- Kraken says it has fastened a bug that allowed exploiters to inflate account balances
- The bug was found by a safety researcher whose linked accounts reportedly siphoned $3 million from Kraken’s coffers utilizing the vulnerability.
Kraken has introduced that its safety group has fastened a bug that allowed some customers to doubtlessly improve their account balances on the trade.
The announcement follows Kraken’s revelation {that a} safety researcher found a vulnerability within the trade’s bug bounty program.
“On June 9, 2024, we acquired a bug bounty alert from a safety researcher. No particulars had been initially launched, however their e mail acknowledged that they’d discovered an “extraordinarily crucial” bug that allowed them to artificially inflate their stability on our platform,” Kraken’s head of safety, Nick Percoco, wrote on X.
$3 million stolen, not person funds
Particularly, the flaw would have allowed some customers, albeit for a brief time period, to “artificially improve the worth of their Kraken account stability with out absolutely finishing the deposit,” in line with the trade’s weblog submit.
Kraken has since fastened the bug in its deposit and funding system and famous that buyer funds weren’t affected.
Nonetheless, whereas the trade fastened the remoted bug, the report got here after two customers had already exploited the vulnerability to withdraw $3 million from their accounts. These accounts are reportedly linked to the identical safety researcher who found the bug and reported it to Kraken.
An unnamed particular person is believed to have reported the error to Kraken after withdrawing $3 million.
In accordance with Percock, regardless of the massive withdrawal, the safety researcher demanded that they obtain his reward.
“We is not going to disclose this analysis firm as a result of they don’t deserve credit score for his or her actions. We’re treating this as a felony matter and can coordinate with regulation enforcement accordingly. We’re grateful that this subject was reported, however that is the place this thought ends,” Percoco added.
