Kraken “identified and shut down” two improper employee accesses to customer data.
Customer funds were not at risk in either incident, according to Kraken.
The cryptocurrency exchange Kraken reported that it is being extorted by a criminal group that threatens to distribute videos of its internal systems with customer data if it does not comply with its demands. Nick Percoco, head of security at the exchange, published a statement on April 13 in which he confirmed the facts and refused to negotiate: “We will not pay these criminals. “We will not negotiate with malicious actors.”
The manager’s statement revealed two elements. On the one hand, “Kraken identified and closed “two instances of inappropriate access to limited customer support data”Percoco explained. One of them occurred in February 2025 and the second more recently, without a specified date.
On the other hand, the existence of a criminal group that has videos that show these accesses and that he uses that material to extort the exchange.
Percoco, however, did not explain in its statement how this material came into the hands of the criminal group or whether the employees acted in coordination with the extortionists, acted on their own behalf or if the material reached third parties through some other channel.
What was and was not at risk
According to Percoco, in both cases of improper access by employees, Kraken took knowledge because it received notices about videos circulating on criminal forums showing access to its support systems. After investigating each one, the exchange identified the employee involved, revoked their access, and notified affected customers.
In total, approximately 2,000 customer accounts0.02% of the exchange’s user base, were potentially seen between both accesses.
Percoco clarified that Kraken’s systems were not compromised from the outside and the Client funds were not at risk at any time.
Finally, Kraken noted that collaborates with industry partners to research internal recruitment efforts of malicious actors, which suggests that this is one of the hypotheses they are investigating, although without confirming it.
Percoco stated that Kraken works with federal authorities in multiple jurisdictions and that there is “sufficient evidence” to identify and arrest those responsible, without detailing what that evidence consists of or offering a timeline for legal action.