Kraken, a prominent American crypto exchange, recently suffered a significant loss of around $3 million worth of crypto due to a bug in its funding system. The exchange's chief security officer, Nick Percoco, disclosed the incident on social media, highlighting the unethical behavior of the individuals involved. The story serves as a warning to the crypto community about the importance of ethical standards in security research.

On June 9, Kraken received a notification from a self-proclaimed "security researcher" about a potential bug. However, upon investigation, the team discovered a flaw deriving from a recent UX change, which allowed clients to trade crypto markets in real-time before their assets cleared. Unfortunately, the exchange didn't test the UX change against this specific attack vector prior to the attack.

After patching the vulnerability, Kraken found that three accounts had exploited the same flaw, withdrawing nearly $3 million from the exchange's treasuries. Instead of reporting the bug directly, the "security researcher" shared the information with associates, who ultimately profited from the exploit. Kraken requested a full account of their activities, a proof of concept, and the return of the withdrawn funds, but the individuals refused to comply.

Percoco emphasized that this behavior was not white-hat hacking but rather extortion. The incident raises concerns about the ethics of security research and the importance of responsible disclosure. It remains unclear whether Kraken identified all the attackers or managed to recover the stolen funds.

This incident serves as a reminder to the crypto community to prioritize ethical standards in security research and to always report bugs directly and responsibly. The consequences of unethical behavior can be devastating, as seen in this case. Kraken's transparency in sharing the incident highlights the importance of accountability and cooperation in maintaining the security and integrity of the crypto space.

Additional points:

Kraken lost around $3 million worth of crypto due to a bug in its funding system.

The exchange's chief security officer, Nick Percoco, disclosed the incident on social media.

The bug was exploited by rogue "security researchers" who refused to report it directly and responsibly.

The incident highlights the importance of ethical standards in security research.

Kraken's transparency in sharing the incident emphasizes the need for accountability and cooperation in maintaining the security and integrity of the crypto space.