Crypto exchange Kraken disclosed two insider-related security incidents involving support staff access to limited client data, followed by an extortion attempt by a criminal group, according to a company statement and comments from its chief security officer.
The firm said no systems were breached and no client funds were placed at risk in either case. Both incidents involved inappropriate access to internal support tools rather than core trading infrastructure, and access was revoked once identified.
Kraken’s Chief Security Officer Nick Percoco said the company is facing demands from attackers who claim to possess videos showing internal systems with client data. The group threatened to release the material unless Kraken complies.
“Our systems were never breached; funds were never at risk; we will not pay these criminals,” Percoco said in a public statement, adding that the company will not negotiate with the actors involved.
Kraken said about 2,000 client accounts were potentially viewed across both incidents, representing roughly 0.02% of its global user base. Affected users were notified, and the company said the exposed information was limited to support data rather than sensitive financial controls.
Multiple security breaches at Kraken
The first incident dates to February 2025, when the company received a tip about a video circulating on a criminal forum. An internal investigation identified a member of the support team as the source of the access. Kraken said it revoked permissions, conducted a review, and implemented additional safeguards.
A second incident emerged later after another tip referenced similar material tied to a different individual. Kraken said it again identified the source, terminated access, and notified impacted users while tightening internal controls.
The situation escalated after the latest access was shut down, when the group behind the videos issued extortion demands. Kraken said the attackers threatened to distribute content to media outlets and social platforms.
The exchange said it is working with law enforcement across multiple jurisdictions and believes there is enough evidence to identify and pursue those responsible. The company also pointed to broader insider recruitment efforts targeting firms across crypto, gaming, and telecommunications.
Security experts have warned that insider threats remain a persistent risk in digital asset markets, where support roles often require visibility into user accounts for troubleshooting. While such access is restricted, it can become a target for coercion or exploitation.
Kraken said it continues to review internal processes, strengthen monitoring systems, and limit access privileges to reduce exposure. The firm emphasized that its core infrastructure remained secure throughout both incidents.
The case comes as the industry faces ongoing security challenges tied to both external attacks and internal vulnerabilities. The combination of high-value assets and global access has made crypto platforms a frequent target for coordinated campaigns.
In a separate disclosure, Galaxy Digital reported a cybersecurity incident involving unauthorized access to an isolated development environment. The firm, founded by Mike Novogratz, said no client data or funds were affected.
Kraken said it will continue cooperating with investigators and industry partners as the case develops. The company framed the incidents as contained events while warning of a wider pattern of insider-focused threats facing technology firms.
