TLDR
- Criminals are demanding payment from Kraken in exchange for not releasing recorded footage of the exchange’s internal operations
- Chief Security Officer Nick Percoco stated that no system compromise occurred and customer assets remain secure
- Approximately 2,000 user accounts may have been accessed during two separate events in February 2025 and recently
- Federal authorities are involved in the investigation, with Kraken successfully stopping one blackmail attempt already
- In May 2025, Coinbase experienced a comparable extortion scenario involving approximately 70,000 users and a $20 million ransom demand
Cryptocurrency exchange Kraken has publicly declined to meet the demands of cybercriminals who acquired recordings of the platform’s internal operations and are threatening public disclosure. The company’s Chief Security Officer, Nick Percoco, shared this information via X on Monday.
According to Percoco, the threat actors captured video footage showing Kraken’s support personnel navigating internal customer management systems. This material is now being used as a bargaining chip to extract an undisclosed sum from the exchange.
“We will not pay these criminals,” Percoco declared. “We will not ever negotiate with bad actors.”
The exchange has verified that no complete system penetration took place. At no time were user assets endangered throughout either occurrence.
This case involves two distinct events. The initial incident took place in February 2025, when evidence suggests a Kraken support staff member recorded internal platform activity. A subsequent incident displaying comparable characteristics happened more recently.
In response to both situations, Kraken moved swiftly to detect the danger and terminate unauthorized access. The organization reports successfully neutralizing one extortion effort linked to these activities.
Roughly 2,000 user accounts on Kraken’s platform were potentially accessed during these two separate events. The exchange has notified all individuals who might have been impacted.
Federal Law Enforcement Involved
Kraken has engaged federal law enforcement agencies to pursue the criminal organization. Percoco indicated that the ongoing investigation may result in apprehensions.
The platform is simultaneously coordinating with cybersecurity specialists across the industry. Percoco noted the company is partnering to “investigate and disrupt insider recruitment efforts” that target cryptocurrency, gaming, and telecommunications firms.
Internal security threats have emerged as an escalating concern throughout the digital currency sector. The North Korean-linked Lazarus Group has gained notoriety for infiltrating operatives into legitimate organizations, with security researchers documenting at least 60 confirmed Lazarus-connected developers working within crypto ventures.
Coinbase Faced a Similar Attack
Kraken isn’t the only prominent exchange to confront this type of extortion. During May 2025, Coinbase revealed that cybercriminals demanded $20 million to prevent the release of customer information.
That security incident impacted approximately 70,000 customers and stemmed from bribes given to offshore customer service contractors.
Overall cryptocurrency security incidents have shown an upward trend. According to blockchain analytics company Nominis, losses exceeded $178 million across major crypto breaches in March 2026, representing a significant jump from the $49.3 million recorded in February.
Authorization exploitation emerged as the predominant attack vector during March, with targets inadvertently approving transactions that granted hackers complete control over their digital assets.
Percoco emphasized that protecting Kraken’s customers remains the platform’s “highest priority” and that the organization continuously enhances its protective measures against evolving threats.


