Tesla paid a Russian hacker $15,000 per bug found — then he cracked open the case that cost them $243 million

Tesla's public bug bounty program, run through the platform Bugcrowd, has advertised rewards from hundreds to tens of thousands of dollars per qualifying finding. This kind of "white hat" arrangement is common across Silicon Valley, where tech companies pay independent researchers to find holes before criminals do. Green, by his own account, stumbled into Tesla's systems while investigating whether the company was using open-source code without publishing it, and his curiosity only deepened from there.

Benavides v. Tesla

The crash at the center of the case happened just after 9 p.m. on April 25, 2019, on a dark, two-lane stretch near Key Largo, Florida. George McGee, driving a 2019 Model S with Autopilot engaged, dropped his phone and bent to retrieve it. The car blew through a stop sign and a flashing red light at roughly 62 mph and slammed into a parked Chevrolet Tahoe. Naibel Benavides Leon, 22, was standing beside the SUV with her boyfriend, Dillon Angulo. She was killed, while he was critically injured.

To prove their case, Angulo and Leon’s family needed the Autopilot computer's record of what the car's cameras had seen in the final seconds — a package of crash data that Tesla vehicles automatically transmit to company servers after a collision. Tesla said it never had the full file. A service-center technician who plugged in the computer years earlier had pronounced the data corrupted. That story held up until the plaintiffs recovered the original hardware from the Florida Highway Patrol in 2024 and brought in Green, who had built a following for recovering data from wrecked Teslas and posting his findings — the same work that once made him useful to Tesla.

Green warned the legal team not to simply power the units on, as Tesla had suggested. Doing that near an internet connection, he said, was "exactly the advice I would give" if the goal were to destroy evidence, since Tesla's standard practice marked local crash data for deletion after uploading it. Instead, he worked from a forensic clone.

A ThinkPad and a Starbucks hot chocolate

In October 2024, the plaintiffs' attorneys flew Green to Miami and sat with him inside a Starbucks near the airport. He fired up his ThinkPad laptop, plugged in a flash drive holding the forensic copy, and — over a Venti-size hot chocolate — found the missing data within minutes. It included the collision snapshot and confirmation that Tesla had received the file within moments of the crash. The attorneys high-fived behind him, according to The Washington Post.

"For any reasonable person, it was obvious the data was there," Green told WaPo, who spoke to the pub anonymously out of fear of retribution.