Fun

Kraken-CertiK saga turns murky as part of exploited funds go ‘missing’

News Feed - 2024-06-20 06:06:28

Prashant Jha5 hours agoKraken-CertiK saga turns murky as part of exploited funds go ‘missing’Kraken is planning to take legal action against security firm CertiK as the “white hat” operation by the security firm turns into a legal blunder.1022 Total views23 Total sharesListen to article 0:00NewsOwn this piece of crypto historyCollect this article as NFTJoin us on social networksThe Kraken-CertiK saga has taken another turn. Security firm CertiK claims it carried out a white hat operation on specific Kraken accounts not belonging to customers, draining nearly $3 million, according to Kraken. However, the exchange claims the total exploited amount was not returned to it, while CertiK claims to have returned all funds as per their record.


On June 20, CertiK took to X to give an update on the situation and claimed it had returned 734 Ether (ETH), 29,001 Tether (USDT) tokens and 1,021 Monero (XMR) coins, while Kraken requested 155,818 Polygon (MATIC) tokens, 907,400 USDT, 475.5 ETH and 1,089.8 XMR.Kraken claims exploit, CertiK says white hat operation


The Kraken-CertiK saga began on June 9, when Kraken claimed it had received a bug bounty program alert from an alleged security researcher. The alert highlighted a bug in Kraken’s system that allowed users to inflate their account balances. When the crypto exchange rushed to patch the bug, it discovered three accounts that had leveraged the flaw, stealing $3 million from Kraken’s account.


Kraken found that one of the three accounts was Know Your Customer (KYC) verified and used the bug to credit $4 to their account.


Kraken chief security officer Nick Percoco said that this would have been enough to prove the bug and claim the bounty, but the account allegedly then shared the flaw with two other accounts, with all three pocketing $3 million from the exchange in the days that followed.


When the crypto exchange asked the alleged “security researcher” to return the funds and collect its bounty after offering the required onchain proofs, the white hat hacker allegedly refused to entertain the request and asked for the bounty to be paid first. Although Kraken didn’t reveal the name of the security firm behind the “white hat” exploit, CertiK revealed that it was behind the Kraken exploit.


CertiK claimed that its employee who discovered the vulnerability was threatened to return the stolen funds, but did not receive a wallet address to send the funds to. Ronghui Gu, co-founder at CertiK, told Cointelegraph:“The verbal consensus reached during our meeting was not confirmed afterward. Ultimately, they [Kraken] publicly accused us of theft and even directly threatened our employees, which is completely unacceptable.”


CertiK reportedly sent the stolen funds to crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. The move triggered much criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation.


Related: Crypto phishing attacks reached ‘alarming levels’ — CertiK co-founderCrypto community calls out CertiK


The crypto community raised questions about why CertiK researchers moved millions of dollars worth of funds when a single transaction could have proven the vulnerability. Others reminded them that Tornado Cash is an Office of Foreign Assets Control (OFAC)-sanctioned tool, and using it could attract legal trouble for the security firm. Others questioned whether it planned to return the funds and why it sent them to Tornado Cash.Crypto community calls out CertiK. Source: X


A majority of the crypto community sided with Kraken on the issue and called out CertiK for its ruthless behavior. Many accused them of “stealing” and blackmailing Kraken for the bounty.Crypto community reaction to Kraken Certik saga. Source: X


Kraken told Cointelegraph that it is in touch with law enforcement agencies regarding the situation.


Update: This article will be updated with comments from Kraken and CertiK.


Magazine:Crypto audits and bug bounties are broken: Here’s how to fix them# Blockchain# Kraken# Cryptocurrencies# Hackers# Cybersecurity# Hacks# DeFi# RegulationAdd reaction

News Feed

Luno Launches Venture Fund to Invest in Over 200 Crypto and Fintech Startups per Year
Luno Launches Venture Fund to Invest in Over 200 Crypto and Fintech Startups per Year Luno cryptocurrency exchange recently announced the launch of an investment arm, Luno Expediti
Chainalysis Reaches $8.6 Billion Valuation In $170 Million Series F Funding Round
Chainalysis Reaches $8.6 Billion Valuation In $170 Million Series F Funding Round Chainalysis, a cryptocurrency security and blockchain auditing firm, has announced it has complete
Skybridge Bitcoin Fund Launches With $25 Million, Expecting ‘Avalanche of Institutional Investors’
Skybridge Bitcoin Fund Launches With $25 Million, Expecting "Avalanche of Institutional Investors" Global investment firm Skybridge Capital has launched a bitcoi
Bitcoin, Ethereum Technical Analysis: BTC, ETH Hit 6-Week Highs as Dollar Loses Steam
Bitcoin, Ethereum Technical Analysis: BTC, ETH Hit 6-Week Highs as Dollar Loses Steam Bitcoin rose to its highest level in six weeks on Wednesday, as the U.S. Dollar continued to w
Bitcoin, Ethereum Technical Analysis: BTC Rebounds, as Bulls Reject Breakout of Key Support Level
Bitcoin, Ethereum Technical Analysis: BTC Rebounds, as Bulls Reject Breakout of Key Support Level Bitcoin was trading in the green on Feb. 7, as prices rebounded following a near c
Australian Police Confiscate Cryptocurrency Worth $1 Million With Help From FBI
Australian Police Confiscate Cryptocurrency Worth $1 Million With Help From FBI The Australian Federal Police (AFP) has confirmed that the Supreme Court of New South Wales has orde
Tom Mitchelhill8 hours agoCelsius creditors vote in favor of reorganization planThe majority of Celsius creditors have voted in favor of a plan that will see approximately $2 billion worth of Bitcoin and Ethereum returne
US City Installs Crypto ATM at Airport After Accepting Cryptocurrency for Payments
US City Installs Crypto ATM at Airport After Accepting Cryptocurrency for Payments The U.S. city of Williston in North Dakota is installing a cryptocurrency ATM at its internationa
Pump.fun to give $80 if tokens complete bonding curve — will it stop rugs?
Tom Mitchelhill4 hours agoPump.fun to give $80 if tokens complete bonding curve — will it stop rugs?Pump.fun is incentivizing memecoin creators to get their tokens off to a successful launch, but the jury’s out wheth
KICK.IO’s Token Will Be Available on ExMarkets LaunchPad, 15th September
KICK.IO"s Token Will Be Available on ExMarkets LaunchPad, 15th September sponsored As the $ADAbull market continues to gather steam – with new price records set each month&#x
Judge greenlights class suit alleging Silvergate Bank aided FTX fraud
Jesse Coghlan1 hour agoJudge greenlights class suit alleging Silvergate Bank aided FTX fraudA federal judge struck down Silvergate’s dismissal bid of a lawsuit claiming it aided fraud at FTX, saying the allegations wer
Oman to Incorporate Real Estate Tokenization in Virtual Assets Regulatory Framework
Oman to Incorporate Real Estate Tokenization in Virtual Assets Regulatory Framework Real estate tokenization is set to be incorporated into Oman Capital Markets Authority (OCMA)&#x