Auditors gone rogue? 🏃 These exploiters are not who you think they are!
Earlier today, Nick Percoco, the Chief Security Officer of the Kraken cryptocurrency exchange, stated that his team had discovered and fixed a bug that allowed users to literally print free money.
Users were able to artificially inflate the balance on their Kraken accounts by initiating deposits and receiving the funds before the deposits were completed. According to Percoco, the bug was initially discovered by a group of researchers on June 9th, where two of them took advantage of the exploit to steal over $3M worth of assets.
Percoco claimed that this information was not disclosed in the researchers' bug bounty report, adding that they were also unwilling to comply with standard bug bounty procedures.
While the researchers' identities were previously unknown, it has now been revealed that the blockchain security company Certik was behind the attack. The firm went on X to defend its actions, citing that the exchange had threatened their employees and that there was a discrepancy between the amount of funds that Kraken demanded to be returned and the amount of funds actually taken by Certik.
However, on-chain evidence seems to indicate that Certik's auditors might be in even more trouble, having interacted with the OFAC-sanctioned protocol Tornado Cash as part of their security tests.
Editor's Note: Based on the sentiment floating around Crypto Twitter at the moment, people are definitely unhappy with Certik's actions. It's not a good look when a crypto auditing firm keeps mum on the exploit for 5 days without approaching the affected platform and then proceeds to act like the victim. As crypto sleuths would later find out, even their own published timeline of events may have been fabricated. | 
0 Komentar untuk "🦎🚀 Have Certik crossed the line? 👀"