Kraken Dust Attack Locks Users as HTX Funds Spread

Steady attention without excessive speculation.

The Kraken dust attack ran from August 17 to August 24, according to a report Bloomberg published on August 25. During that window, one wallet sent nearly 12,000 small transfers to Kraken-linked addresses. Most were worth only a few cents or a few dollars.

What Happened in the Kraken Dust Attack

Arkham Intelligence links the sending wallet to HTX, the exchange formerly known as Huobi. So when the dust landed, some Kraken customers found their accounts temporarily frozen.

Kraken has since restored access to the affected accounts. Meanwhile, the exchange continues to hold or freeze the funds it flagged as sanctioned. It also says it is working with authorities.

Kraken has not published an exact count of locked customers. Instead, it describes the impact only as “some” accounts and a “temporary” or “brief” lockout. The precise duration also remains unclear.

Kraken had already warned about HTX flows before this week. Back in May 2026, the exchange advised customers against sending transfers from Huobi or HTX. So the latest freezes followed months of caution around the sanctioned exchange.

Why Tiny Transfers Can Freeze an Account

A dust attack sends tiny, unsolicited amounts of crypto to many addresses at once. Because blockchains are public and permissionless, anyone can do this cheaply.

Traditionally, attackers use dusting to deanonymize wallets. When a recipient later spends the dust, clustering tools can link their addresses together. This case points to a different goal.

Here the risk comes from where the funds allegedly originated. Modern exchanges screen every deposit for exposure to sanctioned entities. So even unwanted dust can flag an address under AML and clustering rules.

As a result, an exchange may lock a whole account while it reviews the exposure. The recipient never asked for the funds. Still, the inbound transaction creates an on-chain link that compliance systems must check.

Analysts call this risk association “taint.” Once a tainted deposit lands, clustering algorithms group the interacting addresses together. So a few cents of dust can trigger the same review as a large suspicious deposit.

The HTX Sanctions Backdrop

This attack did not happen in a vacuum. The United Kingdom sanctioned Huobi Global SA, the entity behind HTX, back in May 2026. Regulators tied the move to suspected facilitation of Russian sanctions evasion. Reports connected the case to entities such as A7 and Garantex.

Related European Union measures followed over the summer. By around August 23, transaction restrictions had tightened further. Because of that pressure, exchanges such as Bybit, OKX, Binance, and Kraken moved to restrict or review HTX-linked flows.

According to Kraken, the timing was not a coincidence. A spokesperson told Bloomberg the transfers appear designed to spread sanctioned money across compliant platforms.

“The recent dust attack originating from HTX-owned wallets appears to be an attempt to spread funds sanctioned by the U.K. and the European Union across other platforms and undermine trust across the industry,” the spokesperson said. The attackers, they added, may have expected sanctioned funds to lock recipient accounts entirely.

HTX Denies Sending the Funds

HTX rejects that account. The exchange denies initiating the transfers. Instead, it says it is investigating possible address misattribution or malicious third-party activity.

That leaves the core question open. Arkham labels the wallet as HTX-linked, reportedly based on an address from HTX’s proof-of-reserves disclosure. However, a public label does not prove who controls a wallet today.

Andy Zhou, chief executive of security firm BlockSec, compared the incident to poisoning a user’s transaction history. Because anyone can send assets to any address, he noted, the tactic costs the attacker very little.

A Bigger Wave After the Mid-August Dusting

The Kraken dust attack also builds on an earlier, smaller wave. Around August 18, reports described roughly 166 dust transfers from an address labeled “HTX 48” on Etherscan. Some of those transfers also reached Kraken addresses.

During that first wave, users complained about frozen accounts. One reported freeze reportedly involved $4.2 million, though Kraken has not confirmed that figure. HTX denied involvement then too, and Justin Sun called some reports fabricated.

Open coverage still does not name the exact wallet or transaction hashes behind the full 12,000-transfer series. The precise tokens and total value also remain unverified. So the two waves are related, yet the larger one is not fully documented on-chain.

What Kraken Users Should Watch Next

For now, Kraken says the affected accounts are back online. Yet the funds stay frozen, and the investigation continues alongside authorities.

The episode shows how permissionless transfers can turn compliance tools into an attack surface. Because a sender needs no permission, screening systems must sort real risk from weaponized noise. That challenge will not disappear soon.

Kraken customers who received unexpected dust should avoid moving it and watch for official guidance. This article is informational only and not financial advice. Always verify account notices through Kraken’s official channels.