Bounty

2024

Million

Security

Kraken, a major cryptocurrency exchange, recently managed a <a href="https://coingape.com/bitfinex-suffers-data-breach-tether-ceo-says-seems-fake/">security breach</a> and potential extortion attempt after a supposed bug bounty report became a demand for money. Chief Security Officer Nick Percoco outlined the events, noting a flaw was exploited to inflate account balances artificially. This incident has prompted an investigation involving law enforcement and emphasized the importance of adhering to ethical practices in security research. 
<h2 id="strong-kraken-responds-to-3-million-security-breach-strong">Kraken Responds to $3 Million Security Breach</h2> 
Upon receiving a bug bounty report on June 9, 2024, <a href="https://coingape.com/is-kraken-in-trouble-largest-bitcoin-and-ethereum-outflow-spotted-since-2017/">Kraken</a>‘s security team, led by Percoco, sprung into action. They quickly discovered that the vulnerability had already been exploited, leading to the unlawful withdrawal of nearly $3 million from the exchange’s reserves. Although initially an act attributed to a security researcher—who claimed a mere $4 to demonstrate the flaw—the situation escalated when it was revealed that this individual had shared the bug with accomplices who extracted much more significant amounts. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Kraken Security Update: 
 On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform. 
 — Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803403565865771370?ref_src=twsrc%5Etfw">June 19, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Kraken’s team rectified the security loophole within two hours of detection. The bug originated from a recent update intended to enhance the user experience by allowing immediate trading before thoroughly verifying deposited funds. However, this change inadvertently created a vulnerability. Percoco stressed that no client assets were at risk at any time, as the flaw only allowed the inflating of balances within the perpetrators’ accounts. 
Also Read: <a href="https://coingape.com/binance-rolls-out-hodler-airdrops-for-bnb-holders/" target="_blank" rel="noopener">Binance Rolls Out HODLer Airdrops For BNB Holders</a> 
<h2 id="strong-kraken-reinforces-policies-after-security-breach-strong">Kraken Reinforces Policies After Security Breach</h2> 
Following the discovery, the perpetrators refused to cooperate with Kraken’s investigation, demanding to speak with the business development team, a move Percoco labeled as extortion. This incident has highlighted the critical nature of following ethical guidelines in bug bounty programs. Kraken’s longstanding policy is clear: researchers must not exploit vulnerabilities beyond what is necessary to prove their existence and should promptly return any unauthorized funds. 
Kraken has a nearly decade-long history of operating its bug bounty program, designed to encourage <a href="https://coingape.com/hacker-calls-for-live-apology-from-prisma-finance-post-11m-heist/" target="_blank" rel="noopener">white-hat hackers</a> to help identify and fix security gaps responsibly. This program has functioned smoothly with cooperation from the security research community, and this is the first instance of such a severe breach of trust and protocol.&nbsp; 
Despite the unsettling events, Kraken remains dedicated to its bug bounty program, recognizing its value in enhancing the security of the cryptocurrency ecosystem. The exchange has taken steps to reinforce its systems against similar vulnerabilities by implementing stricter testing protocols, particularly following feature updates affecting account transactions. 
Also Read: <a href="https://coingape.com/xrp-lawsuit-sec-ethereum-investigation-conclusion-bolsters-ripple-position/#:~:text=The%20SEC's%20decision%20to%20conclude,SEC%20in%20different%20crypto%20cases." target="_blank" rel="noopener">XRP Lawsuit: SEC’s Ethereum Investigation Conclusion Bolsters Ripple’s Position</a> 
The post <a href="https://coingape.com/just-in-kraken-responds-to-extortion-attempt-following-security-breach/">Just In: Kraken Responds to Extortion Attempt Following Security Breach</a> appeared first on <a href="https://coingape.com">CoinGape</a>.

Just In: Kraken Responds to Extortion Attempt Following Security Breach

Table of Contents

Coingape News Media

Other articles published on Jun 19, 2024

SEC Drops Probe, Delivering Significant Win for Ethereum

Mysterious 100 Million DOGE Transfer Hits Robinhood as DOGE Price Recovers

How TON Foundation Plans to Onboard 500 Million Users On-Chain

BlockDAG’s Big Reveal in Keynote 2: 30,000x Returns Expected as Bitcoin ETFs Slide & Solana Coins...

Here’s Why Bitcoin & Crypto Market Is Up On Wednesday

Big shocker on Trump-linked crypto, Shkreli ties revealed

Join our free newsletter for daily crypto updates!