Cryptocurrency exchange Kraken has revealed that a security researcher remains in possession of about $3 million worth of digital assets it had appropriated.