The Kraken Deposit Bug Exploit Explained: Nearly $3M

Video transcript

Kraken's June 2024 bug was not a leaked key or a broken contract. It was a gap between when a deposit was credited and when it cleared.

Kraken's chief security officer, Nick Percoco, said a recent UX change credited accounts before deposits fully cleared. A credited but unfinished deposit could then be withdrawn.

Percoco said the reporter's account credited itself four dollars to prove the flaw. Two others then withdrew nearly three million dollars from Kraken's treasuries, not client assets.

Kraken got the alert on June ninth. On June nineteenth, Percoco called the exploit extortion, and CertiK said it found the bug. Funds came back the next day, minus fees, and in August CertiK said it made errors in judgment.

A deposit can be started, pending, cleared or failed, and withdrawals should follow the cleared state. In business logic flaws, each request can look valid, but the sequence breaks.

Map what each deposit state allows. Test withdrawals against pending, failed and reversed deposits. Re-test after every UX change, and reconcile credited balances against settled deposits.

Guardian's API Pentest covers endpoint authorization, abuse resistance and automation triggers, at every privilege level. Guardian's WebApp Pentest looks for steps that can be skipped, reordered or run twice.

Read the full article, or talk to Guardian about testing your deposit and balance flows.

Kraken's June 2024 bug was not a leaked key or a broken contract. It was a gap between when a deposit was credited and when it cleared.

It also led to a public dispute between Kraken and CertiK, the security firm that later said it found the bug.

This explainer reports the bug and each side's account as Kraken's chief security officer, CertiK, The Block and CoinDesk published them.

What Happened

On June 9, 2024, Kraken received a bug bounty program alert from a security researcher, according to chief security officer Nick Percoco.

The alert claimed an "extremely critical" bug that let an attacker "artificially inflate their balance," The Block reported.

Percoco said the bug let an attacker "initiate a deposit onto our platform and receive funds in their account without fully completing the deposit," CoinDesk reported.

He said it was "completely fixed within a few hours" and that "no client assets were at risk," The Block reported.

Kraken then found three accounts had exploited the bug within a few days of each other. Percoco disclosed the incident publicly on June 19.

How the Bug Worked

Per The Block, Percoco said the bug came from a flaw in a recent UX change that "credited clients' accounts before asset deposits fully cleared."

He said this was possible only in "a specific set of circumstances."

Put simply, the balance moved before the money did. A credited but unfinished deposit could then be withdrawn.

How it was used, per Kraken

Percoco said one account, KYC-verified to the person who reported the bug, purportedly credited itself $4 to prove the flaw.

He said that person then told two others. They "withdrew much larger sums from their Kraken accounts totaling nearly $3 million."

How it was used, per CertiK

CertiK later said it was the firm involved, and that its team found the flaw during whitehat research.

It said "Millions of dollars can be deposited to ANY Kraken account," CoinDesk reported.

Per The Block, CertiK said its test deposits all used Polygon's MATIC token. It said no alerts were triggered during its multi-day testing period.

Timeline and Loss

The loss

• Nearly $3M withdrawn: Percoco, per The Block and CoinDesk.
• Whose funds: "This was from Kraken's treasuries, not other client assets," Percoco said.
• Returned: the funds, minus a small amount lost to fees, Percoco confirmed on June 20.

The dispute, as reported

Percoco said the researchers refused to return the funds until Kraken gave a speculated dollar figure for what the bug could have caused.

He wrote: "This is not white-hat hacking, it is extortion!" Kraken treated it as a criminal case and coordinated with law enforcement, The Block reported.

Per CoinDesk, Kraken's bounty terms require exploiting only the minimum needed to prove a bug, and returning any assets. Kraken said the researchers did not follow them and would get no bounty.

CertiK said Kraken's security team "threatened" its employees to repay a "mismatched" amount within an "unreasonable" six hours, without giving a repayment address, The Block reported.

It said it was transferring the funds "based on our records."

On August 16, 2024, CertiK said it "made errors in judgment and poorly communicated with Kraken." It said it had partnered with outside counsel to improve its internal processes.

What It Shows

A deposit has states: started, pending, cleared and failed. What a user can withdraw should follow the cleared state, not the started one.

By Kraken's account, a UX change moved the credit earlier in that sequence.

Flaws like this sit in business logic. Each request can look valid on its own; the sequence is what breaks.

Checks for deposit and balance flows

• Map each deposit state and what it lets a user do: trade, transfer or withdraw.
• Test withdrawals against pending, failed and reversed deposits.
• Re-test value flows after every UX or product change, not only backend work.
• Reconcile credited balances against settled deposits, and alert on any gap.

Our guide to crypto exchange pentesting covers balance races and server-side limits. For reconciliation, see withdrawal security controls.

To compare bounty programs, read our exchange bug bounty benchmark.

How API Pentest Tests This

Guardian's API Pentest tests "what each key can reach and what happens when one is used from somewhere new." Three of its six areas bear on deposit and balance flows:

• Endpoint authorization: per-object checks, tenant isolation, mass-assignment and trust in client-controlled parameters.
• Abuse resistance: rate limits, quotas and replay protection, and whether they hold per key.
• Automation triggers: endpoints that fire relayers, bots or onchain transactions, and flows that can be replayed or reordered.

Every endpoint is tested at each privilege level, across REST, GraphQL, gRPC and custom protocols.

For the app layer, Guardian's WebApp Pentest attacks "the flows that authenticate users, authorize actions and move funds."

Its business logic checks look for "steps that can be skipped, reordered, or run twice."

Frequently Asked Questions

What was the Kraken deposit bug?

Per chief security officer Nick Percoco, a flaw in a recent UX change credited accounts before deposits fully cleared. Under certain conditions, a user could start a deposit, receive funds without completing it, and withdraw them.

Were Kraken customers' funds affected?

No, according to Percoco. He said the nearly $3 million came from Kraken's treasuries, not client assets, and that no client assets were at risk.

Who exploited the Kraken bug?

Percoco said three accounts exploited it, one tied to the researcher who reported it. CertiK then said it was the firm involved, and in August 2024 said it made errors in judgment and communicated poorly with Kraken.

Were the funds returned?

Yes. On June 20, 2024, Percoco confirmed the funds had been returned, minus a small amount lost to fees, The Block reported.

Sources

• The Block: Kraken discloses it was exploited for nearly $3 million in bug that has now been fixed (June 19, 2024, updated June 20)
• The Block: CertiK says it found Kraken's bug and is transferring the funds back to the exchange (June 19, 2024)
• CoinDesk: Kraken Says Hackers Turned to 'Extortion' After Exploiting Bug for $3M (June 19, 2024)
• CertiK: CertiK Statement on Kraken Vulnerability (August 16, 2024)