The researcher claimed bug bounty protections; Kraken referred the matter to law enforcement, citing the scale of the exploitation as exceeding the bounds of legitimate security research. Separately, Kraken disclosed in June that a security researcher had identified and exploited a critical API vulnerability that enabled unauthorized withdrawals before the bug was reported. Kraken...