CertiK, a blockchain security firm, confirmed its discovery of a critical vulnerability in Kraken's deposit system and has publicly detailed the sequence of events following allegations of extortion by the exchange. The firm also asserted that Kraken threatened its employees on June 18 and demanded repayment for an amount that didn't match, without providing a relevant wallet address.

CertiK denied the extortion claims and stated it would return the funds used for its security testing to the wallet address it holds, as Kraken did not supply a new address. The firm initiated its investigation on June 5 after discovering an issue in Kraken's deposit system, which failed to distinguish between different internal transfer statuses. This prompted further testing to determine if a malicious actor could fabricate a deposit transaction and withdraw funds improperly.

During testing, CertiK found that large sums could be deposited into any Kraken account and that fabricated cryptocurrencies worth over $1 million could be withdrawn and converted into valid cryptocurrencies without triggering any alerts. Despite initial cooperative efforts to fix the vulnerability, the situation escalated after Kraken allegedly demanded repayment without providing necessary details.

Kraken's Chief Security Officer Nick Percoco disclosed that nearly $3 million was withdrawn from its wallets due to a bug that allowed unauthorized deposits to be initiated and funds received without completing the transaction. He explained that while fixing the bug, Kraken discovered three accounts had exploited this flaw, leading to the substantial loss.

Percoco criticized CertiK's handling of the situation, accusing them of unethical behavior for refusing to return the funds and failing to provide comprehensive data typically required in bug bounty programs.