Crypto exchange and investment platform Kraken recently faced disruption after a wave of unsolicited micro-transfers reached addresses linked to its platform. Between August 17 and 24, 2026, nearly 12,000 tiny cryptocurrency deposits—typically valued at just a few cents to a couple of dollars—arrived from a wallet associated with the sanctioned exchange HTX, formerly known as Huobi.
Kraken described the activity as a “dust attack.” In response, the platform temporarily locked certain customer accounts while its compliance systems reviewed the incoming funds.
These brief restrictions stemmed from automated anti-money laundering and sanctions-screening protocols that flagged the transfers due to their reported connection to wallets subject to United Kingdom and European Union restrictions.
Once reviews concluded, Kraken restored access for the affected users.
The exchange continues to hold the disputed sanctioned amounts separately in accordance with regulatory requirements and is coordinating with authorities to limit further impact.
A Kraken spokesperson indicated that the apparent goal of the campaign was to distribute sanctioned assets across unrelated accounts on other platforms, thereby triggering widespread compliance checks and creating operational friction.
The senders may have anticipated that the arrival of restricted funds would cause entire accounts to be frozen, generating significant disruption for a large number of users.
HTX has denied initiating the transfers and stated it is investigating possible explanations, including misidentification of the originating wallet or activity by a third party.
Blockchain analytics firms had linked the sending address to HTX based on public proof-of-reserves disclosures.
Dust attacks, also called dusting attacks, are a longstanding tactic in the cryptocurrency space.
Malicious actors send negligible amounts of crypto—often too small to notice or economically worth moving—to thousands of wallet addresses.
Because blockchain transactions are public, these tiny deposits act as markers.
When a recipient later combines the dust with other holdings in a normal transaction, analysts can apply clustering techniques to link previously separate addresses to the same owner.
This process undermines privacy by mapping wallet networks and, in some cases, connecting them to real-world identities through interactions with regulated exchanges or services that require identity verification.
Once identities or high-value holdings are revealed, attackers frequently escalate.
They may launch highly targeted phishing campaigns, social-engineering attempts, or extortion schemes that reference specific balances or recent activity to appear credible.
In related variants such as address poisoning, dust transfers from look-alike addresses are planted in transaction histories so that users later copy the wrong destination and send funds to the attacker.
While classic dusting does not directly drain wallets, the intelligence it generates enables subsequent theft of user funds through deception.
As first reported by Bloomberg, the Kraken incident underscores broader challenges in policing open blockchain networks.
Anyone can send tokens to a public address without consent, forcing exchanges to balance rapid compliance responses against the risk of inconveniencing legitimate customers. As regulators tighten sanctions enforcement, such disruptive tactics may become more common, highlighting the ongoing tension between open crypto infrastructure and the need for proper safeguards.