Kraken claims it is being 'extorted' as hacker demands reward after $3M theft

Karma has a nasty sense of humor. Better hope you're FDIC insure... oh, who am I kidding.

So they found the bug, tested it with a series of increasing amounts, and then 8 hours after the last “larger amount test” let them Kraken know about the issue.

Imagine being on the Kraken side and noticing the discrepancy during that window of time. Or even worse, them not knowing it.

Everything I saw from actual independent security researchers was nothing like that story. Most of them just seemed like legitimately curious people who enjoyed trying things and just wanted a little recognition. Just putting their names in release notes or similar recognition seemed to make many of them very happy.