Kraken Blog

This is a follow-up of the 2021 post: https://blog.kraken.com/product/engineering/oxidizing-kraken-improving… We originally introduced Rust (back in 2018) as a small experiment alongside existing systems, mostly to validate safety and performance assumptions under real production load. Over time, the reduction in memory-related incidents and clearer failure modes led us to expand its use into increasingly critical paths. This post focuses less on “Rust is great” and more on the tradeoffs, mistakes, and organizational changes required to make that transition work in practice. Happy to answer questions about what did not work, where Rust was a poor fit, or how we handled interop with existing systems.

Coinbase is technologically kind of a joke. Their matching engine is crap. They haven't even adopted bech32. They just do the bare minimum to keep things working for 99% of users, and for the unlucky 1% they follow the same customer support strategy as Google (aka automated emails but no actual humans). Unfortunately Coinbase is YC and they do a lot of marketing, so people who are just getting started tend to think they're a frontrunner. If you want an exchange that keeps up with the ecosystem you should use someone else. Kraken qualifies: https://blog.kraken.com/post/13502/kraken-now-supports-instant-lightni…

"The results of our most recent audit were once again verified by top-25 global accounting firm, Armanino LLP. " (1) So from this I read that Kraken has done audit themselves and then some other firm has verified it. This (if true) is called attestation, and not audit. Attestations are an empty claim with no proof in the tokenbro industry. And second issue I see (directly related to the first) - they list some tokens they are auditing. Auditing on chain. But what if the Kraken company has a completely off the chain liabilities? Like a contract where they loan money/btc to some shady person and get some worthless tokens as a collateral in return. You can't see this on chain, only a real independent audit can uncover such things. (1) https://blog.kraken.com/post/15002/kraken-proof-of-reserves-...

Kraken Digital Asset Exchange | Engineering Managers | Remote | https://www.kraken.com/en-us/careers Kraken was founded in 2011, being a pioneer exchange in the crypto market. Kraken is in rapid expansion of its engineering teams. At Kraken we have a remote global workforce, allowing our employees to have more freedom in choosing how to organize their routine and balance work and personal life. April Highlights: Engineering Managers - Core Backend - Rust Engineering Manager - Kraken Futures - Rust We’re also hiring software engineers with the following skillsets: Backend (Rust/Go/Typescript/PHP), Frontend (ReactJS/ReactNative/Flux/Typescript/Sass/Less/NextJS). Further information on our Engineering Blog: https://blog.kraken.com/engineering/ Please apply directly on our Lever careers page at https://jobs.lever.co/kraken.

In regards to the hardware wallets, I'd buy 2 Trezors and store them in separate locations If you're going bitcoin-only, you should consider Coldcard, which is the hardware wallet the hardcore bitcoiners love [1]. Cobo Vault is fairly new on the scene but is also getting rave reviews [2]. If you're going multisig, you should buy hardware wallets from different vendors to guard against a flaw or security vulnerability from any one vendor. For example, Trezor has some issues recently [3]. [1] https://coldcardwallet.com [2] https://cobo.com/hardware-wallet [3] https://blog.kraken.com/post/3662/kraken-identifies-critical-flaw-in-t…

Worth reposting Kraken's mobile phone security advisory: http://blog.kraken.com/post/153209105847/security-advisory-mobile-phon…

Did you hear about /r/FortNiteBR Bricks? https://blog.kraken.com/product/asset-listings/brick-and-moon-trading-…

I wouldn't put too much faith in biometrics either, a real shame considering their convenience. https://blog.kraken.com/post/11905/your-fingerprint-can-be-hacked-for-… Personally I advocate using BitWarden for commonly used logins that, if they were compromised, would not be catastrophic; perhaps in some cases because 2FA provides another, tautologically, factor, and KeePass secured with a FIDO2 device in challenge response mode, a passphrase, and possibly setting a higher key stretching work factor to further blunt any brute force attempt, in which more important data is held.

Kraken is supposedly (opening) a bank. https://blog.kraken.com/post/6241/kraken-wyoming-first-digital-asset-b… https://support.kraken.com/hc/en-us/articles/360055126131-What-is-Krak…

Ok, we've changed to that from https://blog.kraken.com/post/17619/settlement/. Thanks! (See https://hn.algolia.com/?dateRange=all&page=0&prefix=false&… for why we prefer third-party reporting where possible)

Kraken's proof-of-reserves audits are looking more and more attractive and important these days! https://blog.kraken.com/post/15002/kraken-proof-of-reserves-audit-expa…

Lack of awareness? Since most people’s initial interaction with Bitcoin is through exchanges, exchange adoption of lightning will increase awareness. Like how Kraken is doing it https://blog.kraken.com/post/13502/kraken-now-supports-instant-lightni…

This is from their about page (https://blog.kraken.com/about/) > Kraken is one of the world’s largest digital asset exchanges and the leader in euro volume and liquidity. Globally, Kraken’s client base trades more than 90 digital assets and 7 different fiat currencies, including GBP, EUR, USD, CAD, JPY, CHF and AUD.

I skimmed through this https://blog.kraken.com/post/7964/oxidizing-kraken/ yesterday now its php->rust so a widely different migration but rust was measured for its latency cutting value, not just fad factor I'd believe discord and others are on rust for this and not just the new shiney (that would be to their loss)

> In 2021 So they are still putting money into the project and promising things in the future. Years ago, before venture capital took over BTC, I could buy games on Steam with Bitcoin. Can I buy video games with Lightning? https://blog.kraken.com/post/7225/a-need-for-speed-kraken-to-launch-bi… > https://coingate.com/lightning-network Ok. What can I actually buy with it? There's tons of venture capital going into this project and no commerce happening. Bitcoin had more real commerce 5 years ago than BTC and Lightning combined do today.

>and correspondingly has not seen any real-world adoption. It is effectively dead. but https://blog.kraken.com/post/7225/a-need-for-speed-kraken-to-launch-bi… and https://coingate.com/lightning-network

It might interest you that Kraken recently started listing Brave's BAT as well: https://blog.kraken.com/post/2664/bat-and-waves-trading-starts-august-…

>it is actually very hard to sell [tether] for USD Kraken offers a USDTUSD pair. How is that hard at all? https://blog.kraken.com/post/206/kraken-announces-support-for-crypto-d…

Looks like they mostly improved their trading engine, and, to their defence, I do not have seen one of the dreaded 520 errors yet. https://blog.kraken.com/post/1449/

They're back with free trading until end of January: https://blog.kraken.com/post/1449/kraken-returns-with-free-trading/

Yea, database migration is my first guess as well. Any code change would have been reverted quickly otherwise. Their blog post about the incident is not clear enough. https://blog.kraken.com/post/1449/kraken-returns-with-free-trading/ Either way, it looks bad from both engineering and product perspective.

Their platform is back online now too: https://blog.kraken.com/post/1449/

Yes, according to Kraken. "Consider switching to a more secure telco, without a human interface. Google Fi: no phone support agents, no physical locations, no problems." https://blog.kraken.com/post/219/security-advisory-mobile-phones/

This was raised by Kraken back in November 2016. Shortly afterwards I removed mobile phone as 2FA from all my accounts. The simple fact is that I don't own my mobile number; the mobile operator does. As such I should not use it as 2fa. https://blog.kraken.com/post/219/security-advisory-mobile-phones/

Meanwhile, Kraken supports Bitcoin Cash from minute one: http://blog.kraken.com/post/1150/bitcoin-cash-and-a-critical-alert-for… http://blog.kraken.com/post/1183/bitcoin-cash-and-a-critical-alert-for… Here's Coinbase's original statement, which seems to be exactly what the grandparent comment was saying: https://twitter.com/coinbase/status/890986442674941953 "Coinbase does not intend to interact with the Bitcoin Cash blockchain."

This sort of attacks have been happening for over 5 months in crypto. Kraken published a highly useful blog post on it. Do give it a read. http://blog.kraken.com/post/153209105847/security-advisory-mobile-phon…

> http://blog.kraken.com/post/153209105847/security-advisory-mobile-phon… A 40-step instruction "how to make your google account secure" as a proof of the sad state of internet security. No way my parents can do it.

Related, but not directly to the article: This post [1] from Kraken covers how to protect yourself from this kind of attack. It's quite thorough. Interesting even if this isn't a concern for you directly. 1 - http://blog.kraken.com/post/153209105847/security-advisory-mobile-phon…

Kraken will soon add the ability to buy and sell DAO tokens http://blog.kraken.com/post/144971320167/kraken-to-support-dao-trading

as far as i know, we do not store fingerprints but i kind of hash of the fingerprint. so if this hash is stolen, it should not be possible to reconstruct the fingerprint "curve points" to use it on your device. but if someone does gain access to your device, i'd say that device is fucked anyway. if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and creating a fingerprint impression from this will be VERY easy. it takes simple glue and it is very low-cost. you use cyanolate and a gummy bear. the gummy bear will hold the fingerprint while you apply it to the sensor :) here are a few links : https://blog.kraken.com/product/security/your-fingerprint-can-be-hacke… https://blog.talosintelligence.com/fingerprint-research/ https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid fingerprints are a conveniance. they will work at home where you want that phone to be protected from your kid you don't want to be accessing internet too easily. as a security measure, it's stupid because it is very easy to grab fingerprints : you leave those all around. it is also very easy to just create an impression from a picture with a good quality camera. and once it's compromised, you CANNOT change your fingerprint for another one. do. not. use. fingerprints. for. security.