Kraken temporarily disabled trading for approximately 12,000 accounts between Aug. 17 and Aug. 24 after they received unsolicited cryptocurrency transfers from wallets linked to HTX, which appear on sanctions lists.
The exchange classified this as a dust attack—a tactic using minimal transfers (fractions of a cent to a few dollars) to obfuscate sanctioned funds across multiple unrelated accounts. On public blockchains, recipients cannot prevent incoming transactions, allowing anyone to send coins to a known address without consent.
Arkham Intelligence attributed the sending wallet to HTX based on addresses the exchange previously submitted in a proof-of-reserves report. However, Arkham's analysis did not specify who controlled the wallet at the time of each transfer.
HTX denied involvement, stating it "absolutely did not engage in such behaviour." The exchange is investigating whether the issue stemmed from mapping problems, operational failures, or malicious actions by third parties. HTX has not released a detailed breakdown of the wallet activity.
The incident underscores escalating regulatory pressure on HTX. Huobi Global S.A. received sanctions from the United Kingdom in May under its Russia sanctions regime and faces additional scrutiny from the European sanctions regime.
This dust attack represents a new compliance vector for centralized exchanges. Unlike traditional dusting campaigns designed to deanonymize wallet owners, this operation weaponized the mandatory investigation burden—each small transfer forces exchanges to examine potential exposure to sanctioned entities, creating operational friction at scale.
For compliance teams, the challenge is acute: receiving funds does not signal intent or voluntary participation with a sanctioned counterparty. Investigations require analyzing transaction size, specific attribution, timing, and customer behavior—resource-intensive work triggered by transfers users never authorized.
Kraken and HTX have not disclosed the total number of customers ultimately restricted, the aggregate value of unsolicited funds, or the specific duration of individual review processes. Neither has announced a joint investigation. Definitive explanations would require deeper wallet-level attribution, further statements from both companies, or formal action from UK and European sanctions authorities.
