Exchanges & Trading
Share
The cryptocurrency community is abuzz with controversy following CertiK’s recent disclosure of significant security vulnerabilities in Kraken, one of the world's leading cryptocurrency exchanges. The revelation has sparked heated debate over the responsible handling of such discoveries.
CertiK’s investigation revealed serious flaws within Kraken's systems, potentially exposing the exchange to hundreds of millions in losses. On June 5, CertiK identified these vulnerabilities but did not immediately inform Kraken. It wasn't until June 10 that CertiK reached out to Kraken via Twitter, a delay of five days from the discovery. This delay suggests shortcomings in Kraken's monitoring capabilities at the time. Kraken responded swiftly upon receiving the report, addressing the issue by June 12.
However, discrepancies in timelines between CertiK and Kraken regarding initial contact and responses have emerged, with Kraken claiming initial contact on June 9, whereas CertiK states it initiated contact on June 10, with a response on June 11.

CertiK’s thorough investigation exposed three major security concerns:
CertiK’s tests revealed that Kraken's security was compromised, permitting millions of dollars to be deposited into any Kraken account and over $1 million in fabricated cryptocurrency to be withdrawn without triggering any alerts.
Disclaimer of Warranty
The information provided in this article is for general informational purposes only. We make no warranties about the completeness, reliability, and accuracy of this information. Read full disclaimer
Kraken's response has drawn both praise and scrutiny. While they acted promptly upon being informed, questions have been raised about their initial detection and monitoring processes. Moreover, allegations of Kraken threatening CertiK employees over the disclosure have added another layer of controversy. Critics argue that if the vulnerabilities were critical, Kraken should have been more proactive in identifying and addressing them.
On the other hand, CertiK's approach, which involved conducting multiple test transactions with significant sums and using Tornado Cash, has also faced criticism. Some argue that these actions border on exploitation rather than ethical security research, likening them to theft and extortion.
Kraken has clarified that their Bug Bounty program is designed to enhance security and relies on ethical behavior from researchers. According to Kraken’s head of security, the actions of CertiK researchers violated the rules of the program and constituted criminal behavior. Kraken is now treating this incident as a criminal case and is coordinating with law enforcement agencies.
Kraken emphasized that this breach is an isolated incident and that they remain committed to their Bug Bounty program. The exchange will continue to work with ethical researchers to improve the security of the cryptocurrency ecosystem.
As both sides present their arguments, the crypto community remains divided. This controversy highlights the challenges of maintaining security in the dynamic world of cryptocurrency and underscores the importance of ethical conduct and transparency from both security researchers and exchanges alike.
On June 20, CertiK took to X to provide an update on the situation, claiming it had returned 734 Ether (ETH), 29,001 Tether (USDT) tokens, and 1,021 Monero (XMR) coins. However, Kraken had requested the return of 155,818 Polygon (MATIC) tokens, 907,400 USDT, 475.5 ETH, and 1,089.8 XMR. CertiK reportedly sent the stolen funds to the crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. This move triggered significant criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation. From his end, Nick Percoco confirmed that fund are back on X as well



Editor's Picks

Franklin Templeton’s 250 Digital Deal Signals a Shift Toward Active Crypto Management
Walid Abou Zaki
Apr 1, 2026
5 min

VARA Introduces Virtual Asset Derivatives Framework As Dubai Deepens Market Maturity
Walid Abou Zaki
Mar 31, 2026
7 min

Crypto-Collateral Mortgage Gap Signals Future Opportunity for Dubai
Walid Abou Zaki
Mar 28, 2026
7 min
Read More Articles
In the Same Space

Ethereum Foundation Locks In $93M More in ETH, Hits 70,000 Target
News Desk
Apr 3, 2026
3 min

X Prepares New Rule to Lock Accounts After First Crypto-Related Post
News Desk
Apr 3, 2026
3 min

Grayscale Predicts Bitcoin Rebound with a Potential End to the War in Iran
News Desk
Apr 3, 2026
4 min

Fed’s Barr Signals Strict Stablecoin Enforcement Ahead of GENIUS Act Deadline
Salma Naueihed
Apr 3, 2026
7 min