BTC

$60784.57

-1.49%

ETH

$3370.897

-0.60%

BNB

$571.953

-0.66%

XRP

$0.47

-0.94%

News

Kraken Critical Vulnerabilities Could Lead To Hundreds Of Millions Of Dollars In Losses

June 19, 2024 - Around 2 mins mins to read

Key Points:

  • CertiK found Kraken critical vulnerabilities allowing counterfeit crypto withdrawals.
  • Kraken allegedly threatened CertiK after initial fixes, demanding returns of funds.
Security agency CertiK recently announced the discovery of Kraken critical vulnerabilities, potentially leading to losses worth hundreds of millions of dollars.
Kraken Critical Vulnerabilities Could Lead To Hundreds Of Millions Of Dollars In Losses

CertiK Uncovers Kraken Critical Vulnerabilities in Security System

The investigation revealed that Kraken’s deposit system was unable to effectively distinguish between different internal transfer states. Kraken critical vulnerabilities allowed malicious actors to forge deposit transactions and withdraw these counterfeit funds without triggering any alarms.

During CertiK’s testing, millions of dollars in fake funds were successfully deposited into Kraken accounts, and over $1 million in fabricated cryptocurrencies were withdrawn and converted into valid assets. Despite initially acknowledging the issue and classifying it as “extremely critical,” Kraken’s response took a contentious turn.

CertiK reported that Kraken’s security team threatened its employees, demanding the return of unmatched cryptocurrencies within an unreasonably short timeframe without providing a repayment address. The timeline provided by CertiK detailed their use of Polygon’s MATIC token for testing deposit transactions.

“The real issue is why Kraken’s in-depth defense system failed to detect numerous test transactions,” CertiK stated. “Weak exchanges often boast about their strong risk controls and defense systems, but Kraken‘s failed miserably during our tests.”

CertiK decided to go public to protect user safety, urging Kraken to cease threats against white hat hackers and emphasizing the importance of collaboration to address security risks and safeguard the future of Web3.

Kraken Reports $3 Million Loss, Pursues Legal Action

Kraken Chief Security Officer Nick Percoco acknowledged that three accounts exploited the vulnerability, withdrawing nearly $3 million in total. He claimed that this behavior violated the vulnerability bounty program rules, crossing into extortion rather than white hat hacking.

Percoco alleged that three individuals linked to an unnamed research company were responsible for the withdrawals and refused to return any funds until Kraken disclosed the potential exploit’s size. Kraken is treating the matter as a criminal case and is cooperating with law enforcement agencies.

DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

CertiK

Kraken

Kraken Critical Vulnerabilities

MATIC

Nick Percoco

Polygon

Web3

Avatar of Harold

Author

Harold

With a passion for untangling the complexities of the financial world, I've spent over four years in financial journalism, covering everything from traditional equities to the cutting edge of venture capital. "The financial markets are a fascinating puzzle," I often say, "and I love helping people make sense of them." That's what drives me to bring clear and insightful financial journalism to the readers of Coincu.
News

Kraken Critical Vulnerabilities Could Lead To Hundreds Of Millions Of Dollars In Losses

Key Points:

  • CertiK found Kraken critical vulnerabilities allowing counterfeit crypto withdrawals.
  • Kraken allegedly threatened CertiK after initial fixes, demanding returns of funds.
Security agency CertiK recently announced the discovery of Kraken critical vulnerabilities, potentially leading to losses worth hundreds of millions of dollars.
Kraken Critical Vulnerabilities Could Lead To Hundreds Of Millions Of Dollars In Losses

CertiK Uncovers Kraken Critical Vulnerabilities in Security System

The investigation revealed that Kraken’s deposit system was unable to effectively distinguish between different internal transfer states. Kraken critical vulnerabilities allowed malicious actors to forge deposit transactions and withdraw these counterfeit funds without triggering any alarms.

During CertiK’s testing, millions of dollars in fake funds were successfully deposited into Kraken accounts, and over $1 million in fabricated cryptocurrencies were withdrawn and converted into valid assets. Despite initially acknowledging the issue and classifying it as “extremely critical,” Kraken’s response took a contentious turn.

CertiK reported that Kraken’s security team threatened its employees, demanding the return of unmatched cryptocurrencies within an unreasonably short timeframe without providing a repayment address. The timeline provided by CertiK detailed their use of Polygon’s MATIC token for testing deposit transactions.

“The real issue is why Kraken’s in-depth defense system failed to detect numerous test transactions,” CertiK stated. “Weak exchanges often boast about their strong risk controls and defense systems, but Kraken‘s failed miserably during our tests.”

CertiK decided to go public to protect user safety, urging Kraken to cease threats against white hat hackers and emphasizing the importance of collaboration to address security risks and safeguard the future of Web3.

Kraken Reports $3 Million Loss, Pursues Legal Action

Kraken Chief Security Officer Nick Percoco acknowledged that three accounts exploited the vulnerability, withdrawing nearly $3 million in total. He claimed that this behavior violated the vulnerability bounty program rules, crossing into extortion rather than white hat hacking.

Percoco alleged that three individuals linked to an unnamed research company were responsible for the withdrawals and refused to return any funds until Kraken disclosed the potential exploit’s size. Kraken is treating the matter as a criminal case and is cooperating with law enforcement agencies.

DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.
Visited 108 times, 6 visit(s) today