Kraken locks some users out after sanctioned HTX dust attack

Kraken users locked out by sanctioned wallet activity

Crypto exchange Kraken briefly locked some customers out of their accounts after receiving nearly 12,000 small transfers from wallets associated with rival exchange HTX. HTX is currently under European Union and U.K. sanctions.

The activity happened between August 17 and August 24. Each transaction was worth only a few cents to a few dollars. Kraken said the pattern appeared designed to spread funds linked to a sanctioned entity in order to trigger account restrictions when the money arrived at customer deposit addresses.

Key numbers and facts

• Nearly 12,000 low-value transfers were sent from HTX-linked wallets to Kraken.
• Transactions occurred between Aug. 17 and Aug. 24.
• Some Kraken users were locked out on the first day the activity was noticed.
• Kraken’s compliance team restored access while continuing to hold the flagged funds.

What Kraken and HTX said

In a statement shared with CoinDesk, Kraken said it does not yet know who is behind the attacks. The exchange added that the likely goal is to force account freezes by sending sanctioned funds to unsuspecting users.

HTX, which lists TRON founder Justin Sun as an adviser, responded by saying an internal review found no official company accounts were responsible for the microtransactions. The exchange posted on X that it is investigating whether the wallets were misidentified or if a third party initiated the transfers. CoinDesk reached out to HTX for further comment but had not received a response at the time of publishing.

Sanctions context

The U.K. sanctioned HTX in May, citing suspicions that it provided financial services to Russia-linked payment network A7 and sanctioned crypto exchange Garantex. HTX has denied the allegations. The EU added HTX to a transaction ban in July, with the ban taking effect on August 23 while the transactions were still occurring.

This incident mirrors a similar tactic seen in 2022, when an unidentified sender transferred ether from the sanctioned mixer Tornado Cash to several celebrities. U.S. authorities later said they would not prioritize enforcement against recipients who reported unsolicited nominal transfers after a delay.

Why this matters

The episode highlights how public blockchains can be used to turn sanctions screening into a weapon. Because anyone can send crypto to any address at low cost, an attacker can create a compliance link between sanctioned funds and ordinary users. The result can be disrupted access, frozen assets, and increased burdens for exchanges trying to enforce regulations.

What happens next

Kraken said its compliance team is working with authorities to ensure the attacks do not achieve their intended impact. The investigation is ongoing.

Sources

• CoinDesk