Kraken Chief Security and Information Officer Nick Percoco revealed on X that the exchange suffered two separate insider breaches where criminals recruited support staff to access client data. Roughly 2,000 accounts (0.02% of total clients) had their support records viewed. The perpetrators then demanded a ransom, threatening to release recorded footage to media and social platforms.
Timeline and Method
The first incident occurred in February 2025. Kraken received a tip about a video circulating on a crime forum showing someone accessing the customer support system. An internal investigation identified the employee, permissions were revoked immediately, and additional security controls were added. The second happened around April 2026 using the same pattern — another support team member was compromised. Kraken terminated access and notified affected users.
In both cases, attackers only viewed customer support data (such as ticket histories), not core trading systems, balances, or private keys. Percoco emphasized the breach was limited to a support interface permission level, which is typical for customer service roles, not a direct threat to funds.
Kraken's Hardline Stance: No Ransom, No Negotiation
After the videos were obtained, the same criminal group began extortion attempts, threatening to leak them unless demands were met. Percoco's public statement directly addressed the ransom: "Our systems were never breached; funds were never at risk; we will not pay these criminals; we will never negotiate with malicious actors." Kraken said it would not finance crime, echoing its 2024 response when CertiK allegedly withdrew ~$3 million during a bug bounty program and demanded a reward — Kraken refused payment and publicly accused the firm of extortion.
Humans, Not Systems, Are the Weakness
This incident highlights human vulnerabilities in security: criminals directly recruited employees rather than attacking code or infrastructure. Similar approaches have been documented in gaming and telecom industries. Coinbase also suffered a data leak when an Indian outsourced support team was bribed. Percoco noted that crypto is not the only target; organized crime is systematically going after people who have access.
Kraken is cooperating with federal law enforcement across multiple jurisdictions. The number of suspects and their identities have not been disclosed. Market reaction has been muted, with BTC trading around $68,000.
Next Steps Pending
Kraken says it has collected sufficient evidence and will continue working with authorities. Further details on the scope of the breach or the criminals' next move are not yet available.