U.S.-based cryptocurrency exchange Kraken briefly locked several user accounts following an influx of roughly 12,000 unsolicited micro-transactions. Sent between August 17 and August 24, 2026, the deposits originated from a digital wallet associated with HTX, a platform subject to United Kingdom and European Union sanctions. While Kraken described the event as a deliberate dusting attack using sanctioned assets, HTX denied initiating the transactions.
Major cryptocurrency exchange Kraken temporarily restricted access to a subset of customer accounts after receiving a wave of thousands of unsolicited micro-transactions.
The small-value deposits came from an external wallet linked to HTX, a platform currently subject to European sanctions regimes. Kraken characterized the incident as a coordinated “dusting attack” intended to trigger automated compliance flags and disrupt user activity.
According to blockchain tracking data, approximately 12,000 micro-deposits were dispatched to Kraken-associated addresses between August 17 and August 24, 2026. The vast majority of the transactions involved trivial amounts ranging from a few cents to a couple of dollars.
The influx affected platform operations and triggered regulatory compliance procedures in the following ways:
- Automated Account Locks: Because the deposits originated from a wallet associated with sanctioned infrastructure, Kraken’s automated anti-money laundering filters temporarily locked affected accounts to review the incoming funds.
- Access Restoration: Kraken’s compliance teams moved quickly to unfreeze customer accounts and restore standard access, though the exchange maintains an ongoing hold on the specific sanctioned tokens.
- Denials from HTX: Representatives from HTX denied sending the funds, stating that the platform did not engage in the activity and suggesting that the wallet address may have been misidentified or manipulated by an unauthorized third party.
Industry security analysts noted that public blockchain networks allow any user to broadcast transactions to arbitrary addresses without recipient consent, making exchange address books vulnerable to low-cost transaction spam.
A dusting attack involves sending tiny amounts of digital currency to numerous wallet addresses. While attackers traditionally use micro-transfers to trace public transaction histories, sending funds from sanctioned entities can artificially contaminate target accounts, forcing compliance systems to intervene.
HTX’s parent entities faced sanctions from both the United Kingdom and the European Union for allegedly facilitating international sanctions evasion. Under existing compliance regulations, centralized crypto platforms must inspect or block assets connected to sanctioned addresses, even when received without the account holder’s knowledge.
The incident highlights a growing operational vulnerability for centralized exchanges, where unsolicited transfers can be weaponized to trigger false-positive regulatory flags. While Kraken restored account functions for most affected users, the exchange continues to work alongside regulatory authorities to mitigate similar disruption tactics in the future.
