Kraken
One of the oldest and most trusted cryptocurrency exchanges, known for strong security practices and wide asset support.
https://kraken.comMax Reward
$100,000
Total Paid
$2,900,000
Resolved
234
Avg Response
2 days
In-Scope Assets
kraken.com
Exchange platform and trading terminal
Kraken API
REST and WebSocket APIs
Kraken Pro
Advanced trading interface
Kraken Wallet
Self-custody wallet application
Out of Scope
- ✕ Kraken NFT marketplace (beta)
- ✕ Educational content
- ✕ Marketing pages
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| KRK-001 | Withdrawal address whitelist bypass via API parameter pollution | Critical | Open | $25,000–$100,000 | 0 |
| KRK-002 | Information disclosure in verbose trading error messages | Low | Resolved | $200–$500 | 3 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.