A researcher was awarded $10,000 by Facebook for the discovery of a critical vulnerability that could have been exploited to hack Instagram accounts. The white-hat hacker Laxman Muthiyah received by Facebook a $30,000 reward as part of its bug bounty program. The process affected Instagrams password recovery process for mobile devices that leverages on a six-digit code sent to the users phone to change the password. The photo and video-sharing social networking service implemented a mechanism that prevents brute force attacks aimed at obtaining this code.”]
Source: https://securityaffairs.co/wordpress/90413/hacking/instagram-account-takeover-issue.html