Bounty

Security

<a href="https://bitcoinworld.co.in/kraken-crypto-exchange-faces-extortion-attempt-from-security-researcher-who-discovered-a-critical-bug/" title="Kraken Crypto Exchange Faces Extortion Attempt From Security Researcher Who Discovered A Critical Bug" rel="noopener noreferrer nofollow"></a>
<ul>
 <li style="font-weight: 400">What initially seemed like a critical bug report from a security researcher quickly turned into an extortion attempt on Kraken.</li>
</ul>
On June 9, 2024, Kraken, a prominent cryptocurrency exchange, received an alarming Bug Bounty report. The report, submitted by a security researcher, claimed to have discovered an “extremely critical” bug that allowed balance inflation.&nbsp;
However, what initially seemed like a routine vulnerability report quickly turned into an <a href="https://bitcoinworld.co.in/security-researcher-exploited-security-bug-to-withdraw-over-3m-on-kraken/" rel="noopener noreferrer nofollow">extortion attempt</a>.
While investigating the bug report, a team led by Nick Percoco, Kraken’s Chief Security Officer, identified a $3 million exploit. Specifically, the executive addressed the whole situation in a thread on <a href="https://x.com/c7five/status/1803403565865771370" rel="noopener noreferrer nofollow">X</a> (formerly Twitter), posted on June 19.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Kraken Security Update:
 On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.
 — Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803403565865771370?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 19, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
Notably, the investigation revealed that three accounts had exploited the reported flaw within days of each other.&nbsp;
One account belonged to an individual who claimed to be a security researcher. Essentially, this person discovered and leveraged the bug to credit their account with $4 in crypto.
Perococo described it as sufficient to prove the flaw and collect a substantial reward through Kraken’s Bug Bounty program.&nbsp;
However, things escalated quickly after noticing the other two accounts, which allegedly benefited from the first person’s disclosure.
According to Nick Percoco,
“Instead, the ‘security researcher’ disclosed this bug to two other individuals who they work with who fraudulently generated much larger sums. They ultimately withdrew nearly $3 million from their Kraken accounts. This was from Kraken’s treasuries, not other client assets.”
<h3 id="span-style-font-weight-400-from-a-bug-report-to-an-extortion-attempt-span">From A Bug Report To An Extortion Attempt</h3>
When Kraken requested a full account of their activities and the return of the withdrawn funds, the security researchers refused and demanded a call with their business development team, engaging in what Percoco described as extortion.
Moreover, the Chief Security Office explained that Kraken’s Bug Bounty program, in place for nearly a decade, has clear rules. In particular:
“Do not exploit more than necessary to prove the vulnerability, provide a proof of concept, and immediately return any extracted funds.”
According to the exchange’s executive, legitimate researchers have never faced issues with Kraken, which has always been responsive.
In the interest of transparency, the company disclosed the bug to the industry and is treating the incident as a criminal case, coordinating with law enforcement agencies.&nbsp;
The exchange emphasized that ignoring bug bounty program rules and attempting to extort the company revokes a researcher’s “license to hack” and makes them criminals.
<h3 id="span-style-font-weight-400-kraken-s-bug-investigation-span">Kraken’s Bug Investigation</h3>
Furthermore, Nick Percoco revealed that the exchange regularly receives fake bug bounty reports. Nevertheless, Kraken treated this report seriously and promptly assembled a team to investigate.&nbsp;
Within minutes, they discovered an isolated bug that, under specific circumstances, allowed a malicious attacker to initiate a deposit and receive funds without fully completing the transaction.
“To be clear, no client’s assets were ever at risk. However, a malicious attacker could effectively print assets in their Kraken account for a period of time,” Nick Percoco added.
Kraken’s team mitigated the issue within an hour and 47 minutes, as reported by Percoco. The vulnerability was completely fixed within a few hours, ensuring it could not reoccur.&nbsp;
The flaw stemmed from a recent user experience (UX) change that credited client accounts before their assets cleared, enabling real-time trading.&nbsp;
Nick Percoco said, “This change was not thoroughly tested against the specific attack vector”
Despite this isolated experience, Kraken remains committed to its Bug Bounty program, recognizing its importance in enhancing the overall security of the crypto ecosystem.&nbsp;
Perhaps the so-called security researcher is actually a hacker. The exchange looks forward to working with good-faith actors in the future while taking a stand against unethical behavior.

Kraken Crypto Exchange Faces Extortion Attempt From Security Researcher Who Discovered A Critical Bug

Table of Contents

ItsBitcoinWorld

Other articles published on Jun 20, 2024

Bitcoin Mining Stocks Marathon Digital, Riot Platforms And CleanSpark Are Moving Higher: What's G...

Dogecoin Funding Rates Turn Negative As Short Sellers Eye Further Losses

BlockDAG’s X1 Miner App Shines with $52.3M Presale Among Monero’s Privacy Issues and VeChain’s Ma...

Bitcoin (BTC) Price is Surging Again! Here’s the Data and the Legendary Analyst’s Next Prediction

Jupiter DEX aggregator may switch tokenomics to community-first, slash excess supply

ETH targets $5,500 as SOL and RBLK prepare for takeoff

Join our free newsletter for daily crypto updates!