Kraken faces extortion after insider incidents expose data of 2,000 users

Kraken says a criminal group is extorting the exchange after two insider support incidents exposed basic customer data. About 2,000 accounts (~0.02% of users) may be impacted; funds and core systems were not breached.

Kraken’s CSO Nick Percoco said the group threatened to publish “videos of our internal systems with client data shown.” Source: Percoco on X.

Bloomberg reports the exposure stemmed from support employees capturing photos and videos of internal screens in two separate incidents, one in 2025 and another in early 2026. The data involved a small set of basic fields such as names and physical addresses. Kraken warned potentially affected clients to be cautious of unsolicited contacts. Source: Bloomberg.

Kraken rejects the extortion attempt. “We will not pay these criminals” and “will not ever negotiate with bad actors.” The company says there was no system hack, client funds remain secure, and it is working with federal law‑enforcement agencies across multiple jurisdictions. Source: Percoco on X.

Recent history shows repeated pressure on CEX support tooling. In January 2026, a read‑only panel for Kraken’s customer support was advertised on a dark web forum for $1, with view access to user profiles and transaction history and the ability to generate tickets for phishing. Source: Dark Web Informer. In mid‑2025, a similar social‑engineering campaign targeted Kraken and Binance after a successful customer data breach at Coinbase, with attackers bribing support agents for access. Source: Bitcoinist.

Key points for investors:
- Insider vector, not an external system breach Bloomberg Percoco
- Scope: ~2,000 accounts, ~0.02% of users; basic support data (names, addresses) Bloomberg
- Funds and trading infrastructure unaffected; no ransom payment Percoco
- Ongoing law‑enforcement coordination Percoco