Kraken Refuses Ransom as 2,000 Accounts Exposed in Internal Access Breach

Approximately 2,000 Kraken user accounts were potentially accessed after criminals obtained video recordings of the exchange’s internal support operations during two separate incidents — the first in February 2025, the second more recently. The exposure did not stem from a system breach, and customer assets were never at risk. Still, the incident has triggered a broader alarm over insider threats in the crypto sector.

Kraken’s Chief Security Officer, Nick Percoco, confirmed the exchange is refusing to pay a ransom to prevent the release of the footage, which captures support staff navigating internal customer management systems. “We will not pay these criminals,” Percoco stated. “We will not ever negotiate with bad actors.”

The company has already stopped one blackmail attempt tied to the footage and is working with federal law enforcement to identify those responsible. All potentially affected users have been notified.

The incidents mirror a May 2025 extortion case at Coinbase, where $20 million was demanded after offshore contractors were bribed, exposing 70,000 users. Kraken’s case, however, involved no third-party contractors or financial penetration — only visual access to internal workflows.

Percoco emphasized Kraken is collaborating with industry cybersecurity experts to counter insider recruitment, particularly by groups like the North Korean-linked Lazarus Group, which has placed operatives in crypto, gaming, and telecom firms. The exchange continues to treat customer protection as its highest priority.

Approximately 2,000 Kraken user accounts were potentially accessed through these recordings.