# Kraken froze accounts over dust. Not your keys, not your coins > Kraken locked some accounts after about 12,000 tiny transfers from an HTX-linked wallet. I use Kraken. I don't leave my stack there. - **Source:** https://ptycoin.com/en/posts/2026-08-25-kraken-dust-attack-self-custody/ - **Published:** 2026-08-25 - **Category:** News - **Author:** Jim Phillips - **Tags:** exchanges, self-custody, wallets, security, compliance, panama - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-08-25-kraken-dust-attack-self-custody/) --- Kraken locked some of its customers out this week because a stranger sent them pennies. [Bloomberg](https://www.bloomberg.com/news/articles/2026-08-25/-dust-attack-on-kraken-shows-challenge-of-policing-crypto-flows) says wallets tagged as HTX sent about **12,000 tiny transfers** to Kraken-related addresses between August 17 and August 24. Cents to a few dollars. Kraken called it a dust attack: drop sanctioned funds into other people's accounts, trip the AML checks, freeze the login. [Cointelegraph](https://x.com/Cointelegraph/status/2092290811849285976) ran the same Bloomberg report later on Tuesday. I said not your keys, not your coins when FTX blew up. I still say it. I don't love being right this way. ## Other people's rules I use Kraken. Last October I tried to deposit so I could buy a dip and the deposit dialog wouldn't even come up. I could have gotten in cheaper. I waited, bought higher, grumbled, and moved on. That's inconvenience. This week some people couldn't log in at all because a wallet they never asked for sent them dust. That's someone else holding the keys. On a public chain anyone can send you coins. There is no consent dialog. You don't get to refuse a UTXO. Dusting works because the network does not ask. When you hold the keys, inbound junk is an annoyance. Polluted coin control, a little privacy leak, a bait paste. You still sign. You still spend. When the coins live on an exchange, that same junk is a compliance event about you. The deposit address is a ledger row inside a company with a bank, a license, a sanctions list, and a robot that flags "HTX-linked" the way a bank flags a wire. The account is one legal object. The dust lands in the same bucket as everything else you hold there. Then the whole login can sit while a human looks at it. A Kraken spokesperson told Bloomberg the dust "originating from HTX-owned wallets appears to be an attempt to spread funds sanctioned by the U.K. and the European Union across other platforms and undermine trust across the industry." They say the senders may have expected the *whole* account to lock. Kraken restored access and is still holding the sanctioned dust. HTX [denies sending the transfers](https://crypto.news/htx-denies-role-in-kraken-linked-poisoning-transfers/). Internal review found no official activity, they said. Maybe the wallet was misidentified. Maybe a third party. Arkham tags it as HTX-linked from an address HTX disclosed in a proof-of-reserves. I don't know which story is true. I don't need to. The freeze happened either way. The sanctions part is not a rumor. Britain designated **Huobi Global S.A.** on [26 May 2026](https://assets.publishing.service.gov.uk/media/6a1578669819be865f421cf1/Sanctions_Notice_Russia_26_May_2026.pdf). Panama company. Vía España, Delta Bank Building, 6th floor, folio 155737650. HTX is on the name list. Asset freeze. The EU followed in July, with a [transaction ban from 23 August](https://decrypt.co/374245/eu-names-justin-suns-htx-in-russia-sanctions-two-months-after-uk). HTX says the Panama company is distinct from the live exchange. OFSI says ownership is enough. A listing in London became a freeze in San Francisco for people who never opened an HTX account. Vía España is a real street. We have been a brass-plate jurisdiction for as long as I have lived here. Crypto just made the consequences faster. Kraken is not uniquely evil. They take UK and EU rules seriously, so they freeze first. A shop that doesn't will freeze you for some other reason, or fail. I watched [AscendEX](/en/posts/2026-07-10-ascendex-shutdown-mica-liquidity/) go dark in July with manual withdrawals and no guarantees. I was around for [Mt. Gox](https://www.reuters.com/investigates/special-report/bitcoin-gox/) too. They halted withdrawals in February 2014. Then the site went blank. Then bankruptcy in Tokyo. Creditors waited ten years. Different failure. Same problem: someone else has the keys. They will try. A hack, a bankruptcy, a regulator, a support ticket, a stranger's pennies. Believe me, they will try. ## What I didn't take I use exchanges. I used to run one in Panama. They turn local money into coins and coins back into local money. That is a job. It is not a home. Advice I have given clients for years: withdraw as soon as you can. Don't leave earnings sitting there waiting for a better day. Self-custody is the same move I made with mail this week. [It isn't a switch you flip](https://ergophobia.org/posts/2026-08-25-self-sovereignty-is-a-dial/). Generate the keys on a device you own. Write the words down. Keep them in a safe place. Sign on that device. If you can, talk to a node you run. Then you aren't asking someone else's server which coins are yours. Camila has the walkthrough if you want the steps: [Self-Custody 101](/en/posts/2026-06-05-self-custody-101-moving-crypto-off-exchange/), [seed phrases](/en/posts/2026-06-23-seed-phrases-explained/), [hardware wallets](/en/posts/2026-06-09-hardware-wallet-form-factors-latam/). I still buy and sell on someone else's books. Last October that someone else was Kraken, and their UI died on me. I still own BTC as a store of value. I still depend on miners, on whoever made the signer, on a block explorer I didn't write. The rest of the network still gets a vote. I don't pretend a hardware wallet makes me independent of all of that. If the savings sit on Bitso, Decrypto, Ripio, or a casa de cambio with an API, you are in the same machine. Change the app, keep the same key holder, same freeze. Brazil will make large withdrawals slower too. From January 2027, [Resolução BCB nº 584](/en/posts/2026-08-13-brazil-bcb-584-24h-hold-jan-2027/) puts a 24-hour hold on transfers of that size out of a VASP toward self-custody or a foreign platform. This week's dusting froze people on deposits. Both only work if you still live at the intermediary. ## The trade Use an exchange to buy and to sell. Leave a working balance if you trade. Move what you mean to keep. Savings do not belong in a compliance queue. Kraken restored the accounts. That's good customer service. Access was still theirs to restore. Next time the dust comes from a wallet tagged for a different list, or the review takes a week, or you need the money on a Tuesday while the ticket sits in a queue, "we restored it" is not the sentence you wanted. Self-custody has its own failure modes. Lose the words and the coins are gone. Get phished and they are gone. If you can't do that one simple thing, write the words down and keep them, you have no one to blame but yourself. I want people to respect the sovereignty of the individual. That includes who holds their coins. I still use other people's computers to buy. I don't leave the stack there. **Sources** - [Bloomberg, "'Dust Attack' on Kraken Shows Challenge of Policing Crypto Flows" (25 August 2026)](https://www.bloomberg.com/news/articles/2026-08-25/-dust-attack-on-kraken-shows-challenge-of-policing-crypto-flows) - [Cointelegraph on X (25 August 2026)](https://x.com/Cointelegraph/status/2092290811849285976) - [crypto.news, "HTX denies role in Kraken-linked poisoning transfers" (20 August 2026)](https://crypto.news/htx-denies-role-in-kraken-linked-poisoning-transfers/) - [UK OFSI sanctions notice, Russia, 26 May 2026, entry for Huobi Global S.A. (RUS3619)](https://assets.publishing.service.gov.uk/media/6a1578669819be865f421cf1/Sanctions_Notice_Russia_26_May_2026.pdf) - [Decrypt, "EU Names Justin Sun's HTX in Russia Sanctions, Two Months After UK" (24 July 2026)](https://decrypt.co/374245/eu-names-justin-suns-htx-in-russia-sanctions-two-months-after-uk) - [Reuters, "Twice burned: How Mt. Gox's bitcoin customers could lose twice" (16 November 2017)](https://www.reuters.com/investigates/special-report/bitcoin-gox/) --- ## Keep reading - [How to practice a seed phrase restore before you need it](https://ptycoin.com/en/posts/2026-08-18-practice-seed-phrase-restore/index.md): A written seed phrase is only a backup after you prove it restores the same wallet. Practice the restore on a spare or wiped device before real funds depend on it. - [How to spot phishing and fake wallet apps before you sign](https://ptycoin.com/en/posts/2026-08-11-spot-phishing-fake-wallet-apps/index.md): Fake wallet apps, lookalike sites, and urgent “support” chats steal seeds and signatures. Use this checklist to verify downloads, URLs, and WalletConnect sessions before you sign. - [Self-custody without a single point of failure](https://ptycoin.com/en/posts/2026-08-10-self-custody-without-single-point-of-failure/index.md): A hardware wallet can generate a key badly. Build a self-custody setup that survives a vendor bug: verified backups, your own entropy, passphrases, and multi-vendor multisig. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-08-25-kraken-dust-attack-self-custody/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/