CertiK Uncovers Major Security Issues in Kraken Exchange

Findings from CertiK’s Investigation: Kraken security vulnerability

CertiK’s thorough investigation exposed three major security concerns:

Deposit System Flaws: Kraken’s system was unable to distinguish between different internal transfer statuses, allowing the potential fabrication of deposit transactions.

Withdrawal of Fabricated Funds: Malicious actors could withdraw fabricated funds and convert them into legitimate cryptocurrencies.

Risk Control Failures: Kraken’s risk controls and asset protection systems did not activate alerts for large withdrawal requests.

CertiK’s tests revealed that Kraken's security was compromised, permitting millions of dollars to be deposited into any Kraken account and over $1 million in fabricated cryptocurrency to be withdrawn without triggering any alerts.

Kraken's response has drawn both praise and scrutiny. While they acted promptly upon being informed, questions have been raised about their initial detection and monitoring processes. Moreover, allegations of Kraken threatening CertiK employees over the disclosure have added another layer of controversy. Critics argue that if the vulnerabilities were critical, Kraken should have been more proactive in identifying and addressing them.

On the other hand, CertiK's approach, which involved conducting multiple test transactions with significant sums and using Tornado Cash, has also faced criticism. Some argue that these actions border on exploitation rather than ethical security research, likening them to theft and extortion.

Kraken’s Position and Future Steps

Kraken has clarified that their Bug Bounty program is designed to enhance security and relies on ethical behavior from researchers. According to Kraken’s head of security, the actions of CertiK researchers violated the rules of the program and constituted criminal behavior. Kraken is now treating this incident as a criminal case and is coordinating with law enforcement agencies.

Kraken emphasized that this breach is an isolated incident and that they remain committed to their Bug Bounty program. The exchange will continue to work with ethical researchers to improve the security of the cryptocurrency ecosystem.

As both sides present their arguments, the crypto community remains divided. This controversy highlights the challenges of maintaining security in the dynamic world of cryptocurrency and underscores the importance of ethical conduct and transparency from both security researchers and exchanges alike.

Recent Update ( June 21st)

On June 20, CertiK took to X to provide an update on the situation, claiming it had returned 734 Ether (ETH), 29,001 Tether (USDT) tokens, and 1,021 Monero (XMR) coins. However, Kraken had requested the return of 155,818 Polygon (MATIC) tokens, 907,400 USDT, 475.5 ETH, and 1,089.8 XMR. CertiK reportedly sent the stolen funds to the crypto mixing service Tornado Cash to avoid having them frozen by crypto exchanges. This move triggered significant criticism from the crypto community, which questioned CertiK’s motive behind the “white hat” operation. From his end, Nick Percoco confirmed that fund are back on X as well