When cybersecurity researchers break the law, destroy their reputation, and make the bug-bounty research community look bad.
TL:DR Researchers found a vulnerability in a cryptocurrency exchange. They notified the company, but then exploited the bug to steal millions.
The irony is that the “security researchers” are claiming bad faith on behalf of Kraken, even though it was them who took millions in assets that did not belong to them.
That is not how bug-bounties and ethical cybersecurity research is supposed to work!
Full article: https://www.theregister.com/2024/06/20/kraken_certik_crypto_dispute
I don't think they should call themselves 'researchers'!
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit