Blockchain security firm CertiK has confirmed that it discovered a critical vulnerability in Kraken's deposit system, which allowed nearly $3 million worth of funds to be withdrawn from the exchange's wallets. The bug, now fixed, enabled anyone to initiate a deposit and receive the funds without completing the process. CertiK has been transferring the funds back to Kraken, resolving a bug bounty dispute that raised concerns about the security of cryptocurrency exchanges.

The vulnerability, identified by CertiK, allowed millions of dollars to be deposited into any Kraken account, with the potential for a "huge amount of fabricated crypto" to be withdrawn and converted into valid cryptocurrencies. Despite triggering no alerts during CertiK's multi-day testing period, Kraken responded and locked the test accounts only days after disclosure.

CertiK alleged that Kraken's security team threatened individual employees to repay a "mismatched" amount of crypto within an "unreasonable" six-hour timeframe without providing a repayment address. In response, CertiK provided a detailed timeline of events, including testing deposit transactions made using Polygon's MATIC token. The security firm is now transferring the funds to an account accessible by Kraken, based on its records.

Kraken's Chief Security Officer, Nick Percoco, earlier disclosed that nearly $3 million was taken from its wallets due to the bug, which has since been fixed. The exchange alleged that three individuals connected to an unnamed research company were behind the withdrawals and refused to return funds until Kraken disclosed the potential size of the exploit if they had not reported the bug.

This incident highlights the importance of robust security measures and responsible disclosure in the cryptocurrency space. As the industry continues to evolve, it is crucial for exchanges and security firms to work together to identify and address vulnerabilities, ensuring the safety and integrity of users' funds.