Kraken Dust Attack Turns Tiny HTX-Linked Transfers Into Compliance Trap

• Nearly 12,000 small transfers reached Kraken-linked addresses over eight days.
• Kraken says the activity appears designed to weaponize sanctions screening.
• Customer access has been restored while the flagged funds remain frozen.
• HTX denies sending the transfers and is investigating the wallet attribution.

Kraken temporarily restricted some customer accounts after nearly 12,000 small crypto transfers from wallets reported as linked to HTX reached Kraken-associated addresses between Aug. 17 and Aug. 24. Kraken described the activity as a “dust attack” that appeared designed to spread sanctioned funds and trigger compliance reviews, while HTX denied initiating the transfers and said it is investigating whether they resulted from misattribution or malicious third-party activity.

Nearly 12,000 Transfers Turned Pennies Into a Compliance Problem

The individual transactions were economically insignificant. Most carried only a few cents or several dollars.

Their compliance implications were considerably larger.

According to reporting based on Bloomberg’s account of the incident, the wallet sent roughly 12,000 small transfers to Kraken-linked addresses over an eight-day period. Arkham Intelligence associates the sending wallet with HTX based on an address previously disclosed by the exchange during its proof-of-reserves process.

Kraken said some customers who received the unsolicited transfers subsequently lost access to their accounts while the transactions underwent compliance review.

The exchange has since restored access to affected users while continuing to hold the sanctioned funds. Kraken also said it is working with relevant authorities to limit further disruption.

The episode creates an unusual inversion of the conventional sanctions problem. Customers did not necessarily choose to transact with a flagged source. Instead, an outside wallet could send assets to their addresses without permission.

The attack in numbers:

• Period: Aug. 17 to Aug. 24
• Transfers: Nearly 12,000
• Typical size: From a few cents to several dollars
• Target: Kraken-linked addresses
• Customer impact: Temporary account restrictions for some recipients
• Current status: Account access restored, flagged funds remain frozen

How a Dust Attack Can Weaponize Sanctions Screening

Traditional crypto dust attacks involve sending tiny amounts of an asset to many addresses. Historically, attackers have used the technique to study transaction patterns and potentially connect otherwise separate wallets.

The Kraken incident points to a different use case: compliance poisoning.

Blockchain transfers are permissionless at the recipient level. An exchange customer cannot prevent an outside wallet from sending crypto to an address that has already been generated for deposits.

That creates a potential attack sequence:

Flagged wallet → tiny unsolicited transfer → customer deposit address → sanctions alert → compliance review

The sender does not need to steal funds or compromise Kraken’s infrastructure. The objective can simply be to make legitimate addresses interact onchain with a source that compliance software identifies as sanctioned.

Kraken said the activity appeared intended to spread funds sanctioned by the U.K. and European Union across other platforms and undermine trust in the industry. The exchange said those behind the transfers may have expected platforms to freeze entire customer accounts once sanctioned assets appeared in them.

That makes the economics heavily asymmetric. Sending thousands of transactions worth pennies can be inexpensive, while investigating thousands of sanctions alerts requires compliance staff, blockchain analytics and potentially manual account reviews.

Why Kraken Could Not Simply Ignore the Transfers

The obvious response might appear to be ignoring unsolicited deposits below a certain value. For a regulated exchange, however, transaction size does not necessarily remove the compliance issue.

Once blockchain analytics identify funds as originating from a sanctioned entity or address, the platform has to determine what restrictions apply and whether the assets can legally be credited, moved or returned.

Automatically freezing the entire recipient account creates another problem. If receiving unsolicited funds is enough to restrict an account, an attacker gains an inexpensive method for disrupting other users.

Kraken’s response indicates a more granular approach. Customer access has been restored, while the sanctioned assets themselves remain held.

That separation matters. It reduces the attacker’s ability to turn a tiny unwanted deposit into a broader denial-of-service mechanism against another user’s exchange account.

HTX Disputes Who Was Behind the Transfers

The identity of the party responsible for the transactions remains unresolved.

Bloomberg reported that the sending wallets had been identified as linked to HTX, and subsequent reporting says the attribution was connected to an address previously disclosed through HTX’s proof-of-reserves process. That association, however, does not establish who controlled the wallet when the transfers were made or prove that HTX initiated the activity.

HTX has denied sending the transfers and said it is investigating. The exchange has raised the possibility of incorrect address attribution or malicious activity by an unrelated third party. Other reporting around the incident has likewise highlighted uncertainty over who initiated the transactions.

感谢倪大关注！
很欣慰看到用户解除风险了！
我们下午查看了所有充提记录，在和其他平台上万条的订单中，暂无新增的冻结案例。请大家放心。

我们会持续保护用户资金安全，保持和各平台的沟通。大家遇到任何问题，欢迎第一时间来找我们反馈，我们一定会竭尽全力解决。 https://t.co/UG8VAjJhMh

— 火币六爷｜火币TradFi负费率 (@HTX_Molly) August 18, 2026

Sanctions Made HTX-Linked Funds More Difficult for Exchanges to Handle

The incident comes after regulatory action increased the compliance sensitivity surrounding HTX-linked transactions.

The U.K. sanctioned Huobi Global SA in May, alleging that the company formed part of financial infrastructure facilitating Russian sanctions evasion. The European Union subsequently announced related measures in July.

Other major crypto platforms have since restricted or reviewed transactions associated with HTX.

That regulatory backdrop is what gives the dust transfers their potential disruptive value.

Without sanctions screening, a transfer worth a few cents would normally have little operational significance.

Once the originating address carries a sanctions designation or strong association with a sanctioned entity, the same transaction can create an investigation regardless of its economic value.

The incident therefore exposes a gap between permissionless blockchain settlement and permissioned financial compliance. Exchanges can control which withdrawals they authorize, but they cannot stop an outside party from broadcasting funds to a public deposit address.

The Bigger Question Is How Exchanges Treat Unsolicited Sanctioned Funds

Kraken restoring account access while continuing to isolate the flagged assets provides one possible response to this type of attack.

The wider industry problem is harder.

If exchanges automatically restrict every account receiving dust from sanctioned wallets, malicious senders can deliberately generate false-positive compliance events at scale. If platforms disregard small transfers entirely, they risk creating thresholds that could be deliberately exploited to move prohibited funds.

The more durable solution may therefore depend on compliance systems distinguishing intentional economic interaction from unsolicited contamination. Transaction size, previous wallet relationships, deposit patterns and the customer’s ability to control receipt of the assets could all become relevant to that assessment.

The nearly 12,000 transfers also create a useful real-world test for blockchain analytics providers. Their tools are designed to identify exposure to risky addresses, but the Kraken case asks a different question: whether they can distinguish meaningful sanctions exposure from an adversary deliberately manufacturing that exposure.

HTX’s investigation into the wallet attribution, along with any additional guidance from authorities working with Kraken, could determine whether this remains an isolated operational disruption or becomes a template exchanges need to incorporate into sanctions-screening systems.