Kraken Cryptocurrency Exchange Hit by 12,000 Microtransactions from HTX-Linked Wallets, Triggering Automatic Account Freezes

Coin Circle (120btc.CoM): From August 17 to 24, the cryptocurrency trading platform Kraken suffered a large-scale dust attack, resulting in temporary freezes of some front-end user accounts. Monitoring by blockchain data analysis firm Arkham Intelligence revealed that this batch of abnormal data flows originated from HTX-linked wallet addresses, which are on the EU sanctions list. Attackers sent nearly 12,000 microtransactions to Kraken's associated addresses, with individual amounts ranging from a few cents to several dollars.

In a statement disclosed to external media, Kraken emphasized that such high-frequency trading is a malicious action that has been meticulously planned. The perpetrators aimed to exploit sanctioned funds to contaminate the accounts of ordinary customers, thereby triggering the platform's built-in automated anti-money laundering and account freeze mechanisms.

The underlying logic of this method takes advantage of the transparency and permissionless interaction of public blockchain data. Without the need for recipient authorization to verify identity, anyone can send on-chain assets to a designated public address. Malefactors exploit this feature to widely disseminate data flows with compliance stains to a vast number of ordinary addresses. Once these sanctioned assets interact on-chain with compliant users' addresses, the trading platform's anti-money laundering alert engine automatically raises alarms. Under relatively stringent risk control strategies, the system often prioritizes cutting off account permissions, leading to innocent users being passively drawn into a lengthy background review process. This act of weaponizing sanction screening effectively distorts the normal risk control defense line into an attack vector, shifting the enormous compliance friction costs onto the platform and retail investors.

Establishing Involuntary Reception Determination

In response to the sudden large-scale data contamination, Kraken's risk control department quickly initiated an emergency response:

• For accounts that were flagged as abnormal and temporarily locked on the first day, risk control personnel restored access and trading permissions as soon as compliance checks confirmed no risks.

• For the sanctioned funds flowing into the platform, the official took hard measures to continuously withhold them, cutting off their channels to user accounts.

• The platform is actively coordinating with relevant law enforcement agencies to collaboratively investigate and block the attackers' subsequent schemes.

Although the platform's intervention actions were relatively swift, the trading experience of some end users still faced substantial disruptions. This case also exposed a core pain point: in an ecosystem where on-chain funding paths are highly transparent, the automated risk control engine of trading platforms urgently needs to establish a more precise involuntary reception identification model to avoid misidentifying normal transactions.

In response to being caught up in this incident, HTX (formerly Huobi, now advised by Tron co-founder Justin Sun) made a public clarification. After internal review and verification, the platform stated that no official accounts participated in or led the sending of the related microtransactions, and it is currently investigating whether the related outgoing wallets suffered from mislabeling or were maliciously manipulated by third parties.

Tracing the macro compliance background, HTX has recently faced increasing external regulatory pressure. In May 2026, UK authorities froze HTX's assets on the grounds of allegedly providing financial channels for Russian-related payment networks and sanctioned trading platform Garantex (HTX has denied these allegations). Subsequently, in July 2026, the EU included it in a broader ban list on Russian cryptocurrency industry transactions. This ban officially took effect on August 23, 2026, coinciding closely with the timing of this intensive micro-pollution attack.

Rule Engine Faces Reconstruction

Using sanctioned digital assets as an attack vector is not an isolated incident in the industry. As early as 2022, anonymous individuals extracted funds from the sanctioned mixing protocol Tornado Cash and directed them to the public addresses of multiple public figures. At that time, US law enforcement agencies stated that they would not prioritize legal actions against recipients of such involuntary and small amounts of passive reception behavior for delayed reporting. Even though regulatory authorities have recognized the potential threat of dust attacks being abused, in practice, the automated filtering programs of trading platforms are often more rigid than official guidelines, making innocent users easy victims of algorithmic misjudgment.

From a broader industry perspective, this incident reflects three evolving trends in the compliance field:

• Balancing automated risk control and misidentification risks: In the face of massive microdata attacks, screening systems relying on fixed rule engines struggle to efficiently distinguish between subjective reception and malicious poisoning. Future risk control architectures must incorporate deep analysis models based on multi-dimensional on-chain behavioral characteristics, rather than solely relying on static funding source labels.

• The weaponization of compliance tools: Using tainted assets as weapons in cyber warfare has become a new form of asymmetric attack in the on-chain ecosystem. Regardless of whether HTX is involved, this method of operation is likely to be emulated by other sanctioned entities.

• Lack of investor education: The vast majority of cryptocurrency market participants are unaware of the account freeze risks associated with receiving unknown airdrops or micro-funds. Trading platforms should establish preemptive blocking and immediate notification mechanisms when accounts encounter suspicious small incoming transfers, rather than waiting until account freezes to notify users.