Key Takeaways
- • Kraken disclosed an extortion attempt by a criminal group threatening to release videos of internal system access, but maintains no systems were breached and no client funds were at risk.
- • Two separate security incidents involved inappropriate access by individuals within Kraken's support team in February 2025 and more recently, each involving limited client data; both were identified, contained, and affected users were notified.
- • Nick Percoco, Chief Security and Information Officer of Payward and Kraken, stated the company will not negotiate with extortionists or pay ransom, positioning a firm stance against criminal demands.
- • The incidents underscore persistent human vulnerability in cryptocurrency exchange operations, where insider access and social engineering remain exploitable vectors despite robust technical security measures.
Summary
Kraken, the Wyoming-based cryptocurrency exchange, publicly disclosed an extortion attempt on Monday in which a criminal group threatened to release videos purportedly showing access to internal systems containing client information. Despite the threat, the company asserted that its core infrastructure remained secure and that no client funds faced risk.
According to Nick Percoco, Chief Security and Information Officer of Payward (Kraken's parent entity), the company identified and isolated two distinct incidents of inappropriate access originating from individuals within its support organization. The first incident surfaced in February 2025 when Kraken received a tip regarding a video circulating on a criminal forum. Following an internal investigation, the company identified the responsible individual, revoked their access, implemented additional security controls, and notified affected clients. A similar incident occurred more recently, prompting identical containment and notification procedures.
Percoco emphasized the company's security posture in a statement on X: "Our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors." This declaration reflects Kraken's public commitment to rejecting ransom demands and maintaining operational integrity despite external coercion.
The incidents highlight a fundamental challenge in cryptocurrency exchange security: the industry combines high-value, instantly transferable digital assets with organizational dependencies on human judgment and behavior. While technical infrastructure vulnerabilities receive substantial attention, insider access and social engineering exploits remain persistent attack vectors. The ease with which cryptocurrency can be moved across borders and the irreversible nature of many transactions create economic incentives for malicious actors to target exchange employees and internal systems.
Recent cryptocurrency exploits have demonstrated increasing sophistication, combining smart contract vulnerabilities, social engineering tactics, and rapid fund movement strategies. Kraken's disclosure and transparent handling of these incidents—including clear communication that no client assets were compromised—represents standard incident management practice within the industry and reinforces the distinction between internal treasury exposure and customer asset protection.
According to Nick Percoco, Chief Security and Information Officer of Payward (Kraken's parent entity), the company identified and isolated two distinct incidents of inappropriate access originating from individuals within its support organization. The first incident surfaced in February 2025 when Kraken received a tip regarding a video circulating on a criminal forum. Following an internal investigation, the company identified the responsible individual, revoked their access, implemented additional security controls, and notified affected clients. A similar incident occurred more recently, prompting identical containment and notification procedures.
Percoco emphasized the company's security posture in a statement on X: "Our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors." This declaration reflects Kraken's public commitment to rejecting ransom demands and maintaining operational integrity despite external coercion.
The incidents highlight a fundamental challenge in cryptocurrency exchange security: the industry combines high-value, instantly transferable digital assets with organizational dependencies on human judgment and behavior. While technical infrastructure vulnerabilities receive substantial attention, insider access and social engineering exploits remain persistent attack vectors. The ease with which cryptocurrency can be moved across borders and the irreversible nature of many transactions create economic incentives for malicious actors to target exchange employees and internal systems.
Recent cryptocurrency exploits have demonstrated increasing sophistication, combining smart contract vulnerabilities, social engineering tactics, and rapid fund movement strategies. Kraken's disclosure and transparent handling of these incidents—including clear communication that no client assets were compromised—represents standard incident management practice within the industry and reinforces the distinction between internal treasury exposure and customer asset protection.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.