Evidence has surfaced indicating that a CertiK researcher may have been conducting probing and testing as early as May 27, 2024, which contradicts CertiK’s reported timeline of events.
This development follows Kraken’s blog post accusing the “third-party security research company” of exploiting the flaw for financial gain before reporting it. The now-resolved vulnerability allowed certain users, for a short time, to artificially inflate their Kraken account balances without fully completing a deposit.
Kraken-CertiK Saga Intensifies Over $3 Million Exploit Discrepancy
The ongoing dispute between Kraken and CertiK has taken another turn as both parties continue to clash over the nearly $3 million exploit. Kraken claimed that the total exploited amount was not returned, while CertiK asserted they had returned all funds according to their records.
On June 20, CertiK provided an update on X , stating they had returned 734.19215 Ether (ETH), 29,001 Tether (USDT), and 1021.1 Monero (XMR). However, Kraken had requested 155,818.4468 Polygon (MATIC), 907,400.1803 USDT, 475.5557871 ETH, and 1089.794737 XMR. The discrepancy between the returned and requested amounts remains a point of contention.
Bug bounty programs, widely adopted by firms to enhance their security systems, invite third-party hackers, known as “white hats,” to identify vulnerabilities so the company can address them before malicious actors exploit them. Kraken, like its competitor Coinbase , employs such a program to proactively discover and fix potential security issues.
CertiK reportedly sent the stolen funds to the crypto mixing service Tornado Cash to prevent them from being frozen by crypto exchanges. This move sparked significant criticism from the crypto community, raising questions about CertiK’s motives behind what was claimed to be a “white hat” operation.
Crypto Community Questions CertiK’s Actions in Kraken Exploit
The crypto community questioned CertiK’s decision to move millions of dollars worth of funds when a single transaction could have proven the vulnerability.
Critics also reminded that Tornado Cash is an Office of Foreign Assets Control (OFAC)-sanctioned tool, and using it could lead to legal trouble for CertiK. Many also wondered whether CertiK intended to return the funds and why it chose to send them to Tornado Cash.
The majority of the crypto community sided with Kraken, condemning CertiK for its ruthless behavior. Many accused CertiK of “stealing” and blackmailing Kraken for the bounty, calling the firm’s ethical standards into question.
