Kraken’s chief security officer disclosed an extortion attempt in which an unnamed group threatened to release videos of internal systems showing client data. The exchange says its systems were not breached, user funds were not at risk, and it is working with federal law enforcement while refusing to negotiate or pay.

Key Takeaways

• An unnamed group attempted to extort Kraken by threatening to release videos of internal systems with client data visible, the exchange’s security chief said.
• Kraken says its systems “were never breached,” and it does not view user funds as being at risk from the extortion attempt.
• Two separate “inappropriate access” incidents to client data were identified, spanning February 2025 and a later event, affecting about 2,000 accounts in total.
• Federal law enforcement is involved in the investigation, and Kraken has indicated the process could lead to arrests.

Kraken Discloses Extortion Threat Involving Internal-System Videos

Kraken chief security officer Nick Percoco said an unnamed criminal group attempted to extort an unspecified amount from the exchange by “threatening to release videos of our internal systems with client data shown.” The disclosure frames the episode as a coercion attempt centered on data visibility rather than a classic hot-wallet drain.

For traders, the immediate market relevance is less about solvency and more about operational risk. Even when funds are not reported stolen, the prospect of client-data exposure can change user behavior fast, from deposit hesitancy to accelerated withdrawals, which can matter for venue liquidity at the margin.

Kraken’s Stance: No Breach, No Funds at Risk, No Negotiation

Percoco said Kraken’s systems “were never breached” and that user funds were not at risk from the extortion attempt. He also laid out a hardline response policy: “We will not pay these criminals,” and “We will not ever negotiate with bad actors.”

That posture matters because it signals Kraken is optimizing for deterrence and process control, not speed of resolution. In practice, a no-payment stance tends to shift the next meaningful updates away from “restitution” headlines and toward investigative milestones, internal controls, and any downstream user-protection steps.

Two “Inappropriate Access” Incidents and the ~2,000-Account Scope

Percoco said Kraken identified two incidents involving “inappropriate access” to client data, one in February 2025 and another “more recently,” affecting about 2,000 user accounts in total. The disclosure introduces a concrete scope number for client-data exposure risk, but it leaves key details open.