Kraken Faces Extortion Plot Involving Rogue Employees, Raising Concerns Over Fed Access Cryptocurrency exchange Kraken is grappling with an extortion attempt orchestrated by hackers who recruited insider employees to bypass security measures. The incident, disclosed by Chief Security Officer Nick Percoco on April 13, 2025, involved rogue members of Kraken’s customer support team who allegedly provided attackers with access to internal systems. The breach was discovered in February 2025 after Kraken received a tip about a video circulating on a criminal forum, showing unauthorized access to its client support tools. Investigations revealed two employees had been compromised, potentially exposing roughly 2,000 client accounts 0.02% of Kraken’s user base. While the exchange confirmed no funds were at risk and core systems remained secure, attackers threatened to leak footage of internal operations unless demands were met. Kraken has refused to negotiate, revoked the employees’ access, and notified affected clients, while collaborating with federal law enforcement. The incident underscores a growing trend of cybercriminals targeting insiders, as seen in a December 2024 report by Check Point, which uncovered darknet ads offering payouts of $3,000 to $15,000 for employees at exchanges like Kraken, Coinbase, and Binance. Similar extortion attempts have targeted other firms, including Coinbase, which has since bolstered insider-threat detection and support security controls. The breach arrives just weeks after Kraken became the first digital asset company to secure a "limited purpose" Federal Reserve master account on March 4, 2025, granting it direct access to the central bank’s payment rails. The approval, issued by the Federal Reserve Bank of Kansas City, has drawn sharp criticism from traditional banking advocates, including the Independent Community Bankers of America (ICBA), which warned of systemic risks. In a joint letter, the ICBA and 42 state bankers’ associations urged the Fed to impose stricter risk controls on Kraken’s account, citing concerns over operational and cybersecurity vulnerabilities. The incident has also intensified congressional scrutiny. Rep. Maxine Waters, ranking Democrat on the House Financial Services Committee, demanded further details on the approval process, while Fed Vice Chair for Supervision Michelle Bowman acknowledged the move as an "experiment" in integrating crypto firms into the federal payment system. Critics, including the Bank Policy Institute, argue that lightly regulated crypto entities may pose broader financial stability risks compared to traditional banks, which undergo rigorous supervision and hold deposit insurance.

Critical Android Vulnerability Exposes Encryption Keys and Crypto Wallet Data Security researchers at Ledger’s Donjon team have uncovered a severe vulnerability in certain Android smartphones, potentially affecting up to 25% of devices worldwide. The flaw, tied to specific MediaTek chipsets using Trustonic’s Trusted Execution Environment (TEE), allows attackers with brief physical access to extract sensitive data including encryption keys and cryptocurrency wallet seed phrases in under a minute. The issue stems from a weakness in the device’s boot chain, a security mechanism that validates system components during startup. Normally, this process protects encryption keys until the OS fully loads. However, researchers demonstrated that by connecting a vulnerable phone to a computer via USB, attackers could bypass security protections before the OS completes booting. In a proof-of-concept test using a Nothing CMF Phone 1, the Donjon team recovered the device’s PIN, decrypted storage, and extracted seed phrases from six crypto wallets Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom within 45 seconds. The vulnerability, tracked as CVE-2026-20435 in MediaTek’s security bulletin, affects devices relying on certain MediaTek processors, which are prevalent in budget and midrange Android phones. MediaTek has issued a firmware fix to manufacturers, but users must install pending updates to mitigate the risk. Until then, affected devices remain exposed to offline decryption attacks once root cryptographic keys are extracted. Ledger’s CTO, Charles Guillemet, noted that smartphones were not designed as secure storage for digital assets, emphasizing that their security depends on the integrity of hardware, firmware, and software. The discovery underscores the risks of storing sensitive data on mobile devices without additional safeguards.

Kraken Faces Extortion Attempt After Insider Security Incidents Cryptocurrency exchange Kraken disclosed an extortion attempt by a criminal group threatening to release videos allegedly showing unauthorized access to internal systems containing client data. The Wyoming-based firm confirmed two separate incidents in 2025 involving rogue employees within its support team, both of which were swiftly contained. In February, Kraken received a tip about a video circulating on a criminal forum, prompting an internal investigation that identified the individual responsible. The company revoked their access, implemented additional security controls, and notified affected clients. A second, similar incident occurred more recently, leading to another termination and user notifications. Kraken emphasized that its systems were never breached, client funds remained secure, and it would not negotiate with the extortionists. Approximately 2,000 accounts roughly 0.02% of its customer base were potentially exposed across both incidents. The exchange is collaborating with law enforcement and industry partners to investigate what it describes as a broader insider recruitment campaign targeting crypto, gaming, and telecommunications firms. The incidents highlight persistent security challenges in the crypto industry, where high-value assets and human vulnerabilities create attractive targets for attackers. Recent exploits, such as the Drift protocol breach, demonstrate increasing sophistication, combining technical exploits with social engineering to evade detection. Kraken, founded in 2011, serves retail and institutional clients globally, offering trading, custody, and staking services. The company has reiterated its commitment to security and regulatory compliance amid evolving threats. Separately, Galaxy Digital reported containing a cybersecurity incident in an isolated development workspace, with no impact on client funds or data.