Kraken Refuses Extortion Demand After Insider Data Leak Affected 2,000 Accounts

Highlights:

• Kraken rejected an extortion attempt after insider-related incidents exposed limited support data from 2,000 accounts.
• The exchange said its core systems stayed secure, and customer funds were never at risk.
• Kraken linked the case to insider misuse, not hacking, and is working with law enforcement.

Crypto exchange Kraken said it is facing an extortion attempt after two insider-related incidents exposed limited client support data tied to about 2,000 accounts. The crypto exchange said its main systems were never breached, customer funds were never at risk, and it will not meet the criminals’ demands. Chief Security Officer Nick Percoco disclosed the update on Monday, saying the company is already working with federal law enforcement across multiple jurisdictions. 

According to Kraken, the issue did not involve a hack of its core exchange infrastructure. Instead, the company linked the case to improper internal access involving support staff.

Percoco said a criminal group is threatening to release videos that allegedly show Kraken’s internal systems with some client data visible unless the exchange complies. He said the company will not pay and will not negotiate with bad actors.

Kraken Security Update

We are currently being extorted by a criminal group threatening to release videos of our internal systems with client data shown if we do not comply with their demands. It’s important to start with the most important points: our systems were never…

— Nick Percoco (@c7five) April 13, 2026

Two Insider-Related Incidents Led to a Data Leak

Kraken reported that the first incident was discovered in February last year after receiving a tip about a video on a criminal forum. The video seemed to show an employee from the support team misusing internal client support tools. The exchange stated it promptly identified the staff member, revoked that person’s access, started an internal investigation, implemented stronger controls, and reached out directly to affected clients.

Later, Kraken said it received another tip and found a second video showing similar activity. The company said it again identified the person involved and immediately revoked access. Across both cases, Kraken said around 2,000 client accounts were potentially viewed. That works out to roughly 0.02% of its client base, based on the company’s own figures.

Soon after Kraken blocked the latest unauthorized access, the exchange said the same criminal group began sending extortion demands. According to Kraken, the group threatened to spread material tied to both incidents through the media and across social platforms.

Kraken’s leadership responded with a firm stance. Rather than pay, Kraken said it is working with federal law enforcement in several jurisdictions. 

Kraken Says No Funds Were At Risk

Kraken stressed that client funds were never at risk. The company said it did not suffer a system breach and linked the incident to misuse of internal access, not an attack on wallets or trading systems. The exchange also said it has collected evidence it believes could help authorities identify and prosecute those behind the case. 

Because the investigation is still ongoing, Kraken said it cannot share more details right now. The exchange added that anyone with relevant information is encouraged to contact the company directly. Kraken said it had already reached out to any client who might have been affected.

Nick Percoco said:

“The security of our clients is our highest priority, and we remain fully committed to combating the growing global threat of insider recruitment and constantly enhancing our security practices to combat new threats.” 

Kraken also said it believes the case may be part of a wider insider recruitment effort targeting crypto, gaming, and telecom companies.

This case shows that insider risk is becoming a bigger concern in crypto. A similar case surfaced last year when Coinbase said overseas support contractors sold customer data tied to about 69,000 accounts.

I am a long time investor in and champion of @coinbase. Something that has to be said though – this hack – which includes home addresses and account balances – will lead to people dying. It probably has already. The human cost, denominated in misery, is much larger than the $400m… pic.twitter.com/ruSYKAGH7x

— Michael Arrington 🏴‍☠️ (@arrington) May 19, 2025