Kraken temporarily restricted a number of customer accounts after nearly 12,000 tiny cryptocurrency transfers triggered compliance reviews across its platform. Most of the transactions, which occurred between August 17 and 24, were worth only a few cents or a few dollars. According to Kraken, the activity appeared designed to distribute sanctioned funds across unrelated accounts and provoke compliance checks.

Accounts Restored After Compliance Reviews

Kraken initially locked the affected accounts after its anti-money laundering and sanctions systems flagged the incoming transfers. This freeze-first, review-later approach is standard practice for regulated platforms, since sanctions regimes such as those administered by the U.S. Office of Foreign Assets Control, the EU, and the UK generally require firms to block assets linked to designated parties pending investigation, with penalties for non-compliance. The exchange later restored customer access after reviewing the transactions and determining the circumstances surrounding each account.

The disputed funds remain held separately, however, because they may involve sanctioned entities under applicable requirements. Kraken says it is coordinating with relevant authorities while monitoring for additional transfers.

Kraken described the incident as a "dust attack," although the campaign differs from traditional dusting tactics. Rather than primarily targeting wallet privacy, the activity appears intended to exploit cryptocurrency compliance procedures. Because public blockchains allow external parties to send assets to any address without the recipient's approval, malicious actors can create compliance problems for customers simply by sending them restricted assets.

The scale of the operation also posed an operational challenge: nearly 12,000 transactions required screening, increasing compliance workloads and affecting customers who never intentionally interacted with sanctioned funds.

🚨𝗝𝗨𝗦𝗧 𝗜𝗡: Kraken temporarily locked some customer accounts after nearly 12,000 tiny crypto transfers from a wallet linked to sanctioned exchange HTX triggered compliance checks. pic.twitter.com/kpE9pSF2LB — DustyBC Crypto (@DustyBC) August 25, 2026

HTX Denies Responsibility as Attribution Remains Unclear

Blockchain analytics firm Arkham Intelligence identified the sending wallet as connected to HTX, formerly known as Huobi. Wallet attribution alone, however, does not establish who controlled the address at the time of the transfers. HTX denied initiating the transactions and said it is investigating possible address misattribution or malicious third-party activity. The identity and motive of the sender therefore remain unresolved.

The incident carries additional weight because sanctions involving HTX-related entities have recently intensified. The European Union's restrictions concerning Huobi Global S.A. took effect on August 23, shortly before the transfer campaign ended, while the United Kingdom designated Huobi Global S.A. under its Russia sanctions regime earlier this year. Those measures included asset-freezing obligations and restrictions on transactions involving the designated entity.

Compliance Poisoning as an Emerging Risk

Traditional dusting attacks expose wallet relationships by encouraging users to combine small deposits with other holdings, allowing attackers to use blockchain analysis to map addresses and potentially identify their owners. The Kraken incident highlights a different risk: compliance poisoning, in which unsolicited sanctioned transfers create regulatory exposure for legitimate users without the attacker needing to compromise exchange systems.

The episode underscores a difficult balance for cryptocurrency exchanges, which must enforce sanctions while distinguishing between deliberate transactions and unwanted blockchain transfers that customers cannot prevent. It also points to an open design question for the industry: whether exchanges adopt automated screening and rapid-review workflows that can absorb unsolicited transfer campaigns at scale without prolonged customer lockouts. As investigations continue and attribution remains unresolved, the incident demonstrates how permissionless blockchain infrastructure can create new operational challenges for regulated cryptocurrency platforms and their customers.