2024

BULL

<p class="is-style-lead">Kraken argues that CertiK was excessive — but the cybersecurity firm insists large-scale withdrawals were necessary to ascertain the scale of the problem.</p>
<p>Last week, <a href="https://crypto.news/tag/kraken/" rel="noopener noreferrer nofollow">Kraken</a> <a href="https://crypto.news/kraken-chief-security-reveals-ux-change-resulted-in-3m-bug-exploit/" rel="noopener noreferrer nofollow">announced</a> that a critical bug had enabled security researchers to artificially inflate their balance — and withdraw almost $3 million.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Kraken Security Update:<br><br>On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.</p>— Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803403565865771370?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>But there was something incredibly unusual about the whole incident, and it ended up sparking a war of words between the <a href="https://crypto.news/tag/cryptocurrency/" rel="noopener noreferrer nofollow">crypto</a> <a href="https://crypto.news/tag/exchange/" rel="noopener noreferrer nofollow">exchange</a> and a major <a href="https://crypto.news/tag/cybersecurity/" rel="noopener noreferrer nofollow">cybersecurity</a> firm.&nbsp;</p>
<p>Kraken’s chief security officer Nick Percoco kicked things off by announcing that a flaw had been found that allowed malicious actors to print funds in an account.</p>
<p>It had taken 47 minutes to mitigate the issue, and a few hours to completely fix. So far, all of this seems pretty normal and routine.</p>
<p>But Percoco escalated things further by claiming that the security researcher involved had told two of their colleagues about the issue, enabling them to take company funds worth millions.</p>
<p>He said Kraken had asked for details about how the exploit was achieved and had sought to arrange for funds to be returned in full, but alleged that the exchange was rebuffed.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p><strong>“Instead, they demanded a call with their business development team (i.e. their sales reps) and have not agreed to return any funds until we provide a speculated $ amount that this bug could have caused if they had not disclosed it. This is not white-hat hacking, it is extortion!”</strong></p> <cite><strong>Nick Percoco</strong></cite>
</blockquote>
<p>Percoco went on to claim that the researchers hadn’t worked within the spirit of the bug bounty program because they extracted far more than they needed to, failed to provide a proof of concept, and didn’t return the cash immediately.</p>
<p>So what was going on here? Was this a white hat hacker making their way to the dark side? Someone holding Kraken to ransom? A criminal matter?</p>
<p>You might also like: <a href="https://crypto.news/premarket-explained-how-to-buy-coins-before-the-official-listing/" rel="noopener noreferrer nofollow"> How to buy coins before they list </a></p>
<h2 class="wp-block-heading" id="strong-certik-steps-forward-strong"><strong>CertiK steps forward</strong></h2>
<p>This is where the story takes an unusual turn. You might have assumed that the exploit was orchestrated by a bright teenager locked away in their bedroom somewhere. In actual fact, <a href="https://crypto.news/certik-admits-krakens-3m-exploit-raises-eyebrows-for-sending-crypto-to-tornado-cash/" rel="noopener noreferrer nofollow">it was carried out by CertiK</a> — one of the biggest auditors in the Web3 space.</p>
<p>Just three hours after Percoco’s thread on X, the company stepped forward with its own version of events.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">CertiK recently identified a series of critical vulnerabilities in <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@krakenfx</a> exchange which could potentially lead to hundreds of millions of dollars in losses.<br><br>Starting from a finding in <a href="https://twitter.com/krakenfx?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@krakenfx</a>'s deposit system where it may fail to differentiate between different internal… <a href="https://t.co/JZkMXj2ZCD" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/JZkMXj2ZCD</a></p>— CertiK (@CertiK) <a href="https://twitter.com/CertiK/status/1803450205389402215?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>It said days upon days of tests had failed to throw up any red flags in Kraken’s internal systems — meaning the exchange’s security team only intervened after being told about the flaw.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p><strong>“After initial successful conversions on identifying and fixing the vulnerability, Kraken’s security operation team has THREATENED individual CertiK employees to repay a MISMATCHED amount of crypto in an UNREASONABLE time even WITHOUT providing repayment addresses.”</strong></p> <cite>CertiK</cite>
</blockquote>
<p><a href="https://crypto.news/tag/certik/" rel="noopener noreferrer nofollow">CertiK</a> went on to urge Kraken “to cease any threats against white hat hackers.”</p>
<p>A day later, it followed up with a thread answering questions about its research.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Q&amp;A to recent CertiK-Kraken whitehat operations: <br><br>1. Did any real user lose fund？<br>No. Cryptos were minted out of air, and no real Kraken user’s assets were directly involved in our research activities.<br><br>2. Have we refused to return the funds?<br>No. In our communication with…</p>— CertiK (@CertiK) <a href="https://twitter.com/CertiK/status/1803646511110365426?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 20, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>As well as stressing that no Kraken customers ended up losing money, CertiK stressed it had “consistently assured” the company that the money would be returned, <a href="https://crypto.news/kraken-recovers-3-million-from-certik-following-bounty-fiasco/" rel="noopener noreferrer nofollow">and it was</a>. The only sticking point? Disagreement over how much the exchange was actually owed.</p>
<p>In explaining why it chose to exploit the flaw on such a large scale, the company added:</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p><strong>“We want to test the limit of Kraken’s protection and risk controls. After multiple tests across multiple days and close to three millions worth of crypto, no alerts were triggered and we still haven’t figured out the limit.”</strong></p> <cite><strong>CertiK</strong></cite>
</blockquote>
<p>Reading between the lines, and it seems CertiK wanted answers from Kraken on how much a genuine fraudster could have ended up walking away with if they kept on going.</p>
<p>The cybersecurity firm went on to argue that a bug bounty was far down its list of priorities — and all transactions associated with its tests had entered the public domain.&nbsp;</p>
<h2 class="wp-block-heading" id="strong-an-almighty-war-of-words-strong"><strong>An almighty war of words</strong></h2>
<p>On X, there’s been a fair bit of disagreement over who’s in the right and who’s in the wrong.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">The real question should be why you exploited an obscene amount as part of your testing in a role where trust is the most crucial element. Take the L and stop tweeting without legal advice.</p>— Seeb $LSS BULL (@crypto_seeb) <a href="https://twitter.com/crypto_seeb/status/1803528998053368019?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">$3m is peanuts compared to the magnitude of a potential bankruptcy hack. Double L by Kraken making it into a public issue instead of just thanking god anons didn't exploit it.</p>— everhusk (@everhusk) <a href="https://twitter.com/everhusk/status/1803505096187158624?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>CertiK’s argument boils down to this: it needed to make astronomically large withdrawals to test whether any of them would end up being flagged by Kraken’s internal systems.</p>
<p>The spat, which now appears to have been resolved on the surface, highlights some of the tension between businesses in the crypto space — and the cybersecurity researchers tasked with keeping them in check.</p>
<p>Does there need to be greater agreement on the rules of engagement? Are there ever instances where large-scale exploits by white hat hackers are justified, as it could prevent something more calamitous happening at a later date?&nbsp;</p>
<p>If this had happened to the Ronin Network — helping prevent one of the greatest crypto heists of all time that led to $625 million being stolen — you’d probably argue that the temporary theft of a few million dollars <em>would </em>be warranted.</p>
<p>No matter how you look at it, this incident is a painful reminder that major exchanges could have bugs that are yet to be uncovered, posing a risk to the everyday investors who use these trading platforms to store their funds.</p>
<p>You might also like: <a href="https://crypto.news/can-the-crypto-industry-trust-donald-trump/" rel="noopener noreferrer nofollow"> Can the crypto industry trust Trump? </a></p>

Kraken v CertiK: Who’s in the right after $3m exploit saga?

Table of Contents

crypto.news

Other articles published on Jun 26, 2024

MoonBag Top Crypto Presale Booms in 2024, Attracts Theta and Arbitrum Investors with 88% APY

Hamster Kombat Latest: Uzbekistan Regulators Say Viral Telegram Game Is Not Illegal

Top 5 Memecoins To Invest in 2024: Pepe, WIF, Bonk, Dogecoin, & Angry Pepe Fork

Solana to $200 or $100? Why SOL has turned volatile today

MoonBag’s Epic $2.9 Million Milestone as Top Crypto Presale and Thrilling 88% APY Comparison Agai...

NEAR Coin Sees Persistent Decline

Join our free newsletter for daily crypto updates!