Tornado Cash

Tornado

The&nbsp;Kraken-CertiK saga&nbsp;has taken another turn.&nbsp;Security firm CertiK claims it carried out a white hat operation on specific Kraken accounts not belonging to customers, draining nearly $3 million, according to Kraken. However, the exchange claims the total exploited amount was not returned to it, while CertiK claims to have returned all funds as per their record.
On June 20, CertiK took to X to give an <a href="https://x.com/CertiK/status/1803646511110365426" target="_blank" rel="noopener nofollow">update</a>&nbsp;on the situation and claimed it had returned 734 Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>), 29,001 Tether (<a href="https://cointelegraph.com/tether-price-index">USDT</a>) tokens&nbsp;and 1,021 Monero (<a href="https://cointelegraph.com/xmr-price-index">XMR</a>) coins, while Kraken requested 155,818 Polygon (<a href="https://cointelegraph.com/polygon-price-index">MATIC</a>) tokens, 907,400 USDT, 475.5 ETH and 1,089.8 XMR.
<h2 data-ct-non-breakable="true" id="kraken-claims-exploit-certik-says-white-hat-operation">Kraken claims exploit, CertiK says white hat operation</h2>
The <a href="https://cointelegraph.com/news/kraken-claims-extortion-bug-bounty-report">Kraken-CertiK saga</a> began on June 9, when Kraken claimed it had received a bug bounty program alert from an alleged security researcher. The alert highlighted a bug in Kraken’s system that allowed users to inflate their account balances. When the crypto exchange rushed to patch the bug, it discovered three accounts that had leveraged the flaw, stealing $3 million from Kraken’s account.
Kraken found that one of the three accounts was Know Your Customer (KYC) verified and used the bug to credit $4 to their account.
Kraken chief security officer Nick Percoco <a href="https://x.com/c7five/status/1803403604667277520" target="_blank" rel="noopener nofollow">said</a> that this would have been enough to prove the bug and claim the bounty, but the account allegedly then shared the flaw with two other accounts, with all three pocketing $3 million from the exchange in the days that followed.
When the crypto exchange asked the alleged “security researcher” to return the funds and collect its bounty after offering the required onchain proofs, the white hat hacker allegedly refused to entertain the request and asked for the bounty to be paid first. Although Kraken didn’t reveal the name of the security firm behind the “white hat” exploit, CertiK revealed that it was behind the Kraken exploit.
CertiK claimed that its employee <a href="https://cointelegraph.com/news/certik-kraken-exploit-bug-bounty-white-hat-hackers-threats">who discovered the vulnerability was threatened</a> to return the stolen funds, but did not receive a wallet address to send the funds to. Ronghui Gu, co-founder at CertiK, told Cointelegraph:
<blockquote data-ct-non-breakable="true">
 “The verbal consensus reached during our meeting was not confirmed afterward. Ultimately, they [Kraken] publicly accused us of theft and even directly threatened our employees, which is completely unacceptable.”
</blockquote>
CertiK reportedly <a href="https://x.com/spreekaway/status/1803475736566612293" target="_blank" rel="noopener nofollow">sent</a>&nbsp;the stolen funds to crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. The move triggered much criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation.
Related: <a href="https://cointelegraph.com/news/crypto-phishing-attacks-alarming-certik">Crypto phishing attacks reached ‘alarming levels’ — CertiK co-founder</a>
<h2 data-ct-non-breakable="true" id="crypto-community-calls-out-certik">Crypto community calls out CertiK</h2>
The crypto community raised questions about why CertiK researchers moved millions of dollars worth of funds when a single transaction could have proven the vulnerability. Others reminded them that Tornado Cash is an Office of Foreign Assets Control (OFAC)-sanctioned tool, and using it could attract legal trouble for the security firm. Others questioned whether it planned to return the funds and why it sent them to Tornado Cash.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/26a32265-20cd-4cf4-9438-78a5641480c9.png" alt="" title="">
 <figcaption style="text-align: center;">
 Crypto community calls out CertiK. Source: X
 </figcaption>
</figure>
A majority of the crypto community sided with Kraken on the issue and called out CertiK for its ruthless behavior. Many accused them of “stealing” and blackmailing Kraken for the bounty. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/8980e226-f21e-445d-a929-68d6c77ad2ff.png" alt="" title="">
 <figcaption style="text-align: center;">
 Crypto community reaction to Kraken Certik saga. Source: X
 </figcaption>
</figure>
Kraken told Cointelegraph that it is in touch with law enforcement agencies regarding the situation.
Update: This article will be updated with comments from Kraken and CertiK.
Magazine: <a href="https://cointelegraph.com/magazine/defi-security-audits-bug-bounties-broken-heres-how-fix/">Crypto audits and bug bounties are broken: Here’s how to fix them</a>

Kraken-CertiK saga turns murky as part of exploited funds go ‘missing’

Table of Contents

Cointelegraph

Other articles published on Jun 20, 2024

Aptos Labs Announces Partnership with NBCU to Transform Fan Experiences with Web3 and Blockchain

Australia's Largest Stock Exchange Lists First Spot Bitcoin (BTC) Exchange Traded Fund (ETF)!

Operating Unlicensed Crypto Business Led To Indictments Of Two Utah Residents

Bitcoin Price Prediction Analysis: 2024, 2025, 2026, 2027, 2028, 2029, 2030

SHIB Surges 3.20%; DOGE Sees $12 Million Whale Transfer to Robinhood: Report

Immunefi Hits Over $100 Million In Rewards For Ethical Hackers

Join our free newsletter for daily crypto updates!