"Researchers" exploit Kraken exchange bug, steal $3 million in crypto

Kraken disclosed that a recently introduced web UI change contained a zero-day bug allowing actors to initiate deposits that credited balances before deposits were cleared; three accounts exploited the flaw to withdraw roughly $3 million from Kraken's treasury. The exchange patched the issue within an hour, states no client assets were at risk, and has reported the activity to law enforcement after an alleged researcher refused to return funds and demanded payment.