Bounty

Cryptocurrency

Million

when

Cryptocurrency exchange Kraken recently revealed that it had fallen victim to a critical security flaw, resulting in the appropriation of $3 million worth of <a href="https://bitcoinist.com/kraken-ipo-planned-100-million-funding-injection/" target="_blank" rel="noopener ">digital assets </a>by a research team.&nbsp; 
The incident unfolded after the exchange received a bug report through its bug bounty program on June 9 from a self-described security researcher who claimed to have discovered an “extremely critical” bug that allowed him to “artificially inflate” his balance on the platform.&nbsp; 
However, the situation took an unexpected turn when it was discovered that the researcher and their associates had exploited the flaw to withdraw a substantial sum. Kraken has launched a <a href="https://bitcoinist.com/kraken-sees-largest-bitcoin-ethereum-outflows-2017/" target="_blank" rel="noopener ">criminal investigation</a> into the matter and is coordinating with law enforcement agencies to address the incident. 
<h2 id="kraken-faces-extortion-attempt">Kraken Faces Extortion Attempt</h2> 
In a social media <a href="https://x.com/c7five/status/1803403565865771370" target="_blank" rel="noopener nofollow">post</a>, the exchange’s chief security officer, Nick Percoco, said that after receiving the initial bug report, Kraken assembled a cross-functional team to investigate the issue.&nbsp; 
Within minutes, they identified an isolated bug that enabled a malicious attacker to initiate a deposit, receive funds in their account without completing the deposit fully, and effectively create assets in their Kraken account for a limited time.&nbsp; 
The vulnerability was classified as critical, and the team reportedly mitigated the issue within an hour, ensuring it could not recur. The flaw emerged from a recent user experience (UX) change that allowed clients to trade <a href="https://bitcoinist.com/kraken-considers-delisting-tethers-usdt-stablecoin/" target="_blank" rel="noopener ">crypto markets</a> in real time before their assets cleared, a change that had not been thoroughly tested against this specific attack vector. 
Further investigation revealed that three accounts had taken advantage of the flaw within a few days of each other. It is alleged that one of these accounts was linked to an individual claiming to be a security researcher who had discovered the bug and credited their account with a “small amount of crypto” to demonstrate the flaw.&nbsp; 
However, instead of reporting the vulnerability and earning a <a href="https://bitcoinist.com/crypto-kraken-fights-sec-definition-securities/" target="_blank" rel="noopener ">bug bounty </a>reward, this individual disclosed the bug to two associates who fraudulently generated much larger sums. In total, the trio withdrew nearly $3 million from Kraken’s treasuries. 
When Kraken requested the return of the funds, the researchers refused, demanding discussions with their business development team and specifying a speculated amount that the bug could have caused if undisclosed. 
<h2 id="legal-action-against-research-company">Legal Action Against Research Company</h2> 
Percoco further disclosed in its address that Kraken firmly denounced the actions of the research team, considering their behavior as “extortion” rather than legitimate <a href="https://bitcoinist.com/hong-kong-bitcoin-etfs-reach-1-billion-aum-by-2024/" target="_blank" rel="noopener ">white-hat hacking</a>.&nbsp; 
The exchange, which has maintained a Bug Bounty program for almost a decade, emphasized that it has never encountered issues with legitimate researchers and has always followed clear rules, such as not exploiting vulnerabilities beyond what’s necessary for proof, providing a proof of concept, and returning any extracted assets immediately.&nbsp; 
Lastly, the exchange’s chief security officer also stated that Kraken is treating the incident as a criminal matter and is actively cooperating with law enforcement. While the exchange expressed gratitude for the report, it intends to pursue <a href="https://bitcoinist.com/bitcoin-etf-buzz-in-uk-kraken-executive-pushes-for-market-access/" target="_blank" rel="noopener ">legal action</a> against the research firm involved. 
<img loading="lazy" decoding="async" class="size-medium" src="https://www.tradingview.com/x/olfJ5Z2S/" alt="Kraken" width="1815" height="858"> 
Featured image from DALL-E, chart from TradingView.com

Kraken Exposes $3 Million Exploit By Research Team, Launches Criminal Investigation

Table of Contents

Bitcoinist

Other articles published on Jun 20, 2024

Kraken Includes FLOKI in Perpetual Futures Trading, Bolstering Its Market Position

Elon Musk Confirms AI Gains Traction Fast

Bitcoin ETF Invasion: VanEck’s Australian Launch Sparks Crypto Craze

Lol Coinage (LOL) (Airdrop Launched) - Claim this Airdrop Now!

Top 4 Crypto Presales: Join the Presale of the Game-Changing Token!

Ethereum: Is $4k close as SEC changes its stance on ETH?

Join our free newsletter for daily crypto updates!