Kraken, a leading cryptocurrency exchange, confronts an extortion attempt following videos leaked by malicious insiders from its client support systems.
Details of the Extortion Attack
Kraken’s Chief Security Officer, Nick Percoco, announced the incident on X. “We are currently being extorted by a criminal group threatening to release videos of our internal systems with client data shown if we do not comply with their demands,” Percoco stated.
He emphasized key facts: the company’s systems experienced no breach, client funds remained secure, Kraken refuses to pay, and it will not negotiate with the perpetrators.
Timeline and Insider Involvement
In February 2025, a video surfaced on the dark web displaying unauthorized access to Kraken’s client support system. Investigations traced it to a malicious insider on the support team. Kraken immediately revoked access and implemented enhanced security measures.
Shortly afterward, another similar video appeared, again linked to a rogue insider. Across both incidents, approximately 2,000 client accounts—representing just 0.02% of total clients—may have been viewed, Percoco noted.
Extortion demands followed, with threats to share the videos across traditional media and social platforms unless payment is received. Details on the criminal group or demanded amount remain undisclosed.
Company Response and Investigation
Kraken stands firm against payment and has launched a criminal investigation. Evidence exists to identify and apprehend the responsible parties, the company confirmed.
Broader Risks in Crypto
Malicious insiders pose significant threats to cryptocurrency exchanges, rivaling external attacks. Major platforms like Coinbase, Kraken, and Binance have encountered similar issues. North Korean-linked hackers, such as the Lazarus group, often infiltrate via fake job placements in campaigns like Operation DreamJob, though they typically prioritize direct theft over extortion.
