Tornado Cash

Read

Polygon

Tornado

<p class="is-style-lead">Blockchain security firm CertiK confirmed it was behind a bug exploit that resulted in an unauthorized withdrawal of $3 million worth of tokens from Kraken.</p> 
<p>New York-headquartered blockchain security firm <a href="https://crypto.news/tag/certik/" target="_blank" rel="">CertiK</a> has admitted to being behind a bug exploit that resulted in an unauthorized withdrawal of $3 million worth of tokens from the <a href="https://crypto.news/tag/kraken/" target="_blank" rel="">Kraken</a> crypto exchange.</p> 
<p>In a Jun. 19 <a href="https://x.com/CertiK/status/1803450205389402215" target="_blank" rel="">thread</a> on X, CertiK revealed that it had identified a series of “critical vulnerabilities” in Kraken’s exchange that could “potentially lead to hundreds of millions of dollars in losses.”</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">CertiK recently identified a series of critical vulnerabilities in <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="">@krakenfx</a> exchange which could potentially lead to hundreds of millions of dollars in losses.<br><br>Starting from a finding in <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="">@krakenfx</a>'s deposit system where it may fail to differentiate between different internal… <a href="https://t.co/JZkMXj2ZCD" target="_blank" rel="">pic.twitter.com/JZkMXj2ZCD</a></p>— CertiK (@CertiK) <a href="https://twitter.com/CertiK/status/1803450205389402215?ref_src=twsrc%5Etfw" target="_blank" rel="">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>According to CertiK, the issue was first identified on Jun. 5, and Kraken failed multiple tests, indicating that the exchange’s defense-in-depth system was “compromised on multiple fronts.” The firm particularly noted that it managed to bypass the exchange’s withdrawal risk controls without triggering any alerts.</p> 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 <p>“A huge amount of fabricated crypto (worth more than 1M+ USD) can be withdrawn from the account and converted into valid cryptos. Worse yet, no alerts were triggered during the multi-day testing period. Kraken only responded and locked the test accounts days after we officially reported the incident.”</p> 
 <p>CertiK</p> 
</blockquote> 
<p> You might also like: <a href="https://crypto.news/kraken-chief-security-reveals-ux-change-resulted-in-3m-bug-exploit/" rel=""> Kraken chief security reveals UX change resulted in $3m bug exploit </a> </p> 
<p>Upon discovering the flaws, CertiK claims it informed Kraken, whose security team classified the issue as “critical.” However, after the exploit was identified and fixed, CertiK alleges that Kraken’s security operations team “threatened” individual CertiK employees, demanding repayment of a “mismatched amount of crypto in an unreasonable time even without providing repayment addresses.”</p> 
<p>CertiK urged Kraken to “cease any threats against whitehat hackers,” asserting its commitment to the web3 community “in the spirit of transparency.” However, the incident has sparked controversy and skepticism within the blockchain community as blockchain researchers have highlighted discrepancies in CertiK’s timeline and claims.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">HAHAHHA YOU FUCKING CLOWNS<br><br>There is absolutely NO universe where this is "whitehat security research"<br><br>Kraken is being incredibly patient for not outright calling this what it very clearly is: a multimillion dollar theft with a side of extortion.</p>— Tay 💖 (@tayvano_) <a href="https://twitter.com/tayvano_/status/1803476389280227849?ref_src=twsrc%5Etfw" target="_blank" rel="">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>As <a href="https://x.com/Meir_Dv/status/1803526308258787704" target="_blank" rel="">noted</a> Cyvers chief technology officer Meir Dolev on his X account, an address associated with CertiK began suspicious activity across multiple blockchain networks weeks before the Kraken incident was first reported, raising questions about the timeline provided by CertiK.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Following the <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="">@krakenfx</a> Incident, similar activity started on base 26 days ago!! The same signature hash is also used on Polygon 14 days ago. So should we believe Cetik timeline that they found the vulnerability only on June 5th?<a href="https://twitter.com/tayvano_?ref_src=twsrc%5Etfw" target="_blank" rel="">@tayvano_</a> <a href="https://t.co/cvAnVrTg67" target="_blank" rel="">pic.twitter.com/cvAnVrTg67</a></p>— Meir Dolev (@Meir_Dv) <a href="https://twitter.com/Meir_Dv/status/1803526308258787704?ref_src=twsrc%5Etfw" target="_blank" rel="">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>In a follow-up post under CertiK’s thread, Coinbase director Conor Grogan <a href="https://x.com/jconorgrogan/status/1803486112608034854" target="_blank" rel="">pointed out</a> that addresses associated with CertiK sent part of the withdrawn crypto to <a href="https://crypto.news/tag/tornado-cash/" target="_blank" rel="">Tornado Cash</a>, a mixing service <a href="https://crypto.news/tornado-cash-case-crypto-anonymity-vs-regulation/" target="_blank" rel="">sanctioned</a> by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) for facilitating approximately $7 billion in crypto laundering since 2019.</p> 
<p>Reports also <a href="https://x.com/tayvano_/status/1803670051133989114" target="_blank" rel="">allege</a> that CertiK-associated addresses sent parts of the withdrawn crypto to <a href="https://crypto.news/tag/changenow/" target="_blank" rel="">ChangeNOW</a>, a non-custodial crypto exchange. As of press time, CertiK has made no public statements on why it interacted with Tornado Cash and ChangeNOW, though it claims to have returned all the withdrawn tokens to Kraken.</p> 
<p> Read more: <a href="https://crypto.news/telegram-certik-security-risk-claim/" rel=""> Telegram refutes CertiK’s auto-download security risk claim </a> </p>

CertiK admits Kraken’s $3m exploit, raises eyebrows for sending crypto to Tornado Cash

crypto.news

Other articles published on Jun 20, 2024

7 Benefits of Using Fiat On-Ramps in Your App

High-Reward Airdrops to Join: Maximize Your Crypto Gains

Notcoin and Fetch.AI Sustainability Issues Spur Investors To Migrate To MoonBag Meme Coin

BlockDAG’s X1 Miner App Hype Pushes Presale To $52.2 Million While Monero Faces Privacy Concerns ...

Queen Cardi B Memecoin to Skyrocket 14,000% Before KuCoin Listing, While SHIB, Bonk and Dogecoin ...

Kraken exchange’s $3 million theft leaves CertiK feeling ‘threatened’ – Why?

Join our free newsletter for daily crypto updates!