Kraken temporarily locked customer accounts after the exchange received nearly 12,000 small cryptocurrency transfers from a wallet that blockchain analytics firm Arkham Intelligence linked to HTX, the exchange said.
The transfers arrived between August 17 and 24. Dust attacks, in which bad actors send tiny amounts of cryptocurrency to addresses to track transaction patterns or trigger automated responses, have become a persistent challenge for centralized exchanges managing customer funds and compliance obligations. Kraken said affected accounts have since been restored, though the exchange continues to hold the flagged funds.
HTX, the Hong Kong-based exchange, denied initiating the transfers. The company said it is investigating possible third-party activity tied to its infrastructure. HTX has not named specific suspects or explained how unauthorized access to a wallet linked to the exchange occurred.
Dust attacks exploit the fact that many users cannot instantly distinguish between legitimate transfers and spam. When recipients attempt to move or consolidate small holdings, the transfers can reveal wallet histories and enable chain analysis. Exchanges must weigh the operational cost of blocking accounts against customer service, since locking accounts prevents withdrawals but also protects users from unknowingly propagating compromised addresses.
The incident marks a recurrence of a tactic that has targeted cryptocurrency holders and exchanges intermittently since at least 2018. In July 2024, major exchanges including Coinbase and Kraken reported similar dust attacks. The scale here, 12,000 transfers over eight days, indicates a sustained, coordinated effort rather than random activity.
Kraken's decision to temporarily freeze accounts prevented customers from moving funds during the period when their addresses might have been flagged as compromised. If a customer's address had been marked as compromised during chain analysis, regulatory and compliance standards at other institutions could have flagged future transactions from that same address, freezing the customer out of service elsewhere. By halting access early, Kraken cut off the transmission chain before it reached counterparties.
Arkham's attribution to HTX infrastructure does not establish HTX's culpability. HTX claimed a breach of its systems or a wallet compromise by someone with operational access. HTX has not disclosed how long its investigation is expected to take or what remediation measures it plans to implement.
