Kraken says insider related incidents affected 2,000 client accounts, but no funds were at risk

Kraken, the US based crypto exchange with more than 13 million registered users, says it was targeted in an extortion attempt following two insider-related incidents, but insists no breach occurred and no customer funds were put at risk.

The latest episode appears to involve insider-related data access that affected roughly 2,000 accounts, according to a security update shared by Chief Security Officer Nick Percoco on X. The exchange said its systems were never breached, no funds were ever at risk, and it will not negotiate or pay the group’s demands.

Kraken said the first incident came to light in February 2025 after the company received a tip about a video posted on a criminal forum that appeared to show access to client support systems.

The firm said it identified the individual involved as a support team member, revoked access immediately, investigated the matter, added security controls, and notified affected clients. More recently, Kraken said it received another tip and a new video showing similar activity, which led it to identify a second support team member and terminate that person’s access as well.

Across both incidents, Kraken said approximately 2,000 client accounts, or about 0.02% of its client base, were potentially viewed. The company said the access was limited to client support data and that only a small number of affected clients were notified.

Shortly after the latest access was cut off, Kraken said it began receiving extortion demands from the same criminal group, which threatened to circulate material from both incidents to the media and on social platforms.

The exchange said it has been working with industry partners and federal law enforcement across multiple jurisdictions to investigate what it described as broader insider recruitment efforts targeting crypto, gaming, and telecommunications companies.

Kraken added that it believes it has gathered enough intelligence to support the identification and arrest of those responsible, though it declined to share further details because of the ongoing investigation.