Kraken temporarily locked customer accounts this month after roughly 12,000 unsolicited crypto transfers, most worth between a few cents and several dollars, arrived at addresses connected to the exchange.
The transfers reached Kraken-linked addresses between 17 and 24 August, according to a Bloomberg report published Tuesday. Blockchain analytics firm Arkham Intelligence attributed the sending wallet to HTX, the exchange sanctioned by the United Kingdom in May and by the European Union this month.
Kraken described the activity as a dust attack. It has since restored access to affected accounts but continues holding the disputed funds separately, and is coordinating with law enforcement. Bloomberg put the largest affected frozen balance at $4.2 million.
HTX denies sending them.
Why cents mattered
Dusting normally involves sending negligible amounts of crypto to large numbers of addresses to track wallet activity or contaminate transaction histories. In ordinary conditions a payment worth eight cents carries no operational significance at all.
Sanctions change that arithmetic completely.
Once the originating address is designated, or strongly associated with a designated entity, any transfer from it becomes a compliance event regardless of value. Automated screening systems flag the receiving account, and under UK and EU rules exchanges must identify prohibited transactions and prevent restricted funds from being released.
That is the vulnerability the transfers exploited. Kraken said the apparent aim was to spread sanctioned funds across unrelated accounts and force compliance reviews across the industry.
“The recent dust attack originating from HTX-owned wallets appears to be an attempt to spread funds sanctioned by the U.K.,” the exchange said.
A Kraken spokesperson said the company does not know who is behind the wave, but that the likely goal was to have sanctioned funds land in client accounts, triggering full account locks and causing operational disruption for a large number of customers.
The attribution is contested
Arkham’s identification rests on addresses HTX itself had previously disclosed as part of its proof-of-reserves process, which makes the link stronger than a typical heuristic label. It is not the same as proof that HTX directed the transfers.
An HTX representative responded to questions on X on 18 August, days before Bloomberg’s report, saying the company had reviewed its internal accounts and found no evidence it was responsible. The representative suggested some Kraken customers may have acted on their own. HTX says it is investigating whether the activity resulted from misattribution or malicious third-party use of its wallets.
There is a plausible version of events consistent with both positions. A wallet publicly labelled as belonging to a sanctioned exchange is an unusually effective tool for anyone wanting to poison compliance systems, precisely because the label does the work. Whoever controlled that wallet during the window would not need to be HTX for the transfers to have the intended effect.
Kraken did not attribute intent to HTX as a corporate actor, only to wallets it described as HTX-owned.
The window opened as sanctions landed
The timing is what gives the incident its shape.
The UK designated Huobi Global S.A. on 26 May, alleging the company formed part of financial infrastructure facilitating Russian sanctions evasion. The EU followed with restrictions on Huobi Global that took effect on 23 August, midway through the eight-day transfer window.
Binance moved ahead of that deadline, saying it would stop processing transactions involving HTX and other listed platforms from 23 August and warning users that transfers after the cutoff could trigger compliance reviews and wallet restrictions.
HTX has disputed the corporate framing. The Block reported in July that the exchange said Huobi Global S.A. was a distinct entity from the trading platform, though the EU’s legal text lists HTX and Huobi Global SA together. For exchanges processing flows, the name in the annex governs.
TRM Labs separately reported that HTX repeatedly rotated wallets after the UK designation, retiring hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain and Solana every few hours. HTX characterised those rotations as routine, security-driven operations common across the industry.
Nobody can decline a deposit
The structural problem underneath this incident applies to every exchange and every self-custody holder.
On a public blockchain, any wallet can send tokens to any address that exists. The recipient has no mechanism to refuse the incoming transaction, no equivalent of returning a cheque or rejecting a wire. The funds arrive, and the receiving address now has exposure to whatever the sending address carries.
Compliance systems built primarily on direct wallet exposure treat that arrival as a signal about the recipient. In most cases it is. In a dusting campaign it is a signal about the sender’s intentions toward the recipient, which is the opposite conclusion.
The practical consequence for Kraken customers was being locked out of their own money because someone sent them eight cents.
What screening would have to change
Analysts examining the incident argue that exposure alone is too blunt a test, and that exchanges need to weigh transaction value, ownership, timing and customer behaviour rather than treating every unsolicited deposit as evidence of an intentional violation.
That is easier to state than to implement. A rule permitting small unsolicited deposits from sanctioned addresses creates an obvious threshold for structuring, and firms operating under UK and EU regimes carry personal and corporate liability for getting it wrong. Erring toward over-freezing is the rational institutional response, which is exactly what makes the tactic effective.
Some mitigation exists further up the stack. Centralised stablecoin issuers can freeze tokens at the contract level, removing them from circulation rather than leaving exchanges to quarantine them individually.
Kraken has restored account access after completing its reviews. The flagged funds remain segregated. What has not been resolved is whether a compliance architecture that can be triggered by an unwanted deposit worth pennies is fit for the sanctions regime now being applied to it.
FAQ
What happened?
Around 12,000 tiny transfers from wallets attributed to HTX reached Kraken-linked addresses between 17 and 24 August, triggering sanctions screening and temporarily locking affected customer accounts.
Have customers got their money back?
Access to accounts has been restored. The unsolicited funds themselves remain held separately because of their reported connection to sanctioned wallets. Bloomberg reported the largest affected frozen balance at $4.2 million.
Did HTX send them?
Arkham attributed the sending wallet to HTX using addresses from HTX’s own proof-of-reserves disclosures. HTX denies initiating the transfers and says it is investigating misattribution or third-party misuse of its wallets.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions.
