Kraken temporarily restricted customer accounts after nearly 12,000 unsolicited cryptocurrency transfers reached addresses connected to the exchange between Aug. 17 and 24, according to a Bloomberg report.
A Coordinated Dust Attack
Kraken characterized the activity as a dust attack intended to spread sanctioned funds across unrelated accounts and trigger compliance reviews. Most transfers were worth several cents or a few dollars. The exchange temporarily restricted affected accounts, later restoring access while retaining the disputed sanctioned funds separately. Kraken said it restored access after completing reviews, but continued holding the unsolicited funds because of their reported connection to sanctioned wallets.
A blockchain transaction can reach a public address without the recipient's permission. Users generally cannot prevent an unknown party from sending tokens to their deposit addresses before an exchange screens the transaction. Recent dust attacks from HTX-owned wallets appear to be an attempt to spread U.K.- and EU-sanctioned funds to other platforms, a Kraken spokesperson said. The exchange acknowledged that it could not identify who initiated the transactions.
HTX Attribution Disputed
Arkham Intelligence reportedly labeled the sending wallet as connected to HTX using addresses previously identified through the exchange's proof-of-reserves disclosures. That attribution associates the address with the HTX ecosystem but does not prove that HTX controlled the wallet when each transfer occurred or directed the payments. HTX denied involvement, saying it absolutely did not engage in such behavior and was investigating whether address-labeling errors, operational misunderstandings or malicious third-party actions caused the activity.
HTX's denial does not resolve ownership of the sending wallet. The exchange has not published a complete address list or transaction analysis supporting its explanation. Similar small transfers had reportedly reached addresses associated with Coinbase, Binance and other exchanges before the Kraken disclosures. HTX said an internal review found no official accounts or testing systems responsible.
Sanctions Context
The U.K. designated Huobi Global S.A. on May 26 under its Russia sanctions regime. The measures include an asset freeze and restrictions on processing payments involving the designated entity. HTX disputed the designation's scope, arguing that Huobi Global S.A. is legally separate from its operating exchange. The European Union later included HTX, identified as Huobi Global S.A., among crypto service providers covered by a transaction ban. The relevant decision took effect on Aug. 23.
The timing meant that small transfers sent shortly before and after the EU restriction became active could attract heightened scrutiny. Exchanges serving U.K. or EU customers must identify prohibited transactions and prevent restricted funds from being released. Blockchain researcher TRM Labs had previously reported that HTX repeatedly changed wallets following the U.K. designation. HTX described those rotations as routine security practices rather than sanctions avoidance.
Compliance Poisoning Raises New Questions
The incident exposes a weakness in compliance systems that rely heavily on direct wallet exposure. A customer can receive funds from a sanctioned address without requesting, approving or controlling the transaction. Exchanges must therefore assess transaction value, ownership, timing and customer behavior instead of treating every unsolicited deposit as evidence of an intentional sanctions violation. Kraken and HTX have not announced a joint investigation or publication deadline. The next verified update would require wallet-level evidence identifying the sender, further statements from either exchange or action from U.K. and EU sanctions authorities.
