Tech-savvy researchers have reported a critical security bug to Kraken – though they’re negotiating hard before promising to return any money.