Russia and Brazil are hacking Facebook, and the social network is paying them to do it.

Facebook paid out US$1.5 million to security researchers worldwide last year as part of its Bug Bounty programme, and the two emerging markets were responsible for reporting some of the most critical threats, according to a report Facebook released this week.

The company rewards disclosures about vulnerabilities, and then uses the information to fortify the world’s largest social network against hackers.

Russians submitted 38 bugs that Facebook paid US$3961 for each on average, totalling US$150,518. Brazilians found 53 bugs, worth US$3792 on average. Brazil’s total take was US$200,976.

Researchers in India contributed the largest number of bugs, at 136, but earned just US$1353 on average for each of them, amounting to a total of US$184,008. Those in the US earned an average of US$2272 each for 92 bugs, totalling US$209,024.