Kraken, a US-based cryptocurrency exchange, has recently fallen victim to a sophisticated bug that allowed rogue "security researchers" to exploit its platform and steal nearly $3 million. The chief security officer, Nick Percoco, revealed the incident in a post on X, stating that the security firm has refused to return the stolen funds and is now demanding a higher payout as a bounty.

Kraken's internal security team discovered the vulnerability after a security researcher alerted them through the Bug Bounty program on June 9. The bug allowed a malicious actor to initiate a deposit into their Kraken account and receive the funds without completing the deposit. This exploit could have been used to print millions out of thin air.

The security team mitigated the issue within 47 minutes and fixed it completely after a few hours. However, the incident highlighted a recent change in the exchange's UX that allowed client accounts to be credited before their assets cleared. Although the change was integrated to enable instant trading, it was not fully tested against this type of risk.

The analysis of the vulnerability found that three accounts exploited the flaw, with one account registered under the name of the security researcher who initially contacted the exchange. While the researcher's account only used the flaw to credit themselves $4, the other two accounts withdrew almost $3 million from their Kraken accounts using the same exploit. Interestingly, these accounts were associated with associates of the security researcher.

Kraken's attempts to get the funds returned have been futile as the researchers are now asking for a higher payment that they believe is commensurate with the risk of the bug. Percoco described this as an act of extortion, which contradicts the principle behind the Bug Bounty program. He added that violating those rules that give white hat hackers the license to hack makes the security researchers criminals, and the exchange is treating them as such.