Fun

Kraken-CertiK saga turns murky as part of exploited funds go ‘missing’

News Feed - 2024-06-20 06:06:28

Prashant Jha5 hours agoKraken-CertiK saga turns murky as part of exploited funds go ‘missing’Kraken is planning to take legal action against security firm CertiK as the “white hat” operation by the security firm turns into a legal blunder.1021 Total views23 Total sharesListen to article 0:00NewsOwn this piece of crypto historyCollect this article as NFTJoin us on social networksThe Kraken-CertiK saga has taken another turn. Security firm CertiK claims it carried out a white hat operation on specific Kraken accounts not belonging to customers, draining nearly $3 million, according to Kraken. However, the exchange claims the total exploited amount was not returned to it, while CertiK claims to have returned all funds as per their record.


On June 20, CertiK took to X to give an update on the situation and claimed it had returned 734 Ether (ETH), 29,001 Tether (USDT) tokens and 1,021 Monero (XMR) coins, while Kraken requested 155,818 Polygon (MATIC) tokens, 907,400 USDT, 475.5 ETH and 1,089.8 XMR.Kraken claims exploit, CertiK says white hat operation


The Kraken-CertiK saga began on June 9, when Kraken claimed it had received a bug bounty program alert from an alleged security researcher. The alert highlighted a bug in Kraken’s system that allowed users to inflate their account balances. When the crypto exchange rushed to patch the bug, it discovered three accounts that had leveraged the flaw, stealing $3 million from Kraken’s account.


Kraken found that one of the three accounts was Know Your Customer (KYC) verified and used the bug to credit $4 to their account.


Kraken chief security officer Nick Percoco said that this would have been enough to prove the bug and claim the bounty, but the account allegedly then shared the flaw with two other accounts, with all three pocketing $3 million from the exchange in the days that followed.


When the crypto exchange asked the alleged “security researcher” to return the funds and collect its bounty after offering the required onchain proofs, the white hat hacker allegedly refused to entertain the request and asked for the bounty to be paid first. Although Kraken didn’t reveal the name of the security firm behind the “white hat” exploit, CertiK revealed that it was behind the Kraken exploit.


CertiK claimed that its employee who discovered the vulnerability was threatened to return the stolen funds, but did not receive a wallet address to send the funds to. Ronghui Gu, co-founder at CertiK, told Cointelegraph:“The verbal consensus reached during our meeting was not confirmed afterward. Ultimately, they [Kraken] publicly accused us of theft and even directly threatened our employees, which is completely unacceptable.”


CertiK reportedly sent the stolen funds to crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. The move triggered much criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation.


Related: Crypto phishing attacks reached ‘alarming levels’ — CertiK co-founderCrypto community calls out CertiK


The crypto community raised questions about why CertiK researchers moved millions of dollars worth of funds when a single transaction could have proven the vulnerability. Others reminded them that Tornado Cash is an Office of Foreign Assets Control (OFAC)-sanctioned tool, and using it could attract legal trouble for the security firm. Others questioned whether it planned to return the funds and why it sent them to Tornado Cash.Crypto community calls out CertiK. Source: X


A majority of the crypto community sided with Kraken on the issue and called out CertiK for its ruthless behavior. Many accused them of “stealing” and blackmailing Kraken for the bounty.Crypto community reaction to Kraken Certik saga. Source: X


Kraken told Cointelegraph that it is in touch with law enforcement agencies regarding the situation.


Update: This article will be updated with comments from Kraken and CertiK.


Magazine:Crypto audits and bug bounties are broken: Here’s how to fix them# Blockchain# Kraken# Cryptocurrencies# Hackers# Cybersecurity# Hacks# DeFi# RegulationAdd reaction

News Feed

Brian Quarmby2 hours agoDJ 3LAU causes a stir after opting out of Friend.tech over regulatory risks3LAU noted that the risks were high and that he has a “responsibility” to avoid regulatory gray areas.513 Total views
US ‘Kidnapped’ Russian Crypto Businessman Denis Dubnikov, Lawyer Says
US ‘Kidnapped’ Russian Crypto Businessman Denis Dubnikov, Lawyer Says U.S. law enforcement agents have “kidnapped” crypto entrepreneur Denis Dubnikov in Mexico, b
Crypto-Friendly Travel Firm Travala Becomes the First Merchant to Offer Binance Pay as a Payment Method
Crypto-Friendly Travel Firm Travala Becomes the First Merchant to Offer Binance Pay as a Payment Method Crypto-friendly travel website Travala has announced the
UwU Lend offers a $5M bounty to whoever catches its exploiter
Brayden Lindrea3 hours agoUwU Lend offers a $5M bounty to whoever catches its exploiterThe UwU Lend hacker has now stolen a combined $24 million from the protocol across two attacks.1270 Total views14 Total sharesListen
Report: FTX Execs Offered Taylor Swift $100M to Endorse the Exchange, Source Says Singer Never Considered the Deal
Report: FTX Execs Offered Taylor Swift $100M to Endorse the Exchange, Source Says Singer Never Considered the Deal According to a report, the American singer-songwriter Taylor Swif
Sunacrip and Venezuelan Intelligence Police Issue Warning on Cryptocurrency Scams
Sunacrip and Venezuelan Intelligence Police Issue Warning on Cryptocurrency Scams Sunacrip, the Venezuelan cryptocurrency watchdog, and the Intelligence Police (CICPC) issued a war
Brayden Lindrea6 hours agoLuxor refutes claims its Bitcoin hash rate-backed product is BlockFi, Celsius 2.0“The return comes from hash rate, not from pixie dust, Ponzi schemes, or rehypothecation,” a Luxor Technology
Building a Decentralized and Uncensorable Internet — The Nexus Protocol
Building a Decentralized and Uncensorable Internet — The Nexus Protocol PRESS RELEASE. On December 21st, 2020, the Nexus Protocol white paperwas released. The
3 signs that Bitcoin price is not ready to make a new all-time high
Marcel Pechman2 hours ago3 signs that Bitcoin price is not ready to make a new all-time highChina-focused stablecoin data, retail investor participation and skeptical BTC derivatives markets are all signs that Bitcoin pr
International Chess Federation Will Launch the Sport’s Global NFT Marketplace on FreeTON
International Chess Federation Will Launch the Sport’s Global NFT Marketplace on FreeTON sponsored FIDE, the International Chess Federation, has become the first global sports fed
Bitpay Reveals Prepaid Cardholders Can Get up to 15% Cash Back Rewards via Select Retailers
Bitpay Reveals Prepaid Cardholders Can Get up to 15% Cash Back Rewards via Select Retailers The Atlanta-based crypto payment services company Bitpay has announced that Bitpayȁ
Report: US Central Bank Loses Billions From Rate Hikes, ‘Losses Pile up Into an IOU’
Report: US Central Bank Loses Billions From Rate Hikes, "Losses Pile up Into an IOU" While the U.S. Federal Reserve ramped up the benchmark bank rate with a barrage of rate hikes,