Kraken Insider Leak Exposes 2,000 Crypto Accounts
- Two recruited Kraken support staff exposed ~2,000 user accounts before dismissal
- No funds were stolen — the breach was limited to KYC data and transaction records
- Crypto casino players who use Kraken to fund gambling accounts should monitor for targeted phishing
- The attack mirrors a 2025 Coinbase insider breach — a growing pattern against support staff
No funds were at risk and the exchange's core systems were not compromised, but the incident points to a growing pattern of insider-recruitment attacks targeting crypto exchanges.
What this means for crypto casino players
Casino players routinely use Kraken to purchase Bitcoin, XRP, Ethereum, and other coins before depositing at crypto gambling platforms. The data accessed in this incident — particularly transaction histories and know-your-customer (KYC) documentation — could reveal those gambling-linked transfers to whoever controls the criminal network behind the extortion attempt. Players can review security-conscious platform options on our best crypto casino guide for US players.
For the roughly 2,000 affected accounts, the most sensitive exposure is the combination of government-issued ID and transaction history. KYC documents can be used in identity fraud; transaction records that show regular withdrawals to casino deposit addresses could be used for targeted phishing or individual extortion — the same approach now being directed at Kraken as a company. Players who want to reduce their exchange-side footprint can use a self-custody wallet as an intermediary step between the exchange and a casino platform.
How the insider recruitment worked
Kraken's Chief Security and Information Officer Nick Percoco disclosed that the first incident came to light in February 2025, when footage of Kraken's internal support tools appeared on criminal forums. The exchange traced the source to a single support employee who had been recruited by an organised criminal network, granting read-only access to customer records. A second, separate incident was identified more recently, and the company estimates around 2,000 accounts were affected across both events. The accessed data included KYC records, transaction histories, and support ticket content — not withdrawal permissions or private keys.
This recruitment model mirrors an insider attack on Coinbase in 2025, where social engineering similarly extracted customer records without any direct breach of core infrastructure. Security analysts note that criminal networks are increasingly targeting exchange support staff rather than technical systems, as employees with legitimate access are easier to compromise than hardened authentication layers.
“We will not pay these criminals. We will not ever negotiate with bad actors.” — Nick Percoco, Kraken Chief Security and Information Officer
What to watch
Federal investigators are working with Kraken to identify and prosecute those involved. If the stolen data is sold or circulated rather than held purely for exchange-level extortion, affected users may receive phishing messages that reference specific transaction details or KYC documents to appear credible. Players with Kraken accounts should enable hardware-key two-factor authentication — a hardware security key is significantly harder for insider access to circumvent than SMS-based codes — and treat any unsolicited contact claiming knowledge of their account history with immediate suspicion.