CertiK: All funds have been returned but it is inconsistent with Kraken’s requirements and no bug bounty has been requested

CertiK responded to the recent dispute with Kraken on the X platform: 1. Did any real users lose funds? No. Cryptocurrencies are minted out of thin air, and no real Kraken users' assets are directly involved in our research activities; 2. Did CertiK refuse to refund? No. In our communication with Kraken (via email and video conference), we always assured them that we would return the funds. 3. Did CertiK really return the funds, and how much was the total amount? Yes, we returned all the funds, but the total amount was different from what Kraken requested. We returned the funds based on records. 4. Did the returned funds match Kraken's requirements? The returned amount did not match what Kraken requested. We returned 734.19215 ETH, 29,001 USDT, and 1021.1 XMR, while Kraken requested 155818.4468 MATIC, 907400.1803 USDT, 475.5557871 ETH, and 1089.794737 XMR. 5. Why did CertiK conduct multiple large-scale tests? a. We wanted to test the limits of Kraken's protection and risk control; b. After multiple tests over multiple days, involving nearly 3 million worth of cryptocurrencies, but without triggering alarms, we still have not determined the upper limit; 6. Did CertiK disclose the details of the vulnerability to Kraken? Yes. We sent a detailed report to Kraken via email, and Kraken claimed to have resolved the issue 47 minutes later based on our report. 7. Did CertiK notify Kraken in a timely manner? Yes. Our testing lasted for five days, and after we got the results, we contacted Kraken in various ways and sent a detailed report. 8. Did CertiK participate in the Kraken bounty program? No. We contacted Kraken Official and CSO Nick through X, LinkedIn, and finally sent a detailed report via email. 9. Did CertiK ask for a bounty? No. We did not ask for a bounty. It was Kraken who first mentioned their bounty to us, and we responded that the bounty was not a priority topic and we wanted to make sure this issue was resolved. 10. Why didn't CertiK submit a complete list of transactions to Kraken? a. We reported a large number of deposit addresses to Kraken from day one. With the information we provided, Kraken was able to identify all transactions and did lock all related accounts. b. We have disclosed all deposit transactions to the public.