Kraken Faces Extortion Threat Tied to Insider Security Incidents

• Kraken said insider-linked videos were used in an extortion attempt over client data.
• The exchange said no systems were breached, and customer funds were not at risk.
• Kraken is working with law enforcement after 2,000 accounts were viewed.

Kraken is dealing with an extortion attempt tied to insider-related security incidents, according to Chief Security Officer Nick Percoco. In an X post on Monday, he said a criminal group is threatening to leak internal videos unless the exchange makes a payment.

Percoco said the group obtained videos showing Kraken support staff accessing internal client support systems and limited client data. He said the attackers are using those recordings as leverage in an attempt to force payment from the company.

Kraken Responds to Insider-Linked Extortion Threat

Kraken said no systems were breached. It also said customer funds are not at risk. Percoco stated that the exchange will not negotiate with bad actors under any circumstances.

The company is now working with federal law enforcement and industry security experts. Percoco said Kraken has already shut down one extortion attempt. He added that the exchange is continuing to respond to the threat as the case develops.

The incidents appear to have happened in two separate cases. One took place in February. According to Percoco, it appears that a member of Kraken’s support team filmed internal systems during that earlier event.

A second case followed more recently. Kraken said it showed a similar pattern of internal access. In both cases, the company said it acted quickly to identify the internal threat and remove access.

Kraken said around 2,000 accounts were potentially viewed in the incidents. The exchange said it has contacted affected users. It did not describe any direct loss of funds or breach of core trading systems.

Percoco said the security of clients remains the company’s top priority. He also said Kraken remains committed to fighting insider recruitment threats. 

Kraken said it is working with others to investigate insider recruitment efforts targeting not only crypto firms but also gaming and telecommunications companies. That detail suggested the company sees the case as part of a wider campaign rather than an isolated event.

Insider Threats Deepen Across Crypto

The incident adds to growing concern over internal access risks in the crypto sector. In May 2025, Coinbase disclosed a separate hack tied to misused internal access. That breach was expected to cost the rival exchange up to $400 million to address.

Lazarus Group, backed by North Korea, is known for placing operatives inside legitimate firms. Crypto researchers identified at least 60 Lazarus-linked coders who worked on crypto projects.

However, recent crypto exploits have also become more complex. The Drift exploit showed how advanced these attacks could become. Attackers used protocol mechanics and liquidity conditions to manipulate systems in real time

For Kraken, the current case centers on insider access and extortion pressure. The company said the matter is being handled with law enforcement support. It also made clear that it does not intend to pay.

Related: Drift Exploit Linked to Coordinated Infiltration Effort