Connect with us

Latest News

CertiK reveals it found Kraken vulnerability and will return funds, denies extortion allegations | MATIC News

Avatar

Published

on

Blockchain security firm CertiK confirmed that it was behind the discovery of a critical vulnerability in crypto exchange Kraken’s deposit system and gone public with its account of the events following allegations of extortion by the exchange.

The security firm also alleged that Kraken threatened its employees on June 18 and demanded repayment of a “mismatched” amount in an unreasonable amount of time without providing a relevant wallet address.

CertiK denied the extortion allegations and said it would transfer the funds used for its “white-hat testing” back to the wallet address it has on hand since Kraken did not provide a new address. The firm said:

“Since Kraken has not provided repayment addresses and the requested amount was mismatched, we are transferring the funds based on our records to an account that Kraken will be able to access.”

CertiK’s side

CertiK said its investigation started on June 5, when its researchers found an issue in Kraken’s deposit system that failed to differentiate between various internal transfer statuses.

This led to a deeper probe into whether a malicious actor could fabricate a deposit transaction and withdraw fabricated funds. The firm said the tests also aimed to determine whether a large withdrawal request would trigger any risk controls.

CertiK’s tests revealed that millions of dollars could be deposited into any Kraken account, and fabricated crypto worth over $1 million could be withdrawn and converted into valid cryptos. The firm said that no alerts were triggered during the multi-day testing period, and Kraken only responded and locked the test accounts days after it reported the incident.

Despite initial successful communications and steps to identify and fix the vulnerability, the situation deteriorated, leading to CertiK’s public disclosure.

The timeline of events began with the initial discovery on June 5 and included significant tests, such as a large withdrawal of over 90,000 Matic on June 7 and additional large deposits and withdrawals over the following days.

CertiK reported its findings to Kraken on June 10, and by June 12, Kraken confirmed and fixed the critical vulnerability. However, the situation escalated on June 18, when Kraken allegedly threatened a CertiK employee, demanding repayment without providing addresses.

Extortion allegations

Kraken’s Chief Security Officer Nick Percoco revealed on June 19 that nearly $3 million was taken from its wallets due to a bug that allowed anyone to initiate a deposit to the platform and receive the funds without completing the transaction.

He revealed that on June 9, the company received an anonymous tip from a “security researcher” about a critical bug affecting its funding system. The flaw allowed malicious actors to artificially inflate their account balances.

While fixing the vulnerability, Kraken found that three accounts had exploited this flaw within a few days, resulting in nearly $3 million being withdrawn from Kraken’s treasury. The amount is several magnitudes higher than it needed to be to prove the vulnerability exists.

The exchange said the researchers refused its request to return the funds and provide data in line with usual bug bounty programs, which includes “a full account of their activities, a proof of concept used to create the on-chain activity.”

Instead, the researchers scheduled meetings between the exchange and CertiK’s business department to discuss what the reward should be worth based on the damages it would have caused if undisclosed.

Percoco condemned the researchers’ demands for a speculative sum for the potential damages, calling the actions unethical and criminal.

Mentioned in this article


Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Latest News

How institutional networks are preparin for Bitcoin integration | MATIC News

Avatar

Published

on


The following is a guest post from Shane Neagle, Editor In Chief from The Tokenist.

Half a year after Bitcoin ETFs launched, it is safe to say that they have been the most successful ETF launch in history, having generated a $309.53 billion volume. Just within the first day of trading, spot-traded Bitcoin ETFs pulled in $4 billion, crushing the previous record holder, Gold ETF (GLD), which took 3 days to top $1 billion in inflows.

This is all the more impressive as Bitcoin is a novel asset compared to ancient gold. The trend clearly points to Bitcoin being more fit for purpose in the digital age. But what is that purpose?

BlackRock’s Head of Thematic & Active ETFs, Jay Jacobs, recently noted that Bitcoin is a “potential hedge against geopolitical and monetary risks”. By now, most people are aware that central banks’ ability to tamper with the money supply brings many moral hazards, from record-breaking budgetary deficits to inflation as an extra layer of taxation to cover those wild spending sprees.

Gold is less suited to counter that ability because it is physical, confiscatable, and not truly limited. Because Bitcoin is one-tenth the size of the gold market, its price is more volatile, but it is also a more attractive gains machine.

Now that Bitcoin ETFs have simplified and institutionalized access to more exciting digital gold, which steps are needed to ensure that trend continues?

Ensuring Network Reliability

Owing to its proof-of-work (PoW) consensus mechanism, Bitcoin is dual-natured. It is a digital asset anchored into the physical reality of energy and hardware. This underlying foundation gives Bitcoin its value as a decentralized counter to central banking.

In turn, the components of that foundation, the Bitcoin network, have to scale up to continue the institutional intake. Presently, the Bitcoin network handles around 412k transactions per day, nearly double from two years ago. Although the median transaction fee oscillates depending on network load, it rarely exceeds $5 per transaction.

In parallel, their networks have to scale to ensure the Bitcoin network handles orders of magnitude greater load coming from institutions. To increase their stability and robustness, they have to tackle multiple network components, from software and servers to hardware and internet connection.

Scalable Blockchain Solutions

Just as IBM made significant contributions to developing current large language models (LLM), the legacy computer company also made a strong case for blockchain scaling with IBM Blockchain. This immutable ledger is based on an open-source Hyperledger Fabric framework with a complete set of tools for building blockchain platforms.

Such a framework could interface with the Bitcoin ecosystem via atomic swaps, such as virtual vaults with timed smart contracts. Similarly, Visa proposed an experimental Universal Payment Channel (UPC) framework as a hub for blockchain network interoperability. International banking network SWIFT had already completed the second test phase for atomic settlement capability.

Zooming out, a picture emerges of enterprise-grade blockchain solutions for institutions, interlinking with international hubs and intermediating with institutions that handle exposure to Bitcoin, such as Coinbase.

Dependable Servers

Powering scalable blockchain solutions comes in the form of hardware. These can either be internal servers, via customized solutions offered by Broadcom, or offloaded to external options like the Canton Network.

As a decentralized infrastructure, the Canton Network is a network of networks, building on Daml smart contract language and micro-services architecture. The latter allows for each service plugged in to to have its own server, expandable with more CPUs and storage.

Using atomic settlements, the Canton Network makes real-time settlement possible across different blockchain apps. By outsourcing services to such networks, businesses and institutions can focus on core features rather than IT infrastructure management, including the maintenance of CPUs, dedicated GPU hosting to diversify into AI support, and other essential hardware.

Internet Connectivity

Nodes in any blockchain network have to communicate continuously to validate transactions and execute settlements by adding them as the next block on the blockchain ledger. In other words, internet connectivity necessarily involves redundancy and failover strategies.

For example, when Solana experienced network downtime problems, co-founder Anatoly Yakovenko hired Jump Crypto to develop Firedancer as a secondary network validator client to fortify network throughput and stability.

With broader solutions like the Canton Network, enjoying support from the Big Tech and Big Bank, redundancies, multi-channels, backup systems, and load balancing are already baked into the DLT cake.

Enhancing Network Performance

It is inherent in all types of computer networks to suffer from some level of packet loss and jitter. Packet losses can happen due to overwhelming demand, causing congestion, network interference, faulty software or hardware, and data corruption on hard drives.

Transmission Control Protocols (TCP) deal with packet losses by retransmitting data, which causes delays, or by Forward Error Correction (FEC), which adds redundant data to packets, removing the need for retransmission. The Bitcoin Relay Network uses FEC to this effect, as does the Blockstream Satellite network, as an alternative avenue to receive Bitcoin blockchain data.

As for jitter, certain data packets can arrive at different intervals. When this jitter happens, packets land in different orders, disrupting data stream. The jitter problem is typically handled with buffers that temporarily store streamed packets to ensure their correct order arrival.

Another way to handle jitter is to introduce quality of service (QoS) network configurations that prioritize critical traffic. This can also be applied to reduce packet loss. Network design itself is a big factor in reducing jitter by making sure the network has as few hops as possible.

The Bitcoin network benefits from its decentralized design because each transaction requires multiple confirmations. If jitter occurs, later confirmations offset the delays. Most importantly, the Bitcoin mainnet has an auto-adjusting difficulty mechanism that maintains the average block time at 10 minutes.

In practice, the management of the network’s data packet loss and jitter lands on on-site vs. ISP solutions.

On-site vs. ISP Solutions

On-site solutions require organizations to handle their IT infrastructure. While this gives institutions total control, including regulatory data compliance and faster personnel response, the upfront costs for hardware and storage are significantly higher.

On the other hand, ISP-hosted solutions are easier to scale as specialized companies are likely to be well-oiled machines, handling both maintenance and network uptime. On the clients’ end, this requires a reliable internet connection and the selection of the best packet loss and jitter metrics.

Case in point, Amazon Web Services (AWS) gives clients a Global Accelerator tool to enhance and balance network performance. Alongside Amazon Managed Blockchain and Quantum Ledger Database (QLDB), such services propelled AWS to become one of the infrastructure pillars of the blockchain space.

As for ISPs themselves, they are typically less forthcoming on their jitter/packet loss metrics, as they rely on several factors. To that end, there are many tools to track network latency, packet loss and jitter, such as PingPlotter.

Jack Dorsey’s Block (former Square) opted to build its own Bitcoin mining network, utilizing its 3 nm chip design, likely built by TSMC foundries. With an in-house, open-source mining hashboard, which is compatible with Raspberry Pi controllers, Block is heading to set up new standards for the Bitcoin ecosystem.

The other piece of the Bitcoin scalability puzzle revolves around energy.

Sustainable Energy Solutions

It is often said that Bitcoin is digital energy, or better yet, tokenized energy. Ultimately, Bitcoin’s proof-of-work sets it apart from thousands of copypasta cryptocurrencies, making it virtually unassailable from a network security standpoint. And that consensus algorithm exerts energy, as expected from any work.

But how much and what kind of energy? Bitcoin’s energy expenditure is often compared to a nation’s footprint, such as the Netherlands or Argentina. It is sufficiently high for Greenpeace to call for a campaign to change Bitcoin from proof-of-work to proof-of-stake.

Yet Greenpeace itself could launch such a shift, given that Bitcoin’s open-source code is available to all. The problem is that without a network and market interest, such a tweak would be meaningless.

In the meantime, over 50% of the Bitcoin network draws power from renewable sources. According to Daniel Batten’s research via Batcoinz, most of it comes from hydro, wind, solar, and nuclear.

Not only did Bitcoin step onto the majority-green territory, but it has been acknowledged as a key ingredient in balancing power networks. Namely, the Electric Reliability Council of Texas (ERCOT) pays large Bitcoin mining companies, such as Bitdeer and Riot Platforms, to stabilize the grid during anomalous conditions such as heat waves.

As recently as June 13th, ERCOT recommended that Bitcoin mining be directly integrated as a Controllable Load Resource (CLR) to boost power grid balancing. Additionally, there is an increasing trend for Bitcoin miners to use flared gas from oil drilling operations. Otherwise wasted and burned off, this byproduct can be captured to power Bitcoin mining rigs.

Now that BlackRock, the main driver of the ESG framework, is pushing Bitcoin, this is a clear signal to institutional investors that the “dirty Bitcoin” narrative is a bygone concern.

Block has yet to reveal its 100% solar-powered mining facility in West Texas. However, multiple Bitcoin mining companies, such as Bitfarms, Iris Energy, TeraWulf, and CleanSpark, have already transitioned to near-zero carbon footprints.

With nuclear power on the horizon due to AI data center demands, investors should expect even greater greening of Bitcoin operations. And in the likelihood of Donald Trump’s victory in the next presidential elections, Bitcoin sustainability concerns will further fade away.

Conclusion

In 2022, Messari noted that gold mining produces three times as many carbon emissions as Bitcoin. Since then, Bitcoin has outperformed gold ETF capital inflows by an even greater magnitude.

It turns out that there is great value to be found in an asset that cannot be tampered with on a practical level and is not controlled by anyone. Rather, Bitcoin is enforced by ingenious cryptography, tethering code to hardware assets and energy.

With capital damn broken, and access to Bitcoin exposure put on the same level as any other stock, it is a race to new highs and new lows to buy the dip. Building from the experience of other blockchain networks and mining companies, the tech is readily available to tap into this growing ecosystem.




Continue Reading

Latest News

Ex-Obama Solicitor General accuses regulators of intentionally debanking crypto firms | MATIC News

Avatar

Published

on

Former Solicitor General Donald B. Verrilli, who served during the Obama administration, has accused US regulators of intentionally stifling the crypto industry through debanking practices.

Verrilli, who now serves as Grayscale Investments’ senior legal strategist, made the remarks in a joint amicus brief filed on July 3 with Paul Clement, the former Solicitor General under President George W. Bush.

The statement highlighted growing bipartisan concerns about the regulatory environment for digital assets and

Debanking claims

The amicus brief was filed on behalf of Custodia Bank, which is appealing a Wyoming district court’s decision to grant the Federal Reserve discretion to deny it a Master Account.

In a joint statement with Clement, Verrilli suggested that the Office of the Comptroller of the Currency (OCC) has issued informal guidance that effectively limits banks’ ability to engage with crypto firms.

He argued that these guidelines, though not official, set stringent requirements that are difficult for banks to meet, impacting their ability to support the growing crypto industry. Additionally, the brief argues that such practices amount to a deliberate effort to debank the crypto industry, stifling competition and innovation.

Verrilli was particularly critical of the court’s decision in favor of the Fed, describing it as a significant obstacle for the crypto sector. His comments, supported by Clement, reflect a broader bipartisan concern about the current regulatory approach toward the crypto industry.

Fox Business journalist Eleanor Terrett recently reported on Verrilli’s perspective, noting the potential consequences of the Fed’s decision. Some market analysts warn that without more adaptive regulations, the United States could lose its competitive edge in the global crypto market.

Terret added that Verrilli and Clement’s joint support for Custodia Bank signals a shifting political landscape around crypto, with bipartisan backing growing as the November election approaches.

Growing influence

Digital assets are becoming a significant issue in the upcoming 2024 US elections, influencing both political discourse and voter behavior. The crypto industry has gained substantial traction, with its advocates pushing for more favorable regulations and greater acceptance among lawmakers.

This has led to increased political engagement from both industry stakeholders and voters interested in digital assets, with key political figures and presidential candidates increasingly aligning themselves with the crypto sector.

Former President Donald Trump recently pledged to support the interests of digital asset traders and has started accepting campaign contributions in cryptocurrencies. On the Democratic side, Robert F. Kennedy Jr. has also embraced cryptocurrencies, with his campaign accepting crypto donations and advocating for the protection of Americans’ rights to use and hold digital assets.

This growing political alignment is seen as crucial for mobilizing younger voters, who are typically more inclined to invest in cryptocurrencies. According to recent data, Millennials and Generation Z make up a significant portion of the crypto user base, and their support could be pivotal in close elections.

A poll by the Crypto Council for Innovation (CCI) found that a candidate’s stance on digital assets is important to many voters, with 83% of those surveyed preferring candidates who advocate for clear crypto regulations.

Meanwhile, Crypto entities are preparing to spend over $80 million on the elections, aiming to boost allies and promote legislation favorable to the industry. This has resulted in surprising bipartisan support for crypto-friendly legislation, with notable figures like Senate Majority Leader Chuck Schumer and former House Speaker Nancy Pelosi emerging as unexpected allies​

Mentioned in this article


Continue Reading

Latest News

OpenAI did not reveal security breach in 2023 – NYT | MATIC News

Avatar

Published

on

OpenAI experienced a security breach in 2023 but did not disclose the incident outside the company, the New York Times reported on July 4.

OpenAI executives allegedly disclosed the incident internally during an April 2023 meeting but did not reveal it publicly because the attacker did not access information about customers or partners.

Furthermore, executives did not consider the incident a national security threat because they considered the attacker a private individual without connection to a foreign government. They did not report the incident to the FBI or other law enforcement agencies.

The attacker reportedly accessed OpenAI’s internal messaging systems and stole details about the firm’s AI technology designs from employee conversations in an online forum. They did not access the systems where OpenAI “houses and builds its artificial intelligence,” nor did they access code.

The New York Times cited two individuals familiar with the matter as sources.

Ex-employee expressed concern

The New York Times also referred to Leopold Aschenbrenner, a former OpenAI researcher who sent a memo to OpenAI directors after the incident and called for measures to prevent China and foreign countries from stealing company secrets.

The New York Times said Aschenbrenner alluded to the incident on a recent podcast.

OpenAI representative Liz Bourgeois said the firm appreciated Aschenbrenner’s concerns and expressed support for safe AGI development but contested specifics. She said:

“We disagree with many of [Aschenbrenner’s claims] … This includes his characterizations of our security, notably this incident, which we addressed and shared with our board before he joined the company.”

Aschenbrenner said that OpenAI fired him for leaking other information and for political reasons. Bourgeois said Aschenbrenner’s concerns did not lead to his separation.

OpenAI head of security Matt Knight emphasized the company’s security commitments. He told the New York Times that the company “started investing in security years before ChatGPT.” He admitted AI development “comes with some risks, and we need to figure those out.”

The New York Times disclosed an apparent conflict of interest by noting that it sued OpenAI and Microsoft over alleged copyright infringement of its content. OpenAI believes the case is without merit.

Mentioned in this article


Continue Reading

Trending