Bounty

Future

Security

Tornado

The cryptocurrency community is abuzz with controversy following CertiK’s recent disclosure of significant security vulnerabilities in Kraken, one of the world’s leading cryptocurrency exchanges. The revelation has sparked heated debate over the responsible handling of such discoveries. 
CertiK’s investigation revealed serious flaws within Kraken’s systems, potentially exposing the exchange to hundreds of millions in losses. On June 5, CertiK identified these vulnerabilities but did not immediately inform Kraken. It wasn’t until June 10 that CertiK reached out to Kraken via Twitter, a delay of five days from the discovery. This delay suggests shortcomings in Kraken’s monitoring capabilities at the time. Kraken responded swiftly upon receiving the report, addressing the issue by June 12. 
However, discrepancies in timelines between CertiK and Kraken regarding initial contact and responses have emerged, with Kraken claiming initial contact on June 9, whereas CertiK states it initiated contact on June 10, with a response on June 11. 
<figure class="wp-block-image size-full">
 <img decoding="async" width="698" height="370" src="https://www.unlock-bc.com/wordpress/wp-content/uploads/2024/06/Certik-timeline.jpeg" alt="" class="wp-image-124839" srcset="https://www.unlock-bc.com/wordpress/wp-content/uploads/2024/06/Certik-timeline.jpeg 698w, https://www.unlock-bc.com/wordpress/wp-content/uploads/2024/06/Certik-timeline-300x159.jpeg 300w" sizes="(max-width: 698px) 100vw, 698px">
</figure> 
<h2 class="wp-block-heading" id="h-findings-from-certik-s-investigation-kraken-security-vulnerability">Findings from CertiK’s Investigation: Kraken security vulnerability</h2> 
CertiK’s thorough investigation exposed three major security concerns: 
<ul> 
 <li>Deposit System Flaws: Kraken’s system was unable to distinguish between different internal transfer statuses, allowing the potential fabrication of deposit transactions.</li> 
</ul> 
<ul> 
 <li>Withdrawal of Fabricated Funds: Malicious actors could withdraw fabricated funds and convert them into legitimate cryptocurrencies.</li> 
</ul> 
<ul> 
 <li>Risk Control Failures: Kraken’s risk controls and asset protection systems did not activate alerts for large withdrawal requests.</li> 
</ul> 
CertiK’s tests <a href="https://x.com/CertiK/status/1803471653751423454" class="ek-link">revealed </a>that Kraken’s security was compromised, permitting millions of dollars to be deposited into any Kraken account and over $1 million in fabricated cryptocurrency to be withdrawn without triggering any alerts. 
Kraken’s response has drawn both praise and scrutiny. While they acted promptly upon being informed, questions have been raised about their initial detection and monitoring processes. Moreover, allegations of Kraken threatening CertiK employees over the disclosure have added another layer of controversy. Critics argue that if the vulnerabilities were critical, Kraken should have been more proactive in identifying and addressing them. 
On the other hand, CertiK’s approach, which involved conducting multiple test transactions with significant sums and using Tornado Cash, has also faced criticism. Some argue that these actions border on exploitation rather than ethical security research, likening them to theft and extortion. 
<h2 class="wp-block-heading" id="h-kraken-s-position-and-future-steps">Kraken’s Position and Future Steps</h2> 
Kraken has clarified that their Bug Bounty program is designed to enhance security and relies on ethical behavior from researchers. According to Kraken’s head of security, the actions of CertiK researchers violated the rules of the program and constituted criminal behavior. Kraken<a href="https://www.unlock-bc.com/124822/kraken-security-breach-3-million-fraudulent-withdrawal/" class="ek-link"> is now treating this incident as a criminal case</a> and is coordinating with law enforcement agencies. 
Kraken emphasized that this breach is an isolated incident and that they remain committed to their Bug Bounty program. The exchange will continue to work with ethical researchers to improve the security of the cryptocurrency ecosystem. 
As both sides present their arguments, the crypto community remains divided. This controversy highlights the challenges of maintaining security in the dynamic world of cryptocurrency and underscores the importance of ethical conduct and transparency from both security researchers and exchanges alike. 
<h2 class="wp-block-heading" id="h-recent-update-june-21st">Recent Update ( June 21st) </h2> 
On June 20, CertiK took to <a href="https://x.com/CertiK/status/1803646511110365426" class="ek-link">X </a>to provide an update on the situation, claiming it had returned 734 Ether (ETH), 29,001 Tether (USDT) tokens, and 1,021 Monero (XMR) coins. However, Kraken had requested the return of 155,818 Polygon (MATIC) tokens, 907,400 USDT, 475.5 ETH, and 1,089.8 XMR. CertiK reportedly sent the stolen funds to the crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. This move triggered significant criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation. From his end, Nick Percoco confirmed that fund are back on <a href="https://x.com/c7five/status/1803773589226995826" class="ek-link">X</a> as well 
The post <a href="https://www.unlock-bc.com/124837/certik-uncovers-major-security-flaws-in-kraken-exchange/">CertiK Uncovers Major Security Issues in Kraken Exchange</a> appeared first on <a href="https://www.unlock-bc.com">UNLOCK Blockchain</a>.

CertiK Uncovers Major Security Issues in Kraken Exchange

目次

UNLOCK_ENG

2024年6月20日公開の他の記事

Nonprofit criticizes Tether in multimillion-dollar ad campaign

Queen Cardi B Memecoin to Skyrocket 14,000% Before KuCoin Listing, While Shiba Inu, Bonk and Doge...

AGATA will be ready for TON next week And AgaSwap Multichain in July

Crypto Market Cheers! Bitcoin Price Upturn Signals Bullish Future

Bitcoin, Ethereum, Dogecoin Go Sideways: 'If Monthly Candle Doesn't Get Going,' Trader Predicts S...

ENS Faces Market Challenges

ニュースレターを購読して暗号資産の最新情報を毎日入手！