Cryptocurrency

Bitcoin

when

Cryptocurrency exchange Kraken has recovered missing funds following a high-profile bug bounty exploit fiasco.&nbsp;
Kraken confirmed the return of the stolen digital assets worth nearly $3 million, putting an end to the <a href="https://cointelegraph.com/news/kraken-certik-saga-exploited-funds-missing" rel="noopener noreferrer nofollow">Kraken-CertiK saga</a> that started on June 9.
The recovery of the funds, minus transaction fees, was confirmed by Nicholas Percoco, chief security officer of Kraken, in a June 20 X <a href="https://x.com/c7five/status/1803773589226995826" target="_blank" rel="noopener noreferrer nofollow">post</a>:
<blockquote data-ct-non-breakable="true">
 “Update: We can now confirm the funds have been returned (minus a small amount lost to fees).”
</blockquote>
Kraken’s CSO first announced the $3 million worth of missing funds on June 19, when he claimed that a “security researcher” maliciously withdrew them from the treasury after discovering and sharing an existing bug.
Kraken claimed that it <a href="https://cointelegraph.com/news/kraken-claims-extortion-bug-bounty-report" rel="noopener noreferrer nofollow">was extorted by the security researcher</a>, who was refusing to return the funds, demanding a reward and a call with the exchange’s business development team.
Related: <a href="https://cointelegraph.com/news/nomura-crypto-laser-digital-abu-dhabi-license" rel="noopener noreferrer nofollow">Nomura crypto arm Laser Digital bags Abu Dhabi license</a>
<h2 id="certik-s-side-of-the-story">CertiK’s side of the story</h2>
Shortly after Kraken’s post about the missing funds, blockchain security firm CertiK publicly identified itself as the “security researcher” that Kraken claimed stole $3 million of digital assets.
In a June 19 X post, CertiK <a href="https://x.com/CertiK/status/1803450205389402215" target="_blank" rel="noopener noreferrer nofollow">said</a> it had informed Kraken of an exploit that allowed it to remove millions of dollars from the exchange’s accounts. CertiK also claimed to have been <a href="https://cointelegraph.com/news/certik-kraken-exploit-bug-bounty-white-hat-hackers-threats" rel="noopener noreferrer nofollow">threatened by the exchange’s team</a>:
<blockquote data-ct-non-breakable="true">
 “After initial successful conversions on identifying and fixing the vulnerability, Kraken’s security operation team has THREATENED individual CertiK employees to repay a MISMATCHED amount of crypto in an UNREASONABLE time even WITHOUT providing repayment addresses.”
</blockquote>
The security firm <a href="https://x.com/CertiK/status/1803450205389402215/photo/1" target="_blank" rel="noopener noreferrer nofollow">posted</a> a timeline of events, starting with identifying the exploit on June 5 and ending with claims Kraken threatened a CertiK employee on June 18. In a statement to Cointelegraph, CertiK said it planned to transfer the funds “to an account that Kraken will be able to access.”
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-06/ffb0314d-4821-4459-95a2-4f46227440fc.png" alt="" title="">
 <figcaption style="text-align: center;">Bug bounty saga timeline. Source: CertiK
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/bitcoin-etfs-legitimized-crypto-industry-investors-storm-partners" rel="noopener noreferrer nofollow">Bitcoin ETFs legitimized the crypto industry for investors — Storm Partners</a>
<h2 id="why-did-certik-withdraw-nearly-3-million">Why did CertiK withdraw nearly $3 million?</h2>
Kraken’s Percoco initially said that the first malicious transfer, worth just $4, would have been sufficient to prove the bug and collect “sizable rewards” from Karken’s bounty program.
However, the security researcher, which was later disclosed as CertiK, had minted nearly $3 million into their Kraken accounts.
In a <a href="https://x.com/CertiK/status/1803646511110365426" target="_blank" rel="noopener noreferrer nofollow">post</a> following the return of the $3 million, CertiK said that the multimillion-dollar sum was necessary to test the limits of the exchange:
<blockquote data-ct-non-breakable="true">
 “We want to test the limit of Kraken’s protection and risk controls. After multiple tests across multiple days and close to $3 million worth of crypto, no alerts were triggered and we still haven’t figured out the limit.”
</blockquote>
Moreover, CertiK claims that it didn’t initially request a bounty, but it was something mentioned by the exchange:
<blockquote data-ct-non-breakable="true">
 “We never mentioned any bounty request. It was Kraken who first mentioned their bounty to us, while we responded that the bounty was not the priority topic and we wanted to make sure the issue was fixed.”
</blockquote>
CertiK added that no Kraken user funds were endangered since the exploited funds were “minted out of air.”
Magazine: <a href="https://cointelegraph.com/magazine/spot-ethereum-etf-ether-price-bitcoin-patrick-scott-dynamo-defi-hall-of-flame/" rel="noopener noreferrer nofollow">Ethereum’s recent pullback could be a gift: Dynamo DeFi, X Hall of Flame</a>

Kraken recovers $3 million from CertiK, ending bug bounty saga

Table of Contents

Cointelegraph

Other articles published on Jun 20, 2024

Bitcoin Price Prediction: Support Levels Drop as Price Struggles To Stabilize Above 66K

Top Crypto Presale in June 2024, MoonBag, Draws Investors Away from Internet Computer and Cardano...

Crypto Exchange bitFlyer Reportedly Plans to Acquire FTX Japan

MoonBag Receives Standing Ovation From Theta and Solana: Will It Be Crowned the Best Presale in 2...

Singapore Banks Under Scrutiny Sequel To Crypto Related Crimes

Real-Time Revolution: How One Oracle Solution is Transforming DeFi Transaction Speeds

Join our free newsletter for daily crypto updates!