For several days millions of dollars of crypto were minted out of thin air- Kraken hack/bug bounty controversy

Today the group CertiK made a post on Twitter revealing multiple vulnerabilities including an exploit that allows any number of "fabricated crypto" to be deposited into any account, the post wasn't made to publicly share this information but to display a situation going on between them and Kraken.

According to CertiK- "After initial successful conversions on identifying and fixing the vulnerability, Kraken’s security operation team has THREATENED individual CertiK employees to repay a MISMATCHED amount of crypto in an UNREASONABLE time even WITHOUT providing repayment addresses."

A closer look at the situation reveals that CertiK hacked into Kraken- and using the exploits they found- minted and sent around 3 million USD to wallets they own. This was performed under a bug bounty scope- meaning the end goal is to help Kraken by exploiting their system and then after revealing how it was done they receive payment- although unsolicited hacking isn't typical in any bug bounty.

It gets a bit more interesting when we find out that CertiK is apparently refusing to send back all of the funds until Kraken pays them more than the bug bounties set payout- they would like what in their opinion is proper pay.

Personally I have mixed feelings about this- while I don't think this is good sentiment for the overall bug bounty environment- I'm indifferent on exchanges being hacked, they're not safe and people need to self custody. Curious to know what others think.

CertiK post- https://x.com/CertiK/status/1803450205389402215?t=9yiXuYEX6idxsbo3zTllGA&s=19