- Kraken says it has mounted a bug that might permit exploiters to extend account balances
- The bug was found by a safety researcher whose linked accounts allegedly siphoned $3 million from Kraken's coffers by exploiting the vulnerability.
Kraken has introduced that its safety crew has mounted a bug that might have allowed some customers to probably enhance their account balances on the trade.
The announcement follows Kraken's revelation {that a} safety researcher recognized the vulnerability as a part of the trade's bug bounty program.
“On June 9, 2024, we acquired a Bug Bounty notification from a safety researcher. No particulars had been initially launched, however their electronic mail claimed to have discovered an “extraordinarily important” bug that allowed them to artificially inflate their steadiness on our platform,” Kraken head of safety Nick Percoco mentioned on X.
$3 million stolen, not person funds
Particularly, the flaw would permit sure customers, albeit for a brief time frame, to “artificially enhance the worth of their Kraken account steadiness with out totally finishing the deposit,” the trade mentioned in a weblog put up.
Kraken has since mounted the bug in its deposit and funding system, noting that it didn’t impression any buyer funds.
Though the trade mounted the remoted bug, the information got here after two customers had already exploited the vulnerability to withdraw $3 million from their accounts. These accounts are mentioned to be linked to the identical safety researcher who recognized the flaw and notified Kraken.
An unnamed particular person reportedly notified Kraken of the error after withdrawing $3 million.
In accordance with Percoco, regardless of the large obtain, the safety researcher demanded that they obtain his reward.
“We is not going to disclose this analysis firm as a result of they don’t deserve credit score for his or her actions. We’re dealing with this case as a felony case and coordinating with regulation enforcement. We're grateful that this concern was reported, however that's the place the thought ends,” added Percoco.
