- Kraken says nearly 12,000 small, unsolicited transfers from wallets linked to sanctioned exchange HTX hit customer deposit addresses between August 17 and August 24, briefly locking some accounts.
- HTX has denied sending the transfers, even as its own head of markets confirmed the exchange opened a formal internal investigation into them.
- The disputed wallet appears in HTX’s own proof of reserves disclosure, and a similar wave of dust hit Binance, Coinbase and OKX customers a week earlier.
Kraken said nearly 12,000 small, unsolicited transfers hit customer deposit addresses between August 17 and August 24, briefly locking some accounts, and traced the wallets behind them to HTX, the crypto exchange the UK and European Union sanctioned this year over alleged ties to Russian sanctions evasion.
“We don’t know who is behind these attacks, but they likely expect that if sanctioned funds land in a client account, it triggers a full account lock, causing operational disruption,” a Kraken spokesperson said.
The dispute reaches beyond Kraken. The same HTX-linked wallets sent near-identical dust to Binance, Coinbase and OKX customers about a week earlier, and HTX’s own account of events is not fully consistent. The exchange has denied initiating any transfers, while its own head of markets confirmed opening a formal investigation into them, an acknowledgment that HTX itself cannot yet say who controlled the wallet when the transfers went out.
Kraken said its compliance team restored access to the affected accounts, while continuing to hold the sanctioned funds under its own screening rules.
Why cents-sized deposits triggered account freezes
Many of the transfers were worth cents or a few dollars, but the size was not the issue. The UK designated HTX, formerly known as Huobi, in May under its Russia sanctions regime, alleging the exchange helped move funds through Kremlin-linked networks. The EU added HTX to its own Russia sanctions package in July, with a transaction ban taking effect August 23.
Kraken has spent the past year building out its own sanctions screening, saying it completed a multi-year effort including end-to-end transaction monitoring. That system is designed to flag exactly this kind of incoming exposure automatically, freezing an account the moment sanctioned funds land in it, regardless of the amount.
The same wallets hit four exchanges in eight days
The pattern did not start with Kraken. It was previously reported that about $24,509 was frozen in a separate case on July 20, after a Huobi-to-Kraken transfer, roughly four weeks before the wider wave began. On August 18, users on Binance, Coinbase and OKX reported receiving unsolicited transfers, some as small as roughly 7.5 USDT, from wallets tied to HTX. Several said their accounts were flagged or restricted afterward.
HTX’s verified account said “there was no official activity” behind the transfers, and that the exchange “has not conducted any related transfers or testing activities.” Justin Sun, HTX’s founder, called reports that the exchange deliberately sent the funds “made up.”
That denial sits awkwardly next to two other facts. HTX’s own head of markets, Liu Ye, confirmed the exchange opened a formal investigation into the transfers, a step companies do not typically take over something they have already ruled out. And the wallet at the center of the dispute, an address labeled “HTX 48” on Etherscan, appears in HTX’s own published proof of reserves data.
What dusting attacks used to do, and what changed
A dusting attack traditionally means something narrower than what is alleged here: sending tiny amounts of crypto to many wallets, then watching where the funds move to unmask the owner’s identity through address clustering. Litecoin saw a large version of this in 2019, when hundreds of thousands of dust transactions hit roughly 295,000 addresses; the sender later said it was advertising a mining pool, not tracking anyone.
What Kraken describes is a different mechanism aimed at a different target. Instead of trying to deanonymize a wallet owner, the alleged goal is to plant sanctioned funds inside an ordinary customer’s account and let the exchange’s own compliance system do the rest, locking out a legitimate user over money they never asked for.
HTX’s investigation is still open, and neither Kraken nor Arkham has said how many accounts across the industry were actually affected. HTX has said the largest frozen balance tied to the dispute is $4.2 million; Kraken has not addressed that figure. Until the investigation produces a clearer answer, exchanges are left checking wallets they cannot fully trust, and customers are left holding deposits they never requested.
Disclaimer: Cryip's content is strictly for educational and informational purposes and does not constitute financial, legal, or investment advice. Cryptocurrency involves significant risk, and readers assume full responsibility for their own financial decisions. Asset references are never endorsements.
To make complex crypto topics accessible to readers at all experience levels, our team uses AI tools strictly to refine language, correct grammar, and simplify terminology. AI is never used to draft facts, source information, or form conclusions. Every article is fact-checked and approved by a human editor before publication. Read our full AI Use & Content Policy.
