Back when I cared about bitcoin, I'd go look at their websites for vulnerabilities and usually find them. Then I would tell them.
They never replied but did fix them.
They never replied but did fix them.
I asked around and was told "oh, yeah, they changed the defaults recently so there is always a transaction cost, you should pay closer attention to mailing list X, it's more up-to-date than the API documentation."
I decided I didn't like dealing with something where I had to assume the fine print was out to screw me and walked away. I have other things to do with my life.
(I probably am misremembering a few details of something that took place a few years ago.)