Bounty

2024

Security

<p><a href="https://kraken.com/" target="_blank" rel="noopener">Kraken</a>, a leading global cryptocurrency exchange, recently navigated a significant security challenge. The platform was alerted by a security researcher about a critical vulnerability that could have allowed unauthorized creation of digital assets. This incident underscores the ongoing challenges faced by digital asset platforms in maintaining robust security measures.</p> 
<p>Upon receiving the tip-off, Kraken’s security team swiftly investigated the matter, distinguishing it from the commonplace false alarms. The bug identified was particularly severe—it enabled users to register deposits and receive corresponding credits to their accounts without the actual transfer of funds.&nbsp;</p> 
<p>This flaw, originating from a recent user experience update that prematurely credited user accounts before confirmation of deposit, posed a hypothetical risk of “printing” digital assets out of thin air.</p> 
<h2 class="wp-block-heading" id="implications-and-actions-taken">Implications and Actions Taken</h2> 
<p>The investigation revealed that only three accounts exploited the bug, including the one belonging to the whistleblower. While the researcher demonstrated the exploit by creating a nominal amount of cryptocurrency, they failed to officially report this through Kraken’s Bug Bounty program.&nbsp;</p> 
<p>Instead, they disclosed the method to two other parties who then exploited the vulnerability to extract millions in cryptocurrency, culminating in unauthorized withdrawals totaling approximately $3 million.</p> 
<p>Nick Percoco, Kraken’s chief security officer, noted the challenge in handling the situation given the incomplete initial report which lacked crucial transaction details.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
   <p lang="en" dir="ltr">Kraken Security Update:<br><br>On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.</p>— Nick Percoco (@c7five) <a href="https://twitter.com/c7five/status/1803403565865771370?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">June 19, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The dialogue with the researchers stalled as they demanded a ransom rather than return the funds, proposing a payout based on the potential financial damage the bug could have inflicted.&nbsp;</p> 
<p>Kraken, labeling these demands as extortion, has declined to publicly name the security firm involved and is pursuing legal actions, treating the issue as a criminal case. The company reassured users that no client assets were compromised at any point.&nbsp;</p>

Kraken’s Quick Fix: How a Critical Bug Nearly Led to Free Money Printing on the Exchange

Table of Contents

BlockchainReporter

Other articles published on Jun 19, 2024

Can Solana Meme Coins Push Back The Advance Of New 100x Altcoin?

ZachXBT Receives $150K for Unmasking DJT Token Creators

SEC backs down from Ether probe, Will ETH price move now?

Shutter Launches First Threshold Encrypted Mempool for Ethereum-like Networks on Gnosis Chain to ...

Meme Coins Dominance Falls: What You Should Know

Altcoin dominance at 9%, drops 15% in 30 days: What now?

Join our free newsletter for daily crypto updates!