In a recent incident, the crypto community has been abuzz with criticism directed towards the blockchain security firm CertiK. The controversy began when Kraken, a prominent crypto exchange, revealed that an unnamed "security researcher" had exploited a bug to steal $3 million worth of digital assets from its platform.

Kraken's chief security officer, Nick Percoco, had initially disclosed the theft and stated that the researcher had refused to return the stolen funds, instead choosing to extort the exchange. However, a few hours later, CertiK came forward, claiming that it had informed Kraken of the exploit that allowed the withdrawal of the funds from the exchange's accounts.

CertiK provided a timeline of the events, stating that after initial successful conversations on identifying and fixing the vulnerability, Kraken's security team had threatened individual CertiK employees to repay a mismatched amount of crypto within an unreasonable time frame, without even providing repayment addresses.

Despite the tensions, CertiK revealed that it would transfer the "stolen" funds to an account that Kraken could access. Percoco later confirmed that Kraken had received all the funds, minus the transaction fees.

While Kraken may be relieved to have recovered the stolen assets, CertiK is now facing a barrage of criticism from the crypto community. Security experts have questioned the blockchain security firm's actions, particularly its decision to perform more than one test transaction to prove the existence of the vulnerability and its use of the OFAC-sanctioned crypto mixer Tornado Cash and the non-custodial crypto exchange ChangeNOW.

CertiK, however, stands by its actions, stating that its test lasted for five days and was on a grand scale to discover the weaknesses in Kraken's security system. The firm argues that the real question should be why Kraken's in-depth defense system failed to detect so many test transactions, despite the exchange's claims of strong risk control and robust security measures.

This incident has sparked a heated debate within the crypto community, raising questions about the role and responsibilities of blockchain security firms, as well as the importance of robust security measures in the ever-evolving digital asset landscape.