Bounty

2024

when

Million

Security

Crypto exchange Kraken recently faced a challenging situation involving security researchers who allegedly crossed the line into extortion. Nick Percoco, Kraken’s Chief Security Officer, detailed the incident on social media platform X. 
According to Percoco, on June 9, Kraken received a report from a security researcher about a vulnerability that allowed users to artificially inflate their account balances. This flaw enabled a malicious attacker to initiate deposits and receive funds without completing the process. 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Kraken Security Update: On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.— Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803403565865771370?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">June 19, 2024</a>
 </blockquote> 
 </div>
</figure> 
Kraken promptly fixed the issue, ensuring no user funds were affected. However, the aftermath of the report raised serious concerns. Kraken found that the individual who discovered the bug had leveraged it to credit their account with $4 in crypto. his would have been sufficient to prove the flaw, file a bug bounty report with them, and collect a reward. Instead of contacting Kraken immediately, the security researcher reportedly shared the vulnerability with two other individuals.&nbsp; 
These individuals then exploited the flaw, withdrawing nearly $3 million from Kraken’s treasury, not from other clients’ assets. The initial bug report did not mention these fraudulent transactions, and when Kraken sought further details, the researchers refused to cooperate. 
Instead, they demanded a meeting with Kraken’s business development team and declined to return the funds until Kraken speculated on the potential financial impact of the bug if it had gone undisclosed. Percoco labeled this demand as extortion rather than ethical hacking. 
Bug bounty programs, like those run by Kraken and its competitor Coinbase, are designed to incentivize third-party hackers, known as “white hats,” to find and report vulnerabilities responsibly. These programs typically require hackers to exploit the minimum amount necessary to prove the bug, return any assets obtained, and provide detailed information about the vulnerability. 
Kraken’s resilience shines amid recent challenges. Kraken’s Chief Security Officer, Nick Percoco, shared “We’ll not disclose this research company because they don’t deserve recognition for their actions. We are treating this as a criminal case and are coordinating with law enforcement agencies accordingly. We’re thankful this issue was reported, but that’s where that thought ends.” 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 Also Read: <a href="https://www.cryptotimes.io/2024/06/18/indian-hacker-loses-1112-eth-in-london-machete-robbery/" target="_blank" rel="noreferrer noopener">Indian Hacker Loses 1,112 ETH in London Machete Robbery</a> 
</blockquote>

Kraken Hit by Extortion After Hackers Exploit $3 Million Bug

The Crypto Times

Other articles published on Jun 19, 2024

Analysts’ Top Three Cryptos To Buy for Massive Profit in 2024 — Bitcoin, Pepe, and Angry Pepe Fork

Is Litecoin (LTC) Price Likely To Decline To $63? Breaking Down The Odds

Pantera Capital Plans to Purchase $100 Million Worth of Ethereum

Why BlockDAG Is The Top Crypto To Watch In 2024 As Presale Nears $52M; More On XRP Price Predicti...

OKX Launches New Token ZRO

Nummus Casino Announces the Presale of $Nummus Token with Unique Rewards and Bonuses

Join our free newsletter for daily crypto updates!