
Kraken received 12,000 tiny deposits from wallets linked to sanctioned exchange HTX, triggering temporary account freezes. The attack exploited EU sanctions compliance, not a hack.
Kraken received almost 12,000 tiny deposits between August 17 and August 24, 2026, from wallets that blockchain analytics firm Arkham Intelligence attributes to the sanctioned exchange HTX. The amounts ranged from a few cents to a few dollars. The exchange's automated sanctions screening temporarily froze affected accounts until the checks completed. Access has since been restored, with only the flagged funds still held back, Kraken said.
A Kraken spokesperson told Bloomberg the exchange did not know who was behind the transfers. The senders probably counted on sanctioned funds in a customer account triggering a full account freeze and disrupting operations for many users, the spokesperson said. HTX denies any involvement and says it is examining whether faulty address attribution, an internal process error, or third-party actions caused the transfers.
The technique is known as a dust attack. It sends negligible amounts to trigger compliance checks. In this case, the sender's origin on a sanctions list made the recipient a compliance problem without any action on the customer's part.
Regulation (EU) 2026/1848 added "HTX (HUOBI GLOBAL SA)" to Annex XLV of the Russia sanctions regulation, with an application date of August 23, 2026. From that date, transactions with the platform are prohibited for EU persons and companies. The United Kingdom had already listed Huobi Global S.A. on May 26, 2026, under the Russia (Sanctions) (EU Exit) Regulations 2019. These two legal acts are the reason a payment of a few cents can trigger a freeze.
Kraken continues to hold back about $4.2 million from the episode, according to reports from several trade publications. The exchange has not publicly confirmed the figure, and at least one newsroom flags it as not independently verified. Treat the number as an order of magnitude, not an audited balance sheet item.
The separation matters: account access and flagged funds are handled separately. The remaining balance stays tradable, the marked portion does not. In the worst case, a freeze does not automatically affect your entire wealth, but the marked portion can lie idle indefinitely as long as the legal position is unresolved.
If an unexplained tiny amount appears in your wallet, one rule applies: leave it alone. The dust does no damage as long as it stays untouched. It becomes dangerous the moment you spend it together with the rest of your holdings, because the blockchain then permanently links the dust's origin to your other funds.
With Bitcoin, that comes down to the network's design. Every bitcoin payment is assembled from individual, clearly delimited pieces of balance known as UTXOs. A Bitcoin (BTC) profile explains the mechanism. If you inadvertently include the dust UTXO when paying, its history travels into the new transaction.
Good wallet software lets you choose which pieces of balance a payment may use. This function is called coin control. It lets you keep a marked amount permanently away from your other holdings without deleting it. On an account at an exchange, you do not have that option because the exchange manages the keys and makes the selection itself.
If your account is restricted, the quality of your documentation decides how long that state lasts. Proof of the source of funds for the affected holdings is worth having: purchase confirmations from the exchange, bank statements for the transfer, and for transfers from your own wallet the transaction IDs. For the unsolicited incoming payment, the transaction ID of the inflow with a note that you did not request it and have not moved it on helps the reviewer.
A sanctions review is not a customer service matter that pressure speeds up. The review ends when the assessment is settled.
Two developments will decide whether this episode remains a one-off. The first is the question of authorship: as long as it is open who initiated the transfers, it remains open whether the pattern repeats. The second concerns the other European providers. Kraken is the exchange where the episode became public; that says nothing about whether other platforms received nothing from the same source.
The regulation provides a narrowly drawn exception for anyone still holding funds at HTX or another listed platform. Under the newly added paragraph 4 of Article 5ad, a member state's competent authority may authorise transactions strictly necessary to withdraw funds or close accounts. Each authorisation is granted for a maximum of three months, and the authority has discretion.
Over the coming days, check the incoming lists of your accounts and wallets for amounts you cannot place. Leave them untouched.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.