Kraken Hit by Insider Threat as Hackers Try to Extort Exchange with Internal Videos

Cryptocurrency exchange Kraken is facing an extortion attempt by hackers who claim to have videos showing internal systems with client data, following a breach involving insider access by support employees. The incident highlights the growing threat of insider recruitment in the crypto industry.

What Happened

Kraken's Chief Security Officer Nick Percoco revealed that the company is being extorted by a criminal group threatening to release videos of internal systems containing client data unless their demands are met. The exchange has firmly stated it will not pay or negotiate with the threat actors.

According to Percoco, the incident did not involve a system breach and client funds were never at risk. The breach stemmed from insider threats, with two instances of improper access to limited customer data by support employees.

Scope and Impact

The breach affects approximately 2,000 accounts, representing just 0.02% of Kraken's user base. For this small subset of users, the exposed information reportedly concerns only client support data rather than financial or trading information.

Kraken has taken swift action by revoking employee access, launching investigations, and strengthening internal controls. The company has also notified affected users directly where exposure was identified.

Insider Threat Pattern

This incident follows a concerning pattern in the cryptocurrency industry. In mid-2025, major exchange Coinbase suffered a data breach after hackers bribed employees of an India-based customer support agency to disclose private client support information. That breach impacted 70,000 customers and resulted in estimated financial damages of $400 million.

These cases demonstrate how cybercriminals are increasingly targeting the human element within cryptocurrency exchanges rather than attempting direct system breaches.

Company Response and Legal Action

Kraken has gathered sufficient evidence to pursue legal prosecution against all individuals involved in the blackmail attempt. The company is working closely with federal law enforcement across multiple jurisdictions to bring the perpetrators to justice.

Percoco emphasized Kraken's commitment to user security: "Our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors."

Industry Context

As one of the largest and most established cryptocurrency exchanges, Kraken serves millions of users across 190 countries, facilitating daily trading volumes of hundreds of millions of U.S. dollars. The platform supports trading in Bitcoin, Ethereum, and approximately 200 other digital assets.

The incident underscores the unique security challenges facing cryptocurrency exchanges, where the combination of valuable digital assets and complex support systems creates multiple potential attack vectors for malicious actors.

Security Implications

This case highlights several important security considerations for the cryptocurrency industry:

• The need for robust insider threat detection and prevention programs
• The importance of limiting employee access to sensitive systems
• The value of rapid incident response and user notification protocols
• The risks associated with third-party support agencies
• The necessity of maintaining strict non-negotiation policies with extortionists

Related Security Incidents

The cryptocurrency sector has seen numerous high-profile security incidents in recent years. Similar extortion attempts have targeted other companies, including gaming giant Rockstar Games, where stolen analytics data was leaked by an extortion gang.

These incidents collectively demonstrate that no organization is immune to sophisticated cyber threats, particularly those involving insider recruitment and extortion tactics.

Expert Perspective

Security experts note that insider threats represent one of the most challenging security problems organizations face. Unlike external attacks that can be blocked by firewalls and intrusion detection systems, insider threats exploit legitimate access and trust relationships.

The cryptocurrency industry's rapid growth and the high value of digital assets make it particularly attractive to both external hackers and insiders who might be tempted by bribes or coercion.

Moving Forward

For Kraken users and the broader cryptocurrency community, this incident serves as a reminder of the importance of security vigilance. While Kraken has maintained that user funds were never at risk, the exposure of support data still represents a privacy concern that the company is actively addressing.

The exchange's transparent communication about the incident and its firm stance against extortion may help maintain user trust despite the security challenge. However, the incident will likely prompt other cryptocurrency exchanges to review and strengthen their own insider threat prevention programs.

As cryptocurrency adoption continues to grow, exchanges must balance the need for responsive customer support with the imperative to protect sensitive user data from both external and internal threats.