$3 million in white hat operation funds is the subject of a dispute between Kraken and CertiK

A security flaw exploit that led to the unauthorized withdrawal of approximately $3 million from Kraken’s treasury by a research team from CertiK has been the focal point of the recent conflict between CertiK and Kraken. This has revealed critical issues.

The nature of ethical hacking, communication protocols, and the appropriate management of discovered vulnerabilities have been the subject of significant questions, as both parties have presented contrasting narratives.

A security research team that initially disclosed the bug recently caused Kraken to incur a loss of approximately $3 million as a result of a bug exploit. Nicholas Percoco, Kraken’s Chief Security Officer, accused the team of extortion, alleging that they demanded a reward for the stolen funds and refused to return them unless Kraken agreed to pay a speculative amount for prospective damages.

Percoco reported that the research team was able to withdraw more than $3 million from Kraken’s treasury as a result of the bug, which was first disclosed on June 9. Nevertheless, the team exploited the defect despite notifying Kraken of the critical security vulnerability.

Kraken verified that the misappropriated assets originated from their treasury and reassured users that their funds were secure. Additionally, the exchange is collaborating with law enforcement to reclaim the misappropriated funds.

Percoco continued by stating that one of the accounts implicated in the exploit had successfully completed the Know Your Customer (KYC) verification process. The suspected research team initially demonstrated the flaw with a $4 crypto transfer, which was sufficient to claim a bounty from Kraken. Nevertheless, the subsequent withdrawal of nearly $3 million raised ethical concerns.

CertiK subsequently identified itself as the team in question and asserted that Kraken had threatened its employees. In response to Kraken’s request to refund the funds, Percoco expressed disappointment, citing accusations of unprofessional behavior.

The nature of a recent controversy between CertiK and Kraken and the actions taken by both parties have prompted a number of critical concerns.

Consequently, CertiK has taken the initiative to provide clarification. Certik asserts that their research activities did not involve any actual Kraken users’ assets, as the cryptos were created arbitrarily. CertiK has consistently given Kraken assurances that they would return the funds, despite allegations, and they have done so.

Kraken’s request is, however, inconsistent with the total quantity returned. Kraken had requested 155818.4468 MATIC, 907400.1803 USDT, 475.5557871 ETH, and 1089.794737 XMR, while CertiK returned 734.19215 ETH, 29,001 USDT, and 1021.1 XMR.

Also Read: India’s Financial Intelligence Unit has imposed a $2.2M fine on Binance