form of ethical hacking where the purpose is precisely to detect security flaws so that the relevant company or protocol can fix them before malicious actors exploit the vulnerability.
The amount of the reward is often determined by the severity of the security issue. The more critical the vulnerability and the greater the potential risk for users or funds, the higher the compensation will generally be.
Well-known examples include:
bug bounty rewards through HackerOne, Intigriti, or Immunefi;
rewards for ethical hacking or vulnerability disclosure;
testnet rewards within blockchain projects;
DAO contributor payments;
open source bounties;
referral rewards;
community and moderation rewards;
web3 marketing or development bounties.
The compensation may be paid in euros, dollars, or crypto assets such as BTC, ETH, or stablecoins.
II. How are bounty rewards taxed?
Belgian tax law does not contain a specific regime for bounty rewards. As a result, the traditional categories of income tax must be applied.
More generally, income derived from crypto assets and digital activities in Belgium is typically classified under one of four tax categories:
tax-exempt normal management of private wealth;
movable income;
miscellaneous income;
professional income.
In practice, two classifications are particularly relevant for bounty rewards:
miscellaneous income;
professional income.
A full tax exemption as normal management of private wealth appears legally difficult to defend in most bounty situations, since an active service or performance is generally provided in exchange for the reward. A qualification as movable income is also usually less appropriate, as bounty rewards generally do not result from the mere passive holding of an asset, but from an active intervention or technical contribution by the taxpayer.
Miscellaneous income (33%)
In many cases, bounty rewards will be taxed as miscellaneous income at the separate rate of 33% (increased by municipal taxes).
This is especially the case when:
the activity remains occasional;
no professional structure is present;
the income is not sustainable or organized;
the activity does not display the characteristics of a genuine professional activity.
The tax authorities always assess this on the basis of the concrete facts.
Such bounty rewards qualifying as miscellaneous income must be voluntarily declared in the personal income tax return under Section XV (“Miscellaneous income”), generally under code 1200/2200.
Professional income (up to 50%)
When bounty activities acquire an organized, regular, or professional character, the income may be reclassified as professional income.
Relevant factors include:
high frequency of rewards;
systematic participation in bounty programs;
professional expertise or commercial exploitation;
use of infrastructure or automation;
presence of a website or branding;
substantial income volume.
In that case, progressive tax rates of up to 50% apply, increased by municipal taxes and potentially also by social security contributions.
When bounty rewards qualify as professional income, they must generally be declared under Section XVIII (“profits from liberal professions or other gainful activities”), usually under code 1650/2650.
Miscellaneous income or professional income? The grey area surrounding bounty rewards
In practice, the boundary between miscellaneous income and professional income remains highly factual and often constitutes a grey area. Once bounty activities go beyond one or a handful of occasional rewards and take on a more regular, organized, or profit-oriented nature, the risk of reclassification as professional income increases significantly.
In such situations, it may be advisable to request a tax ruling (advance decision) in order to obtain legal certainty in advance regarding the tax treatment of the income. For more information on tax rulings and advance decisions, we refer to our dedicated article on this subject.
III. What if bounty rewards are received in crypto?
When bounty rewards are paid in crypto assets, additional tax and banking considerations arise in practice. Proper documentation is essential.
Banks increasingly expect taxpayers to clearly demonstrate:
why certain crypto assets were received;
from which company, protocol, or platform the rewards originated;
which services or activities were performed;
how the compensation was calculated;
to which wallet the crypto assets were transferred;
whether taxes were paid.
The source of funds is crucial in this context. Without sufficient documentation, banks may refuse certain transactions, request additional supporting documents, or in some cases even block funds.
In addition, it is important to distinguish between:
the initial bounty reward itself;
and the subsequent capital gain that may later be realized on the received crypto assets.
The reward at the moment of receipt in principle constitutes taxable miscellaneous income. If the received crypto assets subsequently increase in value, a separate capital gains tax may also become due on that additional appreciation.
Example
In principle, this €22,000 must be declared as taxable income (for example as miscellaneous income or professional income, depending on the specific circumstances).
In that case, the new capital gains tax on financial assets may separately apply to that additional gain (disregarding the annual exemption). |
These income streams must also be properly declared in the tax return. In addition, foreign crypto accounts or platforms on which the crypto assets are received may, in certain cases, also need to be reported to the Central Contact Point of the National Bank of Belgium (CAP).
We would also like to point out that the conversion (swap) of crypto assets into other crypto assets may likewise be taxable, even where the conversion is made into a stablecoin.
IV. Conclusion
Bug bounty programs and bounty rewards are perfectly legal activities and today play an important role in both the cybersecurity sector and the crypto sector. Many companies, platforms, and blockchain projects actively encourage external researchers to identify security issues so that vulnerabilities can be resolved in a timely manner.
That being said, such rewards also give rise to important tax and banking considerations.
In practice, particular attention should be paid to:
the correct tax qualification as miscellaneous income or professional income;
maintaining sufficient documentation and supporting evidence for banks and compliance departments;
the possible reporting obligation of foreign crypto accounts or wallets to the CAP;
the potential application of the new general capital gains tax on subsequent increases in value of received crypto assets.
Proper recordkeeping and prior tax analysis are essential in order to avoid disputes with the tax authorities or banking issues.
Frequently asked questions regarding the taxation of bug bounty rewards
Are bug bounty rewards always taxable in Belgium?
In most cases, yes. A full exemption as normal management of private wealth is legally difficult to defend because an active service is always provided in exchange.
At what rate are bug bounty rewards taxed?
That depends on the specific circumstances. Occasional rewards are generally taxed as miscellaneous income at 33% (+ municipal taxes). In the case of regular or organized activities, progressive tax rates of up to 50% may apply.
When are my bounty activities considered professional income?
The tax authorities look at the frequency, level of organization, professional expertise, use of infrastructure, and volume of the income. There is no strict threshold; it is always a factual assessment.
What if I receive my reward in crypto?
The reward is taxable at the moment of receipt, based on its market value at that time. Any later increase in value of the received crypto may additionally be subject to capital gains tax.
Do I need to report my wallet?
Foreign crypto accounts or platforms must, in certain cases, be reported to the CAP (Central Contact Point of the National Bank of Belgium).
Can I obtain certainty in advance regarding my tax situation?
Yes. Through a tax ruling, you can obtain legal certainty in advance. This is particularly advisable if you regularly receive bounty rewards.
About Aeacus Lawyers
Aeacus Lawyers is a Belgian law firm specialized in crypto tax law and financial law. We assist investors, traders, founders and companies with the tax and regulatory aspects of digital assets and financial structures.
This article is intended for informational purposes only. Do you have further questions about the taxation of crypto-assets or your personal situation? Click below to schedule a free and non-binding initial consultation.
If you have any other questions about crypto, be sure to check out our Frequently Asked Questions (FAQ)
