After authorities revoked Vupen’s global export license, Bekrar packed up and moved his Montpelier offices to the cyberarms market’s global headquarters: Washington, D.C. He took a page from the disgraced military contractor Blackwater and rebranded Vupen as Zerodium. He set up a slick new website and, in an unprecedented move, started advertising the prices he was paying for zero-day exploits, in exchange for hackers’ silence.

