Seems a bit unethical from CertiK. Oops, you got me, now, I'll disclose my findings and return the money. In any case I am waiting for the full write-up.

UX change that caused this, so basically shitcoins got double spent but Kraken did not notice that / wait for enough confirmations or is there some actual technical vulnerability on top of it?