Bounty

Million

Security

Read

<p>The post <a href="https://coinpedia.org/news/crypto-exchange-kraken-loses-3-million-to-exploited-security-flaw/" rel="noopener noreferrer nofollow">Crypto Exchange Kraken Loses $3 Million to Exploited Security Flaw</a> appeared first on <a href="https://coinpedia.org" rel="noopener noreferrer nofollow">Coinpedia Fintech News</a></p>
<p>The world’s leading crypto trading platform, <a href="https://coinpedia.org/exchange/kraken-review/" target="_blank" rel="noopener noreferrer nofollow">Kraken</a> has recently admitted it fell victim to an attack that successfully leveraged a zero-day vulnerability to steal crypto worth millions.</p>
<h2 class="wp-block-heading" id="h-the-exploit-unveiled"><strong>The exploit unveiled</strong></h2>
<p>Kraken got an email from its Bug Bounty researcher on 9th June 2024, which alerted it about a serious vulnerability in the network. The flaw enabled an attacker to manipulate balance sheet figures on the site to a level not supported by actual funds as has been <a href="https://x.com/c7five/status/1803403565865771370" target="_blank" rel="noopener noreferrer nofollow">explained</a> by Kraken’s Chief Security Officer, Nick Percoco.&nbsp;</p>
<p>This critical vulnerability allowed the attacker to make deposits and withdraw money in their account while yet to complete the deposit process.</p>
<h2 class="wp-block-heading" id="h-swift-response-but-not-swift-enough"><strong>Swift Response but not swift enough</strong></h2>
<p>Kraken was able to respond to the alert and eliminate the security problem within 47 minutes. The problem was traced to a new user interface introduced some time back that allowed customers to make deposits and utilize the money before the deposits were identified by the clearing house, if ever.&nbsp;</p>
<p>While Kraken stated that no clients’ cash was lost during the infiltration, the bug made it possible for people with ill intentions to deposit and withdraw fake cash.</p>
<p>In this case, three accounts began trying the identical move inside of a week and all of them tried to transfer $3 million out of the exchange. Of these, one account was owned by the security researcher who recently reported this bug.</p>
<p>As for the first identified vulnerability, Percoco commented that a person who aimed to exploit it invested $4 in crypto to illustrate the issue and it could be enough for a bug bounty report and subsequent reward. However, the researcher decided to give the bug details to two other participants, collectively, who were able to steal nearly $3 million from Kraken’s treasuries.</p>
<h2 class="wp-block-heading" id="h-ethical-dilemma-or-extortion"><strong>Ethical dilemma or extortion?</strong></h2>
<p>When Kraken approached the individuals to return the stolen funds and provide a proof-of-concept (PoC) exploit, the researchers demanded payment in exchange for the return of the assets. Percoco condemned this behaviour as extortion, emphasizing that it violated the ethical principles of white-hat hacking.</p>
<p>Kraken is treating the incident as a criminal case and is coordinating with law enforcement agencies</p>
<p>Also Read : <a href="https://coinpedia.org/news/major-crypto-scam-the-rise-of-pig-butchering-schemes/" rel="noopener noreferrer nofollow">SHOCKING: Crypto “Pig Butchering” Scams on the Rise! What You Should Know</a></p>

Crypto Exchange Kraken Loses $3 Million to Exploited Security Flaw

Table of Contents

CoinPedia News

Other articles published on Jun 20, 2024

Binance Launches LayerZero (ZRO) and Add Seed Tags!

Winklevoss Twins Donate $2M in Bitcoin to Trump Campaign

Real-Time Revolution: How One Oracle Solution is Transforming DeFi Transaction Speeds

'TrumpCoin' Was Launched By Barron Trump With Donald Trump's Approval, Martin Shkreli Alleges

Kraken SEC Lawsuit Prepares for New Developments with Debate from the Exchange

LayerZero CEO Confirms No Obligatory ZRO Airdrop Donation!

Join our free newsletter for daily crypto updates!