Bug Bounty hunters drain $3M from Kraken