We were previously vulnerable but nobody exploited it and we probably would have caught it fairly quickly if they had.
Thanks for the transparency. Kraken always struck me as the sort of well run exchange that has good internal controls, like an appropriately small hot wallet and manual review of certain transaction profiles, so I'm sure that you would have caught any attempt fairly quickly.
During the
discussion of the episode over on the Stellar forum, the bx.in.th exchange operator described one of their controls, which makes exceptionally good sense:
We also check every coin wallet balance before every withdrawal. This means we have to run withdrawals in batches every 5 minutes. Our system does an entire balance audit before every withdrawal batch. We compare all users balances to the actual wallet balances, if any balance does not match then no withdrawals go out for any currency.
If Kraken isn't already doing something similar (and you very well may be), it might be worth implementing as an extra safeguard for all assets.