Overview
- Kraken, which disclosed the threat Monday, said a criminal group is pressuring the exchange to pay by threatening to publish videos of internal support tools that show client data.
- Company investigators traced the material to two insider-access incidents, one first flagged in February 2025 and a similar recent case, and revoked the implicated support employees’ access in each instance.
- About 2,000 accounts were potentially viewed across both events, limited to client support records rather than private keys or core trading systems, and affected users were notified.
- Executives said the firm will not pay or negotiate, it is working with federal law enforcement across multiple jurisdictions, and it believes it has enough evidence to pursue arrests, with no video released publicly so far.
- Kraken frames the episode as part of a wider push to recruit or coerce support staff at crypto, gaming, and telecom firms, a trend that can fuel targeted phishing against users even when funds and core systems are not compromised.