Efe Nail Saltık 
Kraken plans to take legal action against security firm CertiK. CertiK’s “white hat” operation turned into a legal mess.
The Kraken-CertiK crisis began when security firm CertiK claimed to have conducted a white hat operation on certain Kraken accounts (not belonging to customers) and siphoned off approximately $3 million. While Kraken claims that the total amount exploited was not returned to it, CertiK states that it returned all funds.
Kraken Alleges Exploitation, CertiK Insists on White Hat Operation
The Kraken-CertiK crisis began on June 9, when Kraken received a bug bounty program warning from a security researcher. The warning stated that there was a bug in Kraken’s system that allowed users to increase their account balances. The crypto exchange quickly fixed the bug and discovered three accounts that had used the bug to withdraw $3 million from the Kraken account.
Kraken‘s research found that one in three accounts had Know Your Customer (KYC) verification, and this account used the error to add $4 to its account. Kraken security manager Nick Percoco said that this amount was enough to prove the bug and claim the reward, but the account shared the bug with two other accounts within a few days, and in total the three accounts earned $3 million from the exchange.
When Kraken asked the alleged “security researcher” to return the funds and collect his reward, the white hat hacker allegedly ignored the demands and claimed his reward first. While Kraken did not disclose the name of the security firm behind the “white hat” exploit, CertiK announced that they were behind the exploitation.
CertiK stated that its employees who discovered the security vulnerabilities were threatened and no wallet address was provided for the return of funds. Ronghui Gu, co-founder of CertiK, said in an interview:
“The verbal agreement reached during our meeting was not subsequently confirmed. Ultimately, they publicly accused us of theft and even directly threatened our employees, which is completely unacceptable.”
CertiK reportedly sent the stolen amount to crypto mixing services such as Tornado Cash to prevent it from being frozen from crypto exchanges. This move caused serious criticism in the crypto community, questioning CertiK’s intentions behind its “white hat” operations.
You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.