Kraken is confronting a security crisis that did not begin with a network intrusion, but with the people allowed to see customer data from inside the company. In a public statement, Chief Security Officer Nick Percoco said the exchange is being extorted by a criminal group threatening to release videos of internal systems showing client information unless Kraken complies with its demands. The company’s central message was that this was an insider-access problem, not a breach of its core infrastructure.

According to Kraken, roughly 2,000 customer accounts, or about 0.02% of its user base, were potentially viewed across two separate incidents tied to members of its support team. The company said client funds were never at risk, its core systems were never breached, and affected users have already been notified. That distinction matters because it narrows the immediate financial threat, even as it sharpens questions about internal access governance.

An insider problem has become a public trust problem

Kraken said the first incident surfaced in February 2025, when it received a tip about a video circulating on a criminal forum that appeared to show internal support screens. A second, similar incident emerged more recently. In both cases, the company said it identified the employees involved, revoked their access and terminated their employment. The operational failure was limited in scope, but it exposed one of the hardest risks for centralized platforms to fully eliminate: misuse by trusted personnel.

That is why the episode is more consequential than the number of affected accounts alone might suggest. Crypto exchanges are usually judged on custody architecture, wallet security and external attack resistance, yet this case shifts attention to a different control surface: who can view sensitive information, under what permissions, and with what audit trail. For institutional clients and counterparties, human-risk controls are now moving closer to the center of exchange due diligence.

Kraken is trying to contain the fallout without conceding leverage

Percoco said Kraken will not pay the extortionists and will not negotiate with them. He also said the company is cooperating with federal law enforcement across multiple jurisdictions and believes it has enough evidence to support arrests. That posture is designed to project control and deter copycat attempts, even if it also raises the stakes around what the perpetrators may do next.

The broader consequence is likely to be felt in governance and oversight rather than in immediate market structure. Kraken’s public response may limit reputational damage in the short term, but the incident is likely to intensify scrutiny of employee access management, incident disclosure standards and internal surveillance practices at large exchanges. The lesson is no longer just that crypto platforms must defend against hackers, but that they must continuously defend against insiders who already sit behind the perimeter.