Kraken, a crypto exchange, revealed that a rogue security research firm has retained $3 million in digital assets obtained from exploiting a bug on its platform. According to Kraken’s Chief Security Officer Nick Percoco, the incident occurred on June 9 when the company was alerted by an anonymous "security researcher" about a critical bug affecting its funding system.

The Bug

Percoco explained that the bug arose from a recent user experience (UX) change on the exchange, allowing users to artificially inflate their account balances and trade in real-time before assets were properly cleared. This flaw was not adequately tested against this specific vulnerability.

Upon fixing the bug, Kraken discovered that three accounts had exploited the flaw within a short period. The security researcher had shared this information with associates, who subsequently withdrew nearly $3 million from Kraken’s reserves.

Extortion Allegations

Kraken attempted to retrieve the funds and requested a comprehensive report from the researchers, but their requests were ignored. Instead, the researchers demanded an unspecified amount as compensation for potential damages the bug could have caused if undisclosed.

Percoco condemned these actions as unethical and criminal, emphasizing that adherence to bug bounty program rules is crucial for ethical hacking. Ignoring these rules, he argued, revokes the "license to hack" and categorizes the actions as criminal behavior.

Legal Action

In response, Kraken is treating the incident as criminal and is collaborating with law enforcement agencies to address the matter.

As of the current time, Kraken has not responded to further inquiries from CryptoSlate regarding the incident.