Kraken temporarily restricted a number of customer accounts after nearly 12,000 small cryptocurrency transfers arrived from a wallet that Arkham Intelligence identified as linked to HTX, turning unsolicited deposits worth as little as a few cents into sanctions-compliance alerts.

The transfers ran from August 17 through August 24, with most valued at only a few cents or a few dollars. After reviewing the activity, Kraken restored access to the affected accounts, though it continues to hold any funds covered by sanctions restrictions. That hold mirrors how sanctions regimes generally treat unsolicited funds: once assets traceable to a designated entity land in a wallet, the recipient is expected to freeze and report them rather than spend or forward them, an obligation that applies whether or not the deposit was ever requested.

Kraken characterized the activity as a "dust attack" intended to spread sanctioned funds across other platforms and trip automated compliance controls. The exchange said it does not know who initiated the transfers.

Wallet Attribution Disputed by HTX

Arkham Intelligence linked the sending wallet to HTX using addresses the exchange had previously disclosed through its proof-of-reserves process. That attribution remains disputed by HTX. The exchange denied initiating the transfers and said it is investigating whether the activity resulted from address misattribution or malicious third-party action. HTX had already denied intentionally distributing small transactions when HTX-linked USDT transfers began appearing in unrelated user wallets earlier in August. The dispute also points to a structural tension in onchain attribution: proof-of-reserves disclosures exist so the public can verify an exchange's holdings, yet the same published addresses give analysts — and anyone else — a standing map of wallets treated as exchange-controlled.

Kraken's use of the term "dust attack" differs from the classic form of crypto dusting, in which tiny transactions are sent across addresses to help trace wallet ownership. In this case, the unwanted transfers created compliance exposure because recipients cannot prevent another blockchain address from sending assets into their wallets. The mechanism had already become a concern as sanctions screening tightened around HTX-linked transaction paths, with exchanges increasing scrutiny of deposits and withdrawals connected to flagged address clusters. Mass unsolicited-transfer campaigns are not new — a 2019 dusting sweep targeted hundreds of thousands of Litecoin addresses — but earlier episodes were largely aimed at deanonymizing users rather than pushing sanctioned funds into strangers' wallets.

Transfers Straddled the EU Sanctions Deadline

The eight-day burst crossed a significant regulatory deadline. European Union restrictions covering HTX under Huobi Global S.A. took effect on August 23, one day before the transfer sequence ended. Under the EU sanctions framework, HTX was added to a list of crypto and financial entities subject to transaction restrictions over activity connected to Russia. The designations carry the Huobi name because the exchange rebranded from Huobi Global to HTX in 2023.

The UK had already designated Huobi Global S.A. on May 26. Britain's Office of Financial Sanctions Implementation later clarified that it considers the HTX exchange subject to those sanctions through its ownership relationship with the designated entity.

Exchanges Tighten Controls Around HTX Flows

Kraken said its compliance team moved quickly once legitimate customers were caught by the screening process, and that it is working with authorities to limit further disruption. The sanctioned portion of the incoming funds remains frozen.

Automated risk scoring around HTX has already drawn criticism from onchain investigators. In June, ZachXBT argued that widespread address tagging had made some onchain risk scores less useful, because ordinary wallets can acquire exposure without knowingly interacting with a sanctioned entity. The Kraken episode is a concrete version of that concern: customer accounts were restricted not because of anything the users did, but because of transfers they had no way to refuse.

Binance separately moved to restrict HTX transactions from August 23 in line with the EU measures, alongside restrictions covering EXMO and nine other crypto or payment platforms.