Read

Kraken’s chief security officer disclosed that a bug in the exchange’s funding system led to a $3 million loss after being exploited by rogue security researchers.
American crypto exchange <a href="https://crypto.news/tag/kraken/" target="_blank" rel="noopener noreferrer nofollow">Kraken</a> lost around $3 million worth of crypto in early June after a rogue “security researcher” exploited a bug in the exchange’s funding system. Kraken’s chief security officer Nick Percoco disclosed the incident <a href="https://x.com/c7five/status/1803403565865771370" target="_blank" rel="noopener noreferrer nofollow">in an X thread</a>, emphasizing the breach of ethical standards by the individuals involved.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Everyday we receive fake bug bounty reports from people claiming to be “security researchers”. This is not new to anyone who runs a bug bounty program. However, we treated this seriously and quickly assembled a cross functional team to dig into this issue. Here is what we found.— Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803403569854648407?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
As per Percoco, the team first received a notification from a “security researcher” about a potential bug on Jun. 9. Later on, the team found a “flaw deriving from a recent UX change” that would allow credit client accounts before their assets cleared, enabling clients to effectively trade crypto markets in real-time. The Kraken CSO admitted the exchange didn’t test the UX change against that specific attack vector prior to the attack.
“This UX change was not thoroughly tested against this specific attack vector,” Percoco wrote.
You might also like: <a href="https://crypto.news/kraken-again-asks-to-dismiss-sec-lawsuit-citing-incorrect-wording/" rel="noopener noreferrer nofollow"> Kraken again asks to dismiss SEC lawsuit, citing incorrect wording </a>
After patching the vulnerability, Kraken discovered that three accounts had earlier exploited the same flaw within a few days of each other. Instead of reporting the bug directly, the security researcher allegedly shared the information with two associates, Percoco said, adding that the unknown individuals ultimately withdrew nearly $3 million from Kraken’s treasuries.
Percoco pointed out that the initial report from the “security researcher” didn’t fully disclose the bug, so the team had to re-confirm some details to progress with rewarding them for successfully identifying a security flaw.
Kraken requested a full account of their activities, a proof of concept, and the return of the withdrawn funds. However, the individuals refused to comply, which Percoco described as “not white-hat hacking” but rather “extortion.” It remains unclear whether Kraken identified all the attackers or managed to recover the stolen funds.
Read more: <a href="https://crypto.news/crypto-exchange-kraken-eyes-100m-pre-ipo-raise/" rel="noopener noreferrer nofollow"> Crypto exchange Kraken eyes $100m pre-IPO raise </a>

Kraken chief security reveals UX change resulted in $3m bug exploit

crypto.news

Other articles published on Jun 19, 2024

Apexrom (APR) Debuts on ProBit Global: Pioneering a User-Centric Crypto Ecosystem

Shibarium Skyrockets 441%: SHIB Community’s New Era Beckons

BitcoinCash Weekly News June 17th 2024 by the Bitcoin Cash Foundation

X (Twitter) Rival Lens Protocol Seeks $50 Million In New Funding

Solana Price Analysis: Why Ongoing SOL Correction Could Lead to Big Gains

Crypto Experts Signal Green As MoonBag Presale Raises $2.5M Within a Month

Join our free newsletter for daily crypto updates!