2024

Wednesday

Security

<a href="https://bitcoinworld.co.in/kraken-got-its-money-back-from-certiks-controversial-whitehat-hack/" title="Kraken Got Its Money Back From CertiK’s Controversial “Whitehat” Hack" rel="nofollow"></a>
<ul> 
 <li style="font-weight: 400">Kraken got its money back from CertiK, who claim they never sought a whitehat bounty to begin with.</li> 
</ul> 
Crypto exchange Kraken says it got its money back from the “security researchers” that took $3 million from the platform this year. 
“Update: We can now confirm the funds have been returned (minus a small amount lost to fees),” <a href="https://twitter.com/c7five/status/1803773589226995826">tweeted</a> Nick Percoco, Chief Security Officer for Kraken, on Thursday. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Update: We can now confirm the funds have been returned (minus a small amount lost to fees). <a href="https://t.co/cHkjPt3m2A">https://t.co/cHkjPt3m2A</a> 
 — Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803773589226995826?ref_src=twsrc%5Etfw">June 20, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
<h3 id="span-style-font-weight-400-kraken-gets-its-money-back-span">Kraken Gets Its Money Back</h3> 
Though Kraken first refused to identify the culprits, blockchain security experts at CertiK <a href="https://twitter.com/CertiK/status/1803450205389402215">outed</a> themselves on Wednesday as the ones behind the hack. 
Earlier that day, Percoco revealed that Kraken had recently patched a bug that let technically sophisticated individuals artificially inflate their balance on the platform, effectively letting them steal any amount of money from the exchange since January. 
CertiK experts notified them of the vulnerability in June, but not before draining $3 million from Kraken’s Treasury as a demonstration.&nbsp; 
<figure id="attachment_74949" aria-describedby="caption-attachment-74949" style="width: 100%" class="wp-caption aligncenter">
 <img decoding="async" class=" wp-image-74949" src="http://bitcoinworld.co.in/wp-content/uploads/timeline-of-events-566x300.jpg" alt="" width="632" height="335" srcset="https://bitcoinworld.co.in/wp-content/uploads/timeline-of-events-566x300.jpg 566w, https://bitcoinworld.co.in/wp-content/uploads/timeline-of-events.jpg 698w" sizes="(max-width: 632px) 100vw, 632px">
 <figcaption id="caption-attachment-74949" class="wp-caption-text">
 timeline of events
 </figcaption>
</figure> 
&nbsp; 
“Within a few hours, the issue was completely fixed and could not reoccur again,” Percoco clarified, noting that “no client’s assets were ever at risk.” 
While CertiK characterized its actions as a “whitehat” operation to help reinforce Kraken’s security, the way the company went about its actions did not sit well with Kraken nor the wider crypto community. 
These include having failed to follow Kraken’s standard whitehat bounty program procedures, such as not immediately returning all funds once stolen, and arguably stealing far more money than necessary to demonstrate the vulnerability. 
When asked to return the funds, CertiK explicitly refused until provided with an estimate of how much money was at risk had the company not identified the vulnerability, according to Kraken. 
<h3 id="span-style-font-weight-400-certik-s-explanation-for-the-hack-span">CertiK’s Explanation For The Hack</h3> 
By contrast, CertiK said it had “consistently assured them that we would return the funds.” 
“Kraken’s security operation team has threatened individual CertiK employees to repay a mismatched amount of crypto in an unreasonable time even without providing repayment addresses,” CertiK contested over Twitter. 
The company confirmed on Thursday that all funds had been returned, though in a different crypto amount than Kraken had commanded. It also justified the size of its attack as necessary to test the limit of Kraken’s alerts and risk controls – which still never went off after losing millions. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Q&amp;A to recent CertiK-Kraken whitehat operations: 
 1. Did any real user lose fund？ No. Cryptos were minted out of air, and no real Kraken user’s assets were directly involved in our research activities. 
 2. Have we refused to return the funds? No. In our communication with… 
 — CertiK (@CertiK) <a href="https://twitter.com/CertiK/status/1803646511110365426?ref_src=twsrc%5Etfw">June 20, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
“We never mentioned any bounty request,” CertiK added. “It was Kraken which first mentioned their bounty to us, while we responded that the bounty was not the priority topic and we wanted to make sure the issue was fixed.”

Kraken Got Its Money Back From CertiK’s Controversial “Whitehat” Hack

Table of Contents

ItsBitcoinWorld

Other articles published on Jun 21, 2024

Traders Capitulate on Meme Coins As Market Forms Downturn, Moving From Pepe (PEPE) and Bonk (BONK...

Is BRETT crypto the Shiba Inu of Base? What experts have to say

Can Dogecoin, Shiba Inu shake off their double-digit price drops soon?

High-Growth Altcoins: Which Ones Are Worth Your Investment?

37 Million Shiba Inu (SHIB) in 24 Hours, What's Happening?

Spot Bitcoin (BTC) Exchange Traded Funds (ETFs) Listed in the USA Experienced Large Outflows This...

Join our free newsletter for daily crypto updates!