Bounty

Bitcoin

US-based exchange Kraken lost almost $3 million in its treasury after an unnamed security company exploited a bug on its platform. The chief security officer, Nick Percoco, <a href="https://x.com/c7five/status/1803403565865771370" rel="nofollow" target="_blank">disclosed</a> this in a post on X, stating that the security firm has refused to return the funds and is now demanding a higher payout as a bounty. 
Also Read: <a href="https://www.cryptopolitan.com/dmm-bitcoin-to-repay-users-after-300m-hack/">Crypto Exchange DMM Bitcoin Vows To Repay Users After $300M Hack</a> 
In response, Kraken has escalated the matter to law enforcement agencies and will treat it as criminal. However, users do not have to worry, as the exchange claims it has already resolved the vulnerability, and no user account has been impacted. 
<h2 id="span-style-font-weight-400-kraken-bug-allows-money-printing-span">Kraken bug allows money printing</h2> 
According to Percoco, a security researcher alerted Kraken about a critical bug via its Bug Bounty program on June 9. Upon internal investigations, the exchange security team discovered a vulnerability that could allow a bad actor to initiate a deposit into their Kraken account and receive the funds without completing the deposit. A malicious attacker could print millions out of thin air through this exploit. 
He explained: 
<blockquote>
 “We discovered an isolated bug. This allowed a malicious attacker, under the right circumstances, to initiate a deposit onto our platform and receive funds in their account without fully completing the deposit.”
</blockquote> 
The internal security team mitigated the issue within 47 minutes and fixed it completely after a few hours. However, the firm discovered that the bug resulted from a recent change in its UX that allowed client accounts to be credited before their assets cleared. Although the change was integrated to enable instant trading, it was not fully tested against this type of risk. 
However, Percoco added that the incident did not affect users’ assets, and the exploits of the vulnerability only affected the Kraken treasury. 
<h2 id="span-style-font-weight-400-the-security-researchers-are-criminals-span">The security researchers are criminals </h2> 
Meanwhile, an analysis of the vulnerability found that three accounts exploited the flaw, and one of those accounts was registered under the name of the security researcher who initially contacted the exchange. 
Also Read: <a href="https://www.cryptopolitan.com/kraken-consider-delisting-usdt-eu-regulation/">Kraken Considers Delisting USDT in Response to New EU Regulations</a> 
While the researcher’s account only used the flaw to credit themselves $4, enough to prove the bug was real, the two other accounts withdrew almost $3 million from their Kraken accounts using the same exploit. Interestingly, these accounts were associated with associates of the security researcher. 
Kraken explained that its attempts to get the funds returned have been futile as the researchers&nbsp;are now asking for a higher payment that they believe is commensurate with the risk of the bug. 
Percoco described this as an act of extortion, which contradicts the principle behind the Bug Bounty program. He added that violating those rules that give white hat hackers the license to hack makes the security researchers criminals, and the exchange is treating them as such.

Kraken reveals bug allowed rogue ‘security researchers’ to exploit $3M

Table of Contents

Cryptopolitan_News

Other articles published on Jun 19, 2024

ZachXBT Receives $150K for Unmasking DJT Token Creators

Top Meme Coin Presale in 2024: Investors Pick MoonBag for Staking Rewards, Disown BitBot and Chai...

Paraguay Endures Crackdown on Illegal Bitcoin Mining with Harsh Penalties

How to Get Free Bitcoin Safely and Easily

Solana to Skyrocket? Key Chart Shared by Analyst

Polkadot Now at Its Lowest Valuation Since November 2023: What’s Next for the DOT Price?

Join our free newsletter for daily crypto updates!