“This individual discovered the bug in our funding system, and leveraged it to credit their account with $4 in crypto.”
Kraken says $4 would have proved the bug and earned a large bounty. Instead three accounts pulled nearly $3 million and pointed Kraken to their business development team to arrange its return. The “researchers” turned out to be CertiK, a blockchain security firm, which says Kraken’s controls missed millions in fabricated tokens for days. A security firm that finds the hole and then bills for the exit is running a toll booth.