Kraken Extorted By Security Research Team, $3 Million Drained In Hack

Kraken, a major cryptocurrency exchange, has been extorted by a security research team after they exploited a bug in the platform to withdraw nearly $3 million.
Dot
June 20, 2024
Dean Fankhauser

Dean has an economics and startup background which led him to create Bitcompare. He primarly writes opinion pieces for Bitcompare. He's also been a guest on BBC World, and interviewed by The Guardian and many other publications.

TABLE OF CONTENTS

Kraken, a major cryptocurrency exchange, has been extorted by a security research team after they exploited a bug in the platform to withdraw nearly $3 million. The incident highlights the growing issue of malicious actors using bug bounty programs to extort companies rather than following ethical hacking practices.

The Bug Bounty Program Alert

On June 9, Kraken received a bug bounty program alert from a security researcher about a critical vulnerability in their funding system. The researcher claimed to have found a bug that allowed users to artificially inflate their balance on the platform without fully completing a deposit. Kraken's Chief Security Officer, Nick Percoco, confirmed that the company identified the issue within minutes of receiving the alert and patched it within an hour.

The Extortion

However, further investigation revealed that the security researcher had not acted alone. They had disclosed the bug to two other individuals, who then fraudulently generated much larger sums and withdrew nearly $3 million from Kraken's treasuries. The security researcher refused to return the funds, demanding that Kraken provide a speculated amount that the bug could have caused if they had not disclosed it. This is considered extortion rather than white-hat hacking.

Certik's Involvement

Certik, a blockchain code editor, has also been involved in the incident. Certik claimed to have found several vulnerabilities in Kraken's platform, including the one exploited by the security researchers. However, Certik's account of the events suggests that they were threatened by Kraken's security operation team to repay a mismatched amount of crypto in an unreasonable time without providing repayment addresses. This has led to accusations that Certik acted in bad faith.

The Incident's Significance

The incident highlights the importance of ethical hacking practices and the need for companies to be vigilant in their bug bounty programs. It also underscores the growing issue of malicious actors using bug bounty programs to extort companies rather than following ethical hacking practices. The incident serves as a reminder that companies must be prepared to address these types of incidents and work with law enforcement agencies to retrieve stolen assets.

Conclusion

Kraken's experience with the security research team's extortion highlights the need for companies to be cautious in their bug bounty programs and to ensure that they are working with ethical hackers. The incident also underscores the importance of ethical hacking practices and the need for companies to be prepared to address these types of incidents.

Kraken Extorted By Security Research Team, $3 Million Drained In Hack

HomeNews
Contents

Kraken, a major cryptocurrency exchange, has been extorted by a security research team after they exploited a bug in the platform to withdraw nearly $3 million. The incident highlights the growing issue of malicious actors using bug bounty programs to extort companies rather than following ethical hacking practices.

The Bug Bounty Program Alert

On June 9, Kraken received a bug bounty program alert from a security researcher about a critical vulnerability in their funding system. The researcher claimed to have found a bug that allowed users to artificially inflate their balance on the platform without fully completing a deposit. Kraken's Chief Security Officer, Nick Percoco, confirmed that the company identified the issue within minutes of receiving the alert and patched it within an hour.

The Extortion

However, further investigation revealed that the security researcher had not acted alone. They had disclosed the bug to two other individuals, who then fraudulently generated much larger sums and withdrew nearly $3 million from Kraken's treasuries. The security researcher refused to return the funds, demanding that Kraken provide a speculated amount that the bug could have caused if they had not disclosed it. This is considered extortion rather than white-hat hacking.

Certik's Involvement

Certik, a blockchain code editor, has also been involved in the incident. Certik claimed to have found several vulnerabilities in Kraken's platform, including the one exploited by the security researchers. However, Certik's account of the events suggests that they were threatened by Kraken's security operation team to repay a mismatched amount of crypto in an unreasonable time without providing repayment addresses. This has led to accusations that Certik acted in bad faith.

The Incident's Significance

The incident highlights the importance of ethical hacking practices and the need for companies to be vigilant in their bug bounty programs. It also underscores the growing issue of malicious actors using bug bounty programs to extort companies rather than following ethical hacking practices. The incident serves as a reminder that companies must be prepared to address these types of incidents and work with law enforcement agencies to retrieve stolen assets.

Conclusion

Kraken's experience with the security research team's extortion highlights the need for companies to be cautious in their bug bounty programs and to ensure that they are working with ethical hackers. The incident also underscores the importance of ethical hacking practices and the need for companies to be prepared to address these types of incidents.

Dean Fankhauser

Dean has an economics and startup background which led him to create Bitcompare. He primarly writes opinion pieces for Bitcompare. He's also been a guest on BBC World, and interviewed by The Guardian and many other publications.

Kraken, a major cryptocurrency exchange, has been extorted by a security research team after they exploited a bug in the platform to withdraw nearly $3 million. The incident highlights the growing issue of malicious actors using bug bounty programs to extort companies rather than following ethical hacking practices.

The Bug Bounty Program Alert

On June 9, Kraken received a bug bounty program alert from a security researcher about a critical vulnerability in their funding system. The researcher claimed to have found a bug that allowed users to artificially inflate their balance on the platform without fully completing a deposit. Kraken's Chief Security Officer, Nick Percoco, confirmed that the company identified the issue within minutes of receiving the alert and patched it within an hour.

The Extortion

However, further investigation revealed that the security researcher had not acted alone. They had disclosed the bug to two other individuals, who then fraudulently generated much larger sums and withdrew nearly $3 million from Kraken's treasuries. The security researcher refused to return the funds, demanding that Kraken provide a speculated amount that the bug could have caused if they had not disclosed it. This is considered extortion rather than white-hat hacking.

Certik's Involvement

Certik, a blockchain code editor, has also been involved in the incident. Certik claimed to have found several vulnerabilities in Kraken's platform, including the one exploited by the security researchers. However, Certik's account of the events suggests that they were threatened by Kraken's security operation team to repay a mismatched amount of crypto in an unreasonable time without providing repayment addresses. This has led to accusations that Certik acted in bad faith.

The Incident's Significance

The incident highlights the importance of ethical hacking practices and the need for companies to be vigilant in their bug bounty programs. It also underscores the growing issue of malicious actors using bug bounty programs to extort companies rather than following ethical hacking practices. The incident serves as a reminder that companies must be prepared to address these types of incidents and work with law enforcement agencies to retrieve stolen assets.

Conclusion

Kraken's experience with the security research team's extortion highlights the need for companies to be cautious in their bug bounty programs and to ensure that they are working with ethical hackers. The incident also underscores the importance of ethical hacking practices and the need for companies to be prepared to address these types of incidents.

Written by
Dean Fankhauser