SKN | Kraken Users Briefly Locked Out After Nearly 12,000 Sanctioned Crypto Transfers

Key Points:

• Kraken temporarily restricted some customer accounts after nearly 12,000 low-value transfers from wallets labeled by Arkham Intelligence as linked to sanctioned exchange HTX.
• The activity occurred between August 17 and August 24, with individual transfers ranging from a few cents to several dollars.
• The incident highlights a growing compliance challenge: public blockchain transparency can be exploited to create links between sanctioned funds and unrelated customer addresses.

Kraken temporarily restricted access for some customers after a wave of nearly 12,000 small cryptocurrency transfers from wallets linked by blockchain analytics firm Arkham Intelligence to HTX reached Kraken-related addresses. The activity, which occurred from August 17 through August 24, appears to have been structured to distribute sanctioned funds widely enough to trigger automated compliance restrictions, turning a core feature of public blockchains into a potential attack vector for regulated exchanges.

The incident comes as crypto exchanges face increasingly complex obligations around sanctions screening, transaction monitoring and customer access. For institutional investors and professional market participants, the episode illustrates how compliance infrastructure has become an operational risk alongside traditional cybersecurity, liquidity and counterparty considerations.

Nearly 12,000 Transfers Targeted Customer Deposit Addresses

According to Arkham data cited by CoinDesk, wallets associated with HTX sent nearly 12,000 low-value transactions to Kraken-linked addresses during the seven-day period. Individual transfers were generally worth only a few cents to several dollars, making the economic value of the transfers relatively small compared with the potential disruption they could cause.

Kraken said the transactions appeared designed to spread sanctioned funds across multiple platforms and trigger restrictions when those assets reached customer deposit addresses. Some users were briefly locked out when the activity was first detected, although the exchange subsequently restored access while continuing to hold the flagged funds.

The apparent strategy exploits a fundamental property of public blockchains: users can send digital assets to an address without the recipient’s permission. That makes it possible to create an on-chain association between sanctioned funds and an otherwise unrelated customer without the customer’s involvement.

Sanctions Screening Becomes an Attack Surface

Kraken described the activity as a “dust attack”, a tactic involving numerous tiny transfers designed to create unwanted blockchain links. The approach is significant because compliance systems are generally designed to identify potentially prohibited exposure, not necessarily to determine whether a customer deliberately received the funds.

Kraken said it did not know who was behind the activity but believed the attackers may have expected sanctioned funds entering customer accounts to trigger a full account lock. The exchange’s compliance team restored access while maintaining control of the identified funds and working with authorities.

The episode demonstrates the difficult balance exchanges must maintain. Overly aggressive screening can disrupt legitimate customers, while insufficient screening can expose platforms to regulatory penalties and reputational damage.

HTX Disputes Responsibility for the Transfers

HTX, which has TRON founder Justin Sun as an adviser, said an internal review found that no official accounts were responsible for the related microtransactions. The exchange said it was investigating whether the sending wallet had been misidentified or whether a third party was responsible.

The regulatory backdrop adds significance. The United Kingdom sanctioned HTX in May, imposing an asset freeze after authorities said they had reasonable grounds to suspect the exchange provided financial services to Russia-linked payment network A7 and sanctioned crypto exchange Garantex. HTX has rejected those allegations. The European Union subsequently added HTX to a transaction ban in July, with the ban taking effect on August 23, during the period when the transfers were occurring.

For institutional crypto investors, the episode reinforces the importance of transaction-screening resilience, custody controls and counterparty compliance. Exchanges will likely face increasing pressure to distinguish deliberate sanctions exposure from unsolicited transfers, particularly as attackers recognize that blockchain transparency can be weaponized against legitimate users. The next test will be whether platforms can strengthen screening without turning unavoidable third-party transfers into prolonged restrictions for customers who had no role in the underlying activity.