Kraken Refuses Ransom After Insider Leaks Affect 2,000 Accounts

Approximately 2,000 Kraken clients, representing 0.02% of the user base, had their customer support interaction data exposed after internal staff misused company systems. The exchange refused to pay a ransom to criminals who threatened to leak internal videos and user fragments to the media and social media.

Chief Security Officer Nick Percoco reported that the incident stemmed from insider misuse of internal support systems designed for customer service teams. These systems contain account-related information but are separate from the exchange's core infrastructure. The misuse was discovered after footage of internal tools being accessed began circulating on criminal forums.

Percoco detailed two separate instances of staff leaks. One occurred in February 2025 and was discovered after a tip-off. A second, more recent breach occurred similarly. In both cases, Kraken revoked the staff members' access and implemented additional security controls.

Following the termination of access, the perpetrators shifted to extortion. Kraken has since escalated the matter to federal law enforcement across multiple jurisdictions to pursue the individuals involved. The exchange maintains that client funds and private keys remained secure throughout the incident.