The Kraken-CertiK saga has taken another turn. Security firm CertiK claims it carried out a white hat operation on specific Kraken accounts not belonging to customers, draining nearly $3 million, according to Kraken. However, the exchange claims the total exploited amount was not returned to it, while CertiK claims to have returned all funds as per their record.
On June 20, CertiK took to X to give an update on the situation and claimed it had returned 734 Ether (ETH), 29,001 Tether (USDT) tokens and 1,021 Monero (XMR) coins, while Kraken requested 155,818 Polygon (MATIC) tokens, 907,400 USDT, 475.5 ETH and 1,089.8 XMR.
Kraken claims exploit, CertiK says white hat operation
The Kraken-CertiK saga began on June 9, when Kraken claimed it had received a bug bounty program alert from an alleged security researcher. The alert highlighted a bug in Kraken’s system that allowed users to inflate their account balances. When the crypto exchange rushed to patch the bug, it discovered three accounts that had leveraged the flaw, stealing $3 million from Kraken’s account.
Kraken found that one of the three accounts was Know Your Customer (KYC) verified and used the bug to credit $4 to their account.
Kraken chief security officer Nick Percoco said that this would have been enough to prove the bug and claim the bounty, but the account allegedly then shared the flaw with two other accounts, with all three pocketing $3 million from the exchange in the days that followed.
When the crypto exchange asked the alleged “security researcher” to return the funds and collect its bounty after offering the required onchain proofs, the white hat hacker allegedly refused to entertain the request and asked for the bounty to be paid first. Although Kraken didn’t reveal the name of the security firm behind the “white hat” exploit, CertiK revealed that it was behind the Kraken exploit.
CertiK claimed that its employee who discovered the vulnerability was threatened to return the stolen funds, but did not receive a wallet address to send the funds to. Ronghui Gu, co-founder at CertiK, told Cointelegraph:
“The verbal consensus reached during our meeting was not confirmed afterward. Ultimately, they [Kraken] publicly accused us of theft and even directly threatened our employees, which is completely unacceptable.”
CertiK reportedly sent the stolen funds to crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. The move triggered much criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation.
Related: Crypto phishing attacks reached ‘alarming levels’ — CertiK co-founder
Crypto community calls out CertiK
The crypto community raised questions about why CertiK researchers moved millions of dollars worth of funds when a single transaction could have proven the vulnerability. Others reminded them that Tornado Cash is an Office of Foreign Assets Control (OFAC)-sanctioned tool, and using it could attract legal trouble for the security firm. Others questioned whether it planned to return the funds and why it sent them to Tornado Cash.
A majority of the crypto community sided with Kraken on the issue and called out CertiK for its ruthless behavior. Many accused them of “stealing” and blackmailing Kraken for the bounty.
Kraken told Cointelegraph that it is in touch with law enforcement agencies regarding the situation.
Update: This article will be updated with comments from Kraken and CertiK.
Magazine: Crypto audits and bug bounties are broken: Here’s how to fix them