Kraken Says ‘Dust Attack’ From Sanctioned HTX Wallet Locked Out Customers

A few cents of crypto showing up uninvited in your account sounds harmless. At Kraken this week, it was enough to get thousands of accounts frozen.

Between August 17 and August 24, wallets linked to HTX, the exchange formerly known as Huobi, sent roughly 12,000 tiny transfers, most worth only a few cents to a few dollars, to addresses on Kraken. The EU sanctioned HTX in July over allegations it helped Russian entities evade sanctions, and Kraken’s compliance systems are built to automatically freeze any account that receives sanctioned funds, no matter how small the amount. That automatic response is exactly what triggered the lockouts: a flood of unsolicited micro-deposits from a sanctioned wallet tripped compliance holds across a large number of customer accounts simultaneously.

This is a dust attack, a technique normally associated with trying to de-anonymize wallets by tracking what recipients do with tiny unsolicited deposits. Kraken says the apparent goal here was different: using its own sanctions-screening rules against it, deliberately spreading small amounts of tainted funds to trigger compliance freezes at scale rather than to trace anyone. HTX denies directing the transfers itself and says it’s investigating, suggesting the activity may have originated from a third party rather than the exchange.

Kraken has since restored access for affected users while keeping the sanctioned funds themselves frozen, as required. The bigger issue exposed here isn’t really about Kraken specifically: any exchange with an automatic sanctions-freeze system is vulnerable to the same trick, since the rule that’s supposed to protect against sanctioned money can be weaponized simply by sending it to someone else’s account instead of your own.

Want to understand how crypto sanctions screening and compliance systems actually work? Learn more in the Bitcoin Academy.