Update: Kraken Denies Dark Web Access Claims

What Happened

In a statement shared with BeInCrypto, Nick Percoco, Kraken’s Chief Security Officer, said the exchange conducted an internal investigation and found no evidence of compromise.

“We investigated the claims thoroughly and determined that the forum post is not legitimate and appears intended to mislead other forum users,” Percoco said.

According to Dark Web Informer, the listing advertises the ability to view user profiles, transaction histories, and full KYC documents. These include IDs, selfies, proof of address, and source-of-funds information.

Others warn that if genuine, the data exposure could put Kraken customers at significant risk, urging the exchange and law enforcement to investigate urgently.

Indeed, this feature could be exploited for highly convincing social engineering attacks. Kraken did not immediately respond to BeInCrypto’s request for comment.

Complete access to trading patterns, wallet addresses, and deposit or withdrawal behavior equips threat actors with intelligence to launch phishing, SIM swap, and credential stuffing attacks, extending the threat beyond account exposure.

Market Context

Kraken has denied the claims circulating on dark web forums, stating that the alleged admin panel access listing is not legitimate.

Kraken Says Alleged Admin Panel Listing Is Not Legitimate

Why It Matters

The incident had raised concerns about potential exposure of user data and the risk of targeted phishing attacks.

“If this is genuine, it’s a major data‑exposure and phishing risk for Kraken customers. Kraken’s security and law enforcement teams need to be on this immediately,” another added.

Read-Only Access Isn’t Harmless: CIFER Reveals Kraken Panel Exposure Risks

CIFER Security emphasizes that even read-only access can have serious consequences. While attackers cannot directly modify accounts, they could leverage support ticket functionality to:

Details

Kraken did not disclose further technical details but emphasized that no unauthorized access to internal systems or customer data had been identified.

Earlier Reports Cited Alleged Dark Web Listing of Kraken Admin Access

The seller claims access can last one to two months, is proxied with no IP restrictions, and includes the ability to generate support tickets.

The listing has raised immediate concerns among security professionals, although some online users remain skeptical.

“Almost certainly fake,” one user remarked, highlighting uncertainty about the authenticity of the access.

Impersonate Kraken staff,

Reference real transaction details to gain trust, and

Target high-value users identified through transaction history.

Admin panel compromises are not new in the crypto industry. Exchanges like Mt. Gox (2014), Binance (2019), KuCoin (2020), Crypto.com (2022), and FTX (2022) have all faced attacks targeting internal systems. This highlights that centralized tools with elevated privileges remain prime targets.

Kraken’s reported exposure aligns with this broader pattern, highlighting the persistent challenge of securing privileged access in the financial services sector.

What Should Kraken Users Do?

CIFER Security recommends assuming potential exposure and taking immediate protective measures. These include: