The motive was games
The reported motive is the least sophisticated part of the story and the most convincing. Von Hassel, in The Hustle's account, was desperate to get into games he was not allowed to play. Parental controls stood between a five-year-old and the content behind them, and he went looking for a way round.
What he found was a genuine authentication weakness in the Xbox One rather than a guessed password. That is the distinction that separates a child defeating a lock from a security finding: the flaw was in the system's design, and it would have worked for anyone who knew it.
The choice his father gave him
The decisive moment in the story was not technical. His father, described in the reporting as a computer systems engineer, presented him with the two options that define the field: publicise the flaw, or report it to the company so it could be fixed. Von Hassel chose to notify Microsoft.
That choice is why the label attached to him is professional hacker rather than something less flattering. Responsible disclosure is the entire ethical architecture of modern security research, and a five-year-old was walked through it at the first opportunity. The source does not record what Microsoft said in reply, what it paid, or how quickly the flaw was closed.
The industry he arrived in
The Hustle places him inside a market that had grown up around exactly this behaviour. Bug bounty programmes pay outsiders to find and report flaws, and the article records 300,000 hackers from 150 countries using the platform HackerOne, which paid out 19 million dollars to them in a single year. Rival platforms named alongside it include BugCrowd and HackenProof.
The economics are steeper than the headline numbers suggest. Fewer than one per cent of the hackers on the platform earn a full-time income from it, according to the same piece, while 57 per cent of millennials surveyed regarded hacking as a legitimate professional path. Facebook's programme, the article notes, set a floor of 500 dollars per valid report with no stated ceiling. Von Hassel's find predates most of his ability to take part in any of it.
What is documented — and what is not
The firm facts are the age at discovery, the system involved, the motive, the father's intervention, the decision to disclose to Microsoft, and the inclusion of his name on the Christian Science Monitor's fifteen-under-fifteen list of young cybersecurity figures. The description of him as the youngest professional hacker in the world is a characterisation by The Hustle, not a title awarded by any body.
The chronology is unresolved. The article describes him as eleven years old while the page carries a 2024 date, which suggests the text dates from considerably earlier than the timestamp. No source in this record gives his birth year, his current age, his school, his home city, or what he has done since. That gap is left open rather than guessed at.
Why a five-year-old could find it
Security research rewards people who do not know what is supposed to be impossible. An adult tester approaches a login screen with assumptions about how it was built; a small child approaches it as an obstacle with unknown rules and tries things that no specification anticipates. A surprising share of authentication bugs are found precisely that way.
That is the reason the story travelled beyond gaming coverage when it broke, and the reason it is still cited in pieces about young bounty hunters years later. It is a clean illustration of the field's founding argument: the people most likely to find the hole in a system are not the people paid to build it.
Watch: Kristoffer von Hassel on camera
| Person | Country | Milestone | Age / Stat |
|---|---|---|---|
| Sawsan Ahmed | United States | Broward College's youngest graduate, at 12, in December 2021 | Age 12 |
| Arvind Mahankali | United States | Won the 2013 Scripps National Spelling Bee at 13 | Age 13 |
| Kerry Close | United States | Won the 2006 Scripps National Spelling Bee at 13 | Age 13 |
| Shania Muhammad | United States | Langston University's youngest graduate, at 15 | Age 15 |
| Kristoffer von Hassel | United States | Finding an Xbox One security flaw at age 5 and reporting it to Microsoft | — |
What is documented — and what is not
✓ Documented
- Found an Xbox One authentication flaw at age 5 and reported it to Microsoft (The Hustle)
- His father, a computer systems engineer, presented the choice between publishing and reporting
- Named on the Christian Science Monitor's "15 Under 15" cybersecurity roster
? Unverified, disputed or wrong
- "Youngest professional hacker in the world" is a description by a publication, not a verified title
- No birth year, current age, school or location is published in these sources
- The article's stated age of 11 does not align cleanly with the page's 2024 date
- No record of Microsoft's response, any payment, or what he has done since
Questions people ask about Kristoffer von Hassel
What did Kristoffer von Hassel do?
At five he found a security flaw in the Xbox One while trying to reach games he was not allowed to play, and reported it to Microsoft instead of publishing it.
How old was he when he hacked the Xbox?
Five, according to The Hustle. The same article describes him as eleven at the time of writing.
Is he really the youngest professional hacker in the world?
That is how The Hustle describes him. It is a characterisation by a publication, not a title awarded or verified by any official body.
What did Microsoft do about it?
No source in this record states what Microsoft said, paid or changed in response. Only the decision to report is documented.
Where is Kristoffer von Hassel now?
No source in this record says. The published trail stops with the coverage of the Xbox finding and the fifteen-under-fifteen listing.
How old is he now?
No birth year is published in these sources. The article describes him as eleven, but its date does not line up cleanly with that, so no current age can be stated.
Is Kristoffer von Hassel on Wikipedia?
No Wikipedia article was confirmed in the sources gathered for this page. The source used here is The Hustle's report on teenage bug bounty hunters.
Did he get paid for the flaw?
No payment is documented in this record. Bug bounty programmes described in the same article, such as Facebook's, paid a minimum of 500 dollars per valid report, but nothing connects that to his case.
Quick quiz: how well do you know Von Hassel’s story?
What was Kristoffer von Hassel trying to do when he found the flaw?
How old was he?
What did he do with the flaw?
Sources
- How teenage hackers became tech's go-to bounty hunters — The Hustle, 2024-10-01
Checked by the Geniuses.club editorial team. Ages are given as of September 2026.
Discover More Child Prodigies
50+ stories of contemporary young geniuses changing chess, music, science, and art.
Explore All Prodigies →Related Child Prodigy Profiles
Shania Muhammad🇺🇸 United States — She finished a bachelor's degree at 15. A year later she…
Arvind Mahankali🇺🇸 United States — He spelled 'knaidel', won the national bee…
Sawsan Ahmed🇺🇸 United States — She took her teddy bear into a college biology lab at 10.…
Kerry Close🇺🇸 United States — Four national bees ended in defeat. The fifth ended with a…
Sriram Hathwar🇺🇸 United States — He was the bee's youngest speller at eight. Six years…
Balu Natarajan🇺🇸 United States — An immigrant's son won America's English competition in…
.jpg)