Kraken Loses $3M to Exploited Zero-Day Flaw

A security researcher exploited a critical flaw at Kraken, stealing US$3 million in digital assets

[{"selector":"#anim-7910940a-2269-4e5c-8bd6-eaf413ac874d","keyframes":{"transform":["translate3d(-132.12852%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-65374267-eec9-4331-bd39-0bbfb371502a","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-66c8a647-d8fc-47cd-b434-5c4b2478b958","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

The flaw allowed users to inflate their account balances through a deposit loophole

[{"selector":"#anim-2d1b0eb7-ea6f-4fc0-8703-abf13d126665","keyframes":{"transform":["translate3d(-130.07519%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3da8e621-5691-4aab-b0a1-02cc345ba437","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a8992e17-2b22-48e2-8695-71a81668ac7d","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Kraken fixed the issue within 47 minutes, assuring no client assets were at risk

[{"selector":"#anim-ba6b9ca9-c8b6-4504-af4c-f844c229a109","keyframes":{"transform":["translate3d(-130.23256%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f4a8252a-e29c-469d-a32d-7e5cbb437e2b","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0c165ea6-9040-40e7-88f5-fa01ba4c8b4f","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

The researcher and associates allegedly extorted Kraken instead of reporting under bug bounty terms

[{"selector":"#anim-e27dbe63-0ba1-425d-b009-110b6dde1901","keyframes":{"transform":["translate3d(-128.40909%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2018a5ba-e8f0-4c73-9a40-8852250dbf29","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3ff28b16-b5c1-4d5f-9bec-8ec9ec921edb","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Kraken treated the incident as a criminal matter, coordinating with law enforcement

[{"selector":"#anim-bde4533b-14eb-4491-b19f-05506b06c48d","keyframes":{"transform":["translate3d(-138.66666%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-458b295a-0624-4430-bf77-93519c841b5f","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-43cf5750-c300-4418-8208-f69e47cf0493","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]