Tornado Cash

USDC

Polygon

Security

Tornado

CertiK, the smart contract security firm, continues to claim its actions against the Kraken exchange were ethical and that it was trying to estimate the full scope of security flaws. The testers also claim they returned all the funds in kind and have not extorted Kraken.&nbsp;
The CertiK team developed a new statement to refute some previous Kraken claims. The testers denied demands for a bounty, stating their priority was to fix the vulnerability of being able to print funds into an account.&nbsp;
Read: <a href="https://www.cryptopolitan.com/kraken-recovers-funds-stolen-by-certik/" rel="noopener noreferrer nofollow">Kraken recovers $3M as criticism mounts against Certik</a>
All the withdrawn funds came from Kraken’s cold wallets, and no user accounts were affected. The coins were returned based on CertiK’s own calculations and transaction records.&nbsp;
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Q&amp;A to recent CertiK-Kraken whitehat operations: 1. Did any real user lose fund？ No. Cryptos were minted out of air, and no real Kraken user’s assets were directly involved in our research activities. 2. Have we refused to return the funds? No. In our communication with…— CertiK (@CertiK) <a href="https://twitter.com/CertiK/status/1803646511110365426?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">June 20, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
The most controversial action of CertiK included records of sending some funds to Tornado Cash. The coin mixer has faced previous <a href="https://home.treasury.gov/news/press-releases/jy0916" rel="noopener noreferrer nofollow" target="_blank">sanctions</a> from the US Treasury Department, which banned persons domiciled in the USA from interacting with it.&nbsp;
CertiK is well aware of the use of Tornado Cash and included the transfers as proof of its exploit. Previously, CertiK has also tracked Tornado Cash usage as part of older exploits. One of Certik’s chief focuses remains the auditing of smart contracts, which often contain similar logic flaws leading to unlimited token creation.
CertiK’s approach to ethical hacking unnerved observers, as small sums were sent directly to Tornado Cash to test the exploit. Some steps in the Kraken testing process were leaked on social media before Kraken finally notified it&nbsp;of the actual size of the exploit.&nbsp;
The issue of a bug bounty has not been discussed, but CertiK keeps claiming it did not require a bounty to return the funds. So far, Kraken’s security team has not announced any bounty for CertiK.&nbsp;
<h2 class="wp-block-heading" id="span-style-font-weight-400-kraken-admits-to-receiving-all-funds-span">Kraken admits to receiving all funds</h2>
CertiK generated balances on the centralized Kraken platform and performed withdrawals on behalf of those accounts.&nbsp;
Kraken’s claims that CertiK was inaccurate in its returns were the most controversial. However, this was refuted a few days later. Kraken’s Chief Security Officer Nick Percoco announced that the funds were fully returned minus transaction fees.&nbsp;
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Update: We can now confirm the funds have been returned (minus a small amount lost to fees). <a href="https://t.co/cHkjPt3m2A" rel="noopener noreferrer nofollow" target="_blank">https://t.co/cHkjPt3m2A</a>— Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803773589226995826?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">June 20, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
CertiK’s accounting reported withdrawals of only ETH, USDT and XMR, while Kraken also claimed 155,818.44 MATIC were also withdrawn and mixed. The withdrawals were estimated at around $3M, though Certik used a small sum to prove the exploit.&nbsp;
Further analysis of the exploit showed that CertiK generated non-existing MATIC balances, but the transactions failed, and no funds left the Kraken cold wallets. The MATIC generated was just an internal exploit that did not result in the transfer of real Polygon tokens.&nbsp;
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <a href="https://twitter.com/hashtag/Certik?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#Certik</a> : At first glance, it seems that Certik's exploit consists of: 1. Creating a contract &amp; depositing funds into it 2. Generating the LogFeeTransfer() event 3. <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">@krakenfx</a> scans LogFeeTransfer() on its deposit addresses and doesn't seem to verify if the MATIC are really there <a href="https://t.co/QI4bdXJdbz" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/QI4bdXJdbz</a>— Naïm Boubziz (@BrutalTrade) <a href="https://twitter.com/BrutalTrade/status/1803714145663013099?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">June 20, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
In some cases, the presence of funds can be simulated, as other protocols have been attacked with flash loans.&nbsp;
CertiK asserted that <a href="https://x.com/CertiKAlert/status/1801623753282981976" rel="noopener noreferrer nofollow" target="_blank">exploits</a> picked up again in June, with more than $30M taken from apps and protocols. The count does not include attacks against individual wallets.&nbsp;
<h2 class="wp-block-heading" id="span-style-font-weight-400-tornado-cash-is-still-operational-years-after-the-sanctions-span">Tornado Cash is still operational years after the sanctions</h2>
The Tornado Cash mixer is still facilitating exploits, as funds are untraceable after moving through the mixer. Even after blacklisting wallets and addresses, there is nothing preventing hackers from mixing ETH and sending it to new unknown wallets.&nbsp;
Also read: <a href="https://www.cryptopolitan.com/tornado-cash-plaintiffs-lose-to-us-treasury/?_rt=M3wxfHRvcm5hZG8gY2FzaHwxNzE4OTUzOTM5&amp;_rt_nonce=0e4542585a" rel="noopener noreferrer nofollow">Group behind the Tornado Cash lawsuit loses to the US Treasury</a>
Since 2022, Tornado Cash has had limited resources, but the service is still operational.&nbsp;
The founder of Tornado Cash, Alexey Pertsev, received a sentencing in May 2024, with potential years behind bars. Yet the sanctions and bans do not prevent anyone from using the mixer, which does not affect jurisdictions outside the USA.
Some coins, like USDC, have blacklisted all Tornado Cash contracts. Any funds sent to the contract cannot be recovered again. USDC is also known for its centralized ability to freeze coins. For Kraken, the ability to withdraw to a Tornado Cash contract address was also a major vulnerability. Most token producers choose not to exercise control over tokens, leaving them vulnerable to theft and irrecoverable through mixing.&nbsp;
Cryptopolitan reporting by Hristina Vasileva

CertiK explains ethical hacking stance, Kraken admits full return of funds

Table of Contents

Cryptopolitan_News

Other articles published on Jun 21, 2024

MicroStrategy acquires nearly 12,000 more Bitcoins

Bitcoin: ETF Outflows are Accelerating!

Toncoin Meroket, Siap Saingi Bitcoin dalam Ruang Kripto

Michael Dell Discusses Cryptocurrencies and Blockchain

Australian Man Receives Prison Sentence for Cyber-Enabled Identity Theft

Decimal Digest

Join our free newsletter for daily crypto updates!