HTX dust attacks Kraken as 12,000 transfers collide with EU sanctions

Nearly 12,000 unsolicited crypto transfers slammed into addresses linked to Kraken over just eight days in August, triggering a wave of account freezes and reviving a thorny question for the entire exchange industry: what happens when sanctioned money shows up in your wallet without anyone asking for it. The episode, first reported by Bloomberg, has turned into a case study on how exchanges police crypto flows tied to sanctioned entities, with attribution to HTX remaining disputed.

Key takeaways

• Nearly 12,000 unsolicited transfers reached Kraken-linked addresses between August 17 and 24, 2026, according to Bloomberg.
• Kraken temporarily restricted affected accounts, then restored access while keeping the disputed funds held separately.
• Arkham Intelligence tied the sending wallet to HTX, but that labeling does not prove HTX controlled the transfers.
• HTX denied initiating the transactions and is investigating possible misattribution or third-party misuse of its wallets.
• EU sanctions against HTX’s Huobi Global entity took effect on August 23, 2026, right in the middle of the transfer window.

Kraken Experiences Nearly 12,000 Unsolicited Crypto Transfers

Kraken temporarily locked down customer accounts after a flood of small, unrequested deposits hit addresses connected to the exchange, and the scale of the incident is what set it apart from routine spam transfers.

Timeline and Scale of Transfers

Bloomberg reported on August 25 that nearly 12,000 transfers arrived between August 17 and August 24, 2026. That’s roughly 1,500 unsolicited deposits a day landing on Kraken-linked wallets over the course of a week, an unusually high volume for what typically shows up as background noise on a blockchain.

Kraken’s Response to the Incident

Kraken’s initial move was blunt: restrict the accounts that received the tainted funds while it figured out what it was dealing with. The exchange later restored access to those accounts once its reviews wrapped up, but it kept the disputed money segregated because of its reported ties to sanctioned wallets. A Kraken spokesperson described the episode as an apparent attempt to “spread U.K.- and EU-sanctioned funds to other platforms,” while also admitting the exchange could not pin down who actually sent the transactions. Kraken has not disclosed how many customers were affected, how long the reviews took, or the total value of the funds it’s still holding, and its public status page never listed a platform-wide outage tied to the event.

Disputed Wallet Attribution and HTX Denial

The wallet behind the transfers has been publicly linked to HTX, but that link is far from a settled fact, and HTX itself is pushing back hard against the accusation.

Arkham Intelligence’s Attribution to HTX

Blockchain analytics firm Arkham Intelligence labeled the sending wallet as connected to HTX, drawing on addresses the exchange had previously disclosed through its proof-of-reserves reporting. That’s a meaningful clue, but it’s not proof. Wallet labeling based on historical disclosures shows an address once belonged to the HTX ecosystem — it doesn’t establish who was pulling the strings when each individual transfer went out.

HTX’s Investigation and Denial of Involvement

HTX flatly denied sending the funds. A spokesperson said the exchange “absolutely did not engage in such behaviour” and is now looking into whether the activity stemmed from labeling mistakes, an internal operational mix-up, or a malicious third party abusing HTX-associated wallets. Notably, similar small transfers reportedly reached addresses tied to Coinbase and Binance before Kraken flagged its own case, and HTX said an internal review turned up no official accounts or testing systems responsible. HTX has not published a full address list or transaction breakdown to back up its version of events, so the ownership question around the sending wallet remains open. There is also no sign yet of a joint investigation between Kraken and HTX to settle it.

Sanctions Context and Compliance Challenges

The timing of the transfers lines up almost exactly with a tightening sanctions net around HTX, and that overlap is what turned a batch of dust deposits into a genuine compliance headache.

EU and UK Sanctions Targeting HTX

The United Kingdom designated Huobi Global S.A. under its Russia sanctions regime on May 26, 2026, imposing an asset freeze and restrictions on processing payments tied to the entity. HTX disputed how broadly that designation applied, arguing Huobi Global S.A. is legally distinct from its trading platform. Then came the EU: Brussels added HTX, identified as Huobi Global S.A., to a list of crypto service providers covered by a transaction ban, with the restriction taking effect on August 23, 2026 — just one day before the wave of transfers to Kraken tapered off. That timing meant deposits sent right before and after the EU crypto sanctions took hold were bound to draw extra scrutiny from compliance teams. Separately, blockchain researcher TRM Labs had previously reported that HTX repeatedly rotated its wallets following the UK designation, something HTX characterized as routine security practice rather than an attempt to dodge sanctions.

Implications for Crypto Exchanges and Compliance Poisoning

This is where the story stops being about one exchange and starts being about the entire industry’s compliance plumbing. Traditional dust attacks send tiny amounts of crypto to track wallet owners across the blockchain. What happened to Kraken looks more like compliance poisoning — deliberately or accidentally distributing unwanted funds to create sanctions exposure or simply overwhelm the automated screening systems exchanges rely on. The uncomfortable truth is that a transaction can land on a public address without the recipient’s permission or even awareness, and there’s little an exchange’s customers can do to stop an unknown sender before screening kicks in. That forces platforms to weigh transaction value, ownership history, timing, and customer behavior rather than treating every unsolicited deposit as proof of an intentional violation. Centralized stablecoin issuers offer one point of comparison: Tether, for instance, froze more than $500 million across 370 addresses in a single 30-day stretch, showing how token-level freezes can act faster than wallet-screening alone. Neither Kraken nor HTX has set a timeline for resolving the dispute, and any real clarity will likely depend on wallet-level evidence identifying the true sender or fresh guidance from UK and EU sanctions authorities.

FAQ

What triggered Kraken to restrict customer accounts in August 2026?

Kraken restricted accounts after nearly 12,000 unsolicited cryptocurrency transfers reached Kraken addresses between August 17 and 24, 2026, with the sending wallet attributed to HTX by Arkham Intelligence, though attribution remains disputed.

Did HTX admit to sending the dust transfers to Kraken?

No, HTX denied initiating the transfers and is investigating the possibility of misattribution or malicious third-party actions.

How do EU and UK sanctions relate to the Kraken incident?

EU sanctions against HTX’s Huobi Global took effect on August 23, 2026, amid which small transfers attracted heightened compliance scrutiny; the UK designated Huobi Global under Russia sanctions earlier, on May 26, 2026.

What is “compliance poisoning” in the context of cryptocurrency exchanges?

Compliance poisoning refers to sending unsolicited sanctioned funds to exchanges to create sanctions exposure or overwhelm automated compliance screening systems.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.