Cryptocurrency Exchange Kraken Loses $3 Million in Theft

 Here is the rewritten blog in English with a similar meaning:

Kraken's Chief Security Officer, Nick Percoco, shared details of the incident on X (formerly Twitter), explaining that they received a warning from their Bug Bounty program regarding a flaw "allowing users to alter their balance to a higher amount than actual on our platform." However, no further specific details were disclosed.

The company reported that the security issue was identified within minutes of the alert. Essentially, it allowed attackers to "initiate a deposit on our platform and credit funds to their account without completing the deposit process."

Although Kraken assured that no customer assets were at risk, the issue could have enabled malicious actors to generate assets in their accounts, potentially causing damage to the system. The problem was fixed within 47 minutes.

The company also mentioned that this flaw stemmed from a recent change in the user interface, which allowed customers to deposit and use funds before they were fully confirmed.

A deeper investigation revealed three accounts, including one belonging to a security researcher, who exploited the vulnerability over several days to siphon $3 million.

Percoco stated: “This individual found a flaw in our system and exploited it to add $4 of cryptocurrency to their account.” “This was enough to validate the flaw, submit a bug bounty report, and earn a significant reward per our program's terms.”

“Instead of following the proper channels, the ‘security researcher’ disclosed the vulnerability to two others they were working with. They exploited the flaw to withdraw nearly $3 million from Kraken accounts. This money came from Kraken’s treasury, not from other customers' assets.”

Blockchain security company CertiK took responsibility for the breach on Kraken, revealing that they had identified several serious vulnerabilities allowing for the creation of cryptocurrency in any account, which could then be withdrawn and converted into legitimate crypto assets.

CertiK noted, "Over a few days, with multiple fake tokens created and withdrawn to legitimate cryptocurrencies, there were no blocking or risk control mechanisms activated until CertiK reported the issue. The question is, why did Kraken’s sophisticated defense system not detect multiple trial transactions? Withdrawing large sums from different test accounts was part of our testing process."

This development comes as Kraken accuses a “third-party security research company” of exploiting the flaw for financial gain before reporting it.