Security

Blockchain security firm CertiK has publicly revealed that it is the “security researcher” Kraken accused of stealing $3 million in digital assets. On June 19, CertiK disclosed in a post on X that it had identified a vulnerability in Kraken’s system, allowing the removal of millions from the exchange’s accounts.&nbsp;
Kraken’s Chief Security Officer, Nicholas Percoco, had previously claimed an unnamed security team, now identified as CertiK, committed “extortion” by <a href="https://www.cryptotimes.io/2024/06/19/kraken-hit-by-extortion-after-hackers-exploit-3-million-bug/" target="_blank" rel="noopener noreferrer nofollow">refusing to return</a> the funds until Kraken paid a speculative amount that could have been lost if the bug went undisclosed.
CertiK countered by stating that Kraken’s security team threatened individual employees, demanding repayment of an unspecified amount of crypto within an unreasonable time frame, without providing repayment addresses. CertiK announced plans to transfer the funds to an account accessible by Kraken.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 CertiK recently identified a series of critical vulnerabilities in <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@krakenfx</a> exchange which could potentially lead to hundreds of millions of dollars in losses. Starting from a finding in <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@krakenfx</a>'s deposit system where it may fail to differentiate between different internal… <a href="https://t.co/JZkMXj2ZCD" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/JZkMXj2ZCD</a>— CertiK (@CertiK) <a href="https://twitter.com/CertiK/status/1803450205389402215?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
 </blockquote>
 </div>
</figure>
CertiK detailed the vulnerabilities in Kraken’s system, which could have led to significant losses. Their investigation found that Kraken’s deposit system could fail to differentiate between different internal transfer statuses, allowing malicious actors to fabricate deposit transactions, withdraw fabricated funds, and convert them into valid cryptos without triggering any alerts.&nbsp;
CertiK stated, “After initial successful conversions on identifying and fixing the vulnerability, Kraken’s security operation team has THREATENED individual CertiK employees to repay a MISMATCHED amount of crypto in an UNREASONABLE time even WITHOUT providing repayment addresses.”
They noted that Kraken’s defense systems were compromised on multiple fronts, with the exchange only responding days after the vulnerabilities were reported.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Holy shit. Certik just admitted to being the security firm that stole from Kraken and is trying to extort them for more of a payment. Given how often Certik audits get hacked and now this shit, it’s wild they still exist. Down right criminal. <a href="https://t.co/Ijpv3x5Pxc" target="_blank" rel="noopener noreferrer nofollow">https://t.co/Ijpv3x5Pxc</a>— Adam Cochran (adamscochran.eth) (@adamscochran) <a href="https://twitter.com/adamscochran/status/1803483232509501584?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
 </blockquote>
 </div>
</figure>
CertiK emphasized its commitment to transparency and the security of the Web3 community, urging Kraken to stop threatening white-hat hackers. They called for collaboration to address security risks and safeguard the future of Web3.&nbsp;
Initial reactions from the crypto community seemed to support Kraken, viewing CertiK’s actions as not in line with typical white-hat hacker behavior.
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 Also Read: <a href="https://www.cryptotimes.io/2024/06/17/xlink-partners-fireblocks-ancilia-after-10m-hack/" target="_blank" rel="noopener noreferrer nofollow">XLink Partners Fireblocks, Ancilia After $10M Hack</a>
</blockquote>

CertiK Discovered Kraken Exploit, Accuses Threats from Exchange

The Crypto Times

Other articles published on Jun 19, 2024

2024’s Leading Crypto: NEAR Protocol Holders Shift to BlockDAG Following a $50.7 Million Presale ...

Who Is Martin Shkreli? Donald Trump Meme Coin Controversy Sets Internet Abuzz

Polygon (MATIC) Price Poised for Potential Recovery with Investor Support

‘Hold Onto Your Altcoins, But Don’t Convert Bitcoin Into Altcoins’: Here’s When Your Favorite Alt...

Chainlink and Tron Investors Troop to MoonBag, the Top Crypto Presale in 2024

XRP Price Prediction: Why Now Could Be the Best Time to Buy the Ripple Token

Join our free newsletter for daily crypto updates!