Kraken Lost Almost $3 Million After Bug Allowed Users to Print Money

Kraken patched a bug that let users credit their accounts with funds before deposits were completed, and two researchers who exploited it withdrew nearly $3 million, the company said. Chief Security Officer Nick Percoco said his team found the "isolated bug" in June after a bug bounty alert from a security researcher, and that the bug had been present on the platform since January. Percoco said the initial reporting researcher credited their wallet with $4, while two other researchers withdrew nearly $3 million, with losses borne by Kraken's treasury. Percoco said those researchers have refused to return funds, and Kraken is treating the matter as a criminal case with law enforcement.