Kraken hit by 12,000 HTX-linked dust transfers

Kraken temporarily restricted customer accounts after nearly 12,000 unsolicited cryptocurrency transfers reached addresses connected to the exchange between Aug. 17 and 24, according to an Aug. 25 report from Bloomberg.

Most transfers were worth several cents or a few dollars. Kraken characterized the activity as a “dust attack” intended to spread sanctioned funds across unrelated accounts and trigger compliance reviews.

Kraken restored access but retained disputed funds

Kraken said it restored access to the affected customer accounts after completing reviews. The exchange continued holding the unsolicited funds separately because of their reported connection to sanctioned wallets.

A blockchain transaction can reach a public address without the recipient’s permission. Users generally cannot prevent an unknown party from sending tokens to their deposit addresses before an exchange screens the transaction.

“Recent dust attacks from HTX-owned wallets appear to be an attempt to spread U.K.- and EU-sanctioned funds to other platforms,” a Kraken spokesperson said. Kraken acknowledged that it could not identify who initiated the transactions.

Traditional dust attacks involve sending tiny crypto amounts to identify or track wallet owners. The Kraken incident more closely resembles “compliance poisoning,” where unwanted funds are distributed to create sanctions exposure or overwhelm automated screening systems.

Kraken did not disclose how many customers were restricted, how long the reviews lasted or the total value of the retained assets. Its public status page did not list a platform-wide outage connected to the transfers.

Arkham’s HTX attribution remains disputed

Arkham Intelligence reportedly labeled the sending wallet as connected to HTX using addresses previously identified through the exchange’s proof-of-reserves disclosures.

That attribution associates the address with the HTX ecosystem. It does not prove that HTX controlled the wallet when each transfer occurred or directed the payments.

HTX denied involvement. A spokesperson said the exchange “absolutely did not engage in such behaviour” and was investigating whether address-labeling errors, operational misunderstandings or malicious third-party actions caused the activity.

HTX’s denial does not resolve ownership of the sending wallet. The exchange has not published a complete address list or transaction analysis supporting its explanation.

Similar small transfers had reportedly reached addresses associated with Coinbase, Binance and other exchanges before the Kraken disclosures. HTX said an internal review found no official accounts or testing systems responsible.

Sanctions gave small transfers greater compliance weight

The U.K. designated Huobi Global S.A. on May 26 under its Russia sanctions regime. The measures include an asset freeze and restrictions on processing payments involving the designated entity.

HTX disputed the designation’s scope, arguing that Huobi Global S.A. is legally separate from its operating exchange. As previously reported, HTX denied that the U.K. sanctions applied broadly to its trading platform.

The European Union later included HTX, identified as Huobi Global S.A., among crypto service providers covered by a transaction ban. The relevant decision took effect on Aug. 23.

The timing meant that small transfers sent shortly before and after the EU restriction became active could attract heightened scrutiny. Exchanges serving U.K. or EU customers must identify prohibited transactions and prevent restricted funds from being released.

Blockchain researcher TRM Labs had previously reported that HTX repeatedly changed wallets following the U.K. designation. HTX described those rotations as routine security practices rather than sanctions avoidance.

Compliance controls must distinguish receipt from intent

The incident exposes a weakness in compliance systems that rely heavily on direct wallet exposure. A customer can receive funds from a sanctioned address without requesting, approving or controlling the transaction.

Exchanges must therefore assess transaction value, ownership, timing and customer behavior instead of treating every unsolicited deposit as evidence of an intentional sanctions violation.

Centralized stablecoin issuers can freeze tokens at the contract level. In related enforcement activity, Tether froze more than $500 million across 370 addresses during one 30-day period.

Kraken and HTX have not announced a joint investigation or publication deadline. The next verified update would require wallet-level evidence identifying the sender, further statements from either exchange or action from U.K. and EU sanctions authorities.