Kraken, a cryptocurrency exchange, disclosed the details of a security breach where a security researcher exploited a zero-day website vulnerability, resulting in the theft of $3 million in cryptocurrency. The incident involved a critical vulnerability allowing artificial balance increases in Kraken wallets. Identified and fixed within minutes by Kraken’s security team, the flaw, stemming from a user interface change, enabled deposits without full completion, leading to three (3) users, including one (1) researcher, exploiting it to siphon funds from Kraken’s treasury. Despite requests for proof-of-concept (PoC) and fund returns, the researchers demanded compensation, prompting Kraken to treat the matter as a criminal case. CertiK, a blockchain security firm, claimed responsibility, asserting its actions were part of research and criticizing Kraken’s security measures. Kraken, however, accused CertiK of exploiting the flaw for financial gain before reporting it. The incident is currently being coordinated with law enforcement. CTIX analysts recommend that any Kraken users ensure that their application firmware is up-to-date and execute best practices for security like using strong passwords and implementing multi-factor authentication (MFA).