Dust Attack on Kraken: Why 12,000 Tiny Deposits Froze Customer Accounts

If your account at a crypto exchange is frozen without warning, it may have nothing to do with you. Between August 17 and August 24, 2026, Kraken received almost 12,000 tiny deposits from wallets that analytics firms attribute to the sanctioned exchange HTX. The amounts mostly ranged from a few cents to a few dollars. That was enough for the exchange's automated sanctions screening: affected accounts were temporarily frozen until the checks were complete. Kraken has since restored access and is holding back only the flagged funds. What you should take from this is set out in three steps further down, and the most important one is this: do not touch small amounts of unknown origin.

Dust Attack on Kraken: What Happened Between August 17 and 24

Within eight days, Kraken customers received almost 12,000 transfers that nobody had requested. Several trade publications consistently report amounts in the range of a few cents to a few dollars per transfer. The blockchain analytics service Arkham Intelligence attributes the sending wallet to the exchange HTX, which formerly traded under the name Huobi.

Kraken has classified the events as an attack rather than an accident. A spokesperson for the exchange told Bloomberg that it did not know who was behind it; the senders were probably counting on sanctioned funds in a customer's account triggering a full account freeze and thereby disrupting operations for many users at once. HTX denies any involvement and says it is examining whether faulty address attribution, an internal process error or the actions of third parties lie behind it. The two accounts stand side by side; what is documented so far is the attribution of the wallet by an analytics service, not the question of who initiated the transfers.

What a Dust Attack Is and Why It Freezes Other People's Accounts

A dust attack is the mass sending of tiny amounts to other people's addresses, either to contaminate their transaction history or to trigger screening routines at the receiving providers. The name comes from the word for dust: these are sums that are worthless in themselves. The damage is done not by the amount but by its origin.

Originally the method served to de-anonymise users. Anyone who sends dust to thousands of addresses and watches which of those amounts are later spent together with other holdings can group addresses together and draw conclusions about individual users. The Kraken case shows a second application: if the sender is on a sanctions list, the recipient becomes a problem for the compliance department without having done anything at all.

For you as an investor the difference matters. In a hack you lose funds. In a dust attack you initially lose only access, and you lose it because your provider is meeting a legal obligation.

Sanctions Screening at the Exchange: Why the Freeze Is Automatic

An exchange licensed in the EU screens incoming payments against sanctions lists on an ongoing basis. When a match comes in, the check bites immediately and without a prior human decision. That is not a matter of goodwill but the core of the anti-money-laundering regime. This automation is precisely what a dust attack is aimed at.

In practice that means the account is restricted while the check runs. How long that takes depends on the individual case. Kraken released access again once the checks were complete, without naming the number of customers affected or the duration of the freezes. What happens legally during that period, and why your provider often may not even tell you the reason, is something we set out in crypto exchange account frozen.

Anyone who keeps their holdings exclusively with providers licensed in Europe gets these checks just the same, but gets them within a framework where a supervisory authority is responsible and a complaints route exists. Which providers those are is set out in the overview of regulated crypto exchanges.

HTX on the EU Sanctions List: The Legal Background Since August 23

The timing of the attack coincides with a cut-off date. With Regulation (EU) 2026/1848, the Council of the European Union added the entry "HTX (HUOBI GLOBAL SA)" to Annex XLV of the Russia sanctions regulation. The annex gives August 23, 2026 as the date of application. From that date, transactions with the platform are prohibited for persons and companies in the EU.

The United Kingdom moved earlier. There, Huobi Global S.A. was listed on May 26, 2026 under the Russia (Sanctions) (EU Exit) Regulations 2019, according to consistent reports the first designation of a crypto exchange by name by the British government. These two legal acts are the reason a payment of a few cents can trigger a freeze at all.

We have already written about the ban itself and the platforms affected: on HTX on the EU sanctions list and on the blocking of fourteen platforms from August 23. This article deals with the consequence that was not yet foreseeable there: that sanctioned funds end up with customers of entirely different exchanges.

$4.2 Million Frozen: What Happens to the Flagged Funds

According to reports from several trade publications, Kraken continues to hold back around $4.2 million from the episode, while the accounts themselves have been released. The exchange has not publicly confirmed this figure, and at least one of the reporting newsrooms expressly flags it as not independently verified. Treat the number as an order of magnitude, therefore, not as an audited balance sheet item.

The separation is the point that really matters: account access and flagged funds are handled separately. The remaining balance stays tradable, the marked portion does not. In the worst case that means for you that a freeze does not automatically affect your entire wealth, but also that the marked portion can lie idle indefinitely as long as the legal position is unresolved.

Dust in Your Wallet: Why You Should Not Move the Tiny Amounts

If an unexplained tiny amount turns up in your own wallet, one simple rule applies: leave it alone. The dust does no damage as long as it stays untouched. It becomes dangerous the moment you spend it together with the rest of your holdings, because the blockchain then permanently links the origin of the dust to your other funds.

With Bitcoin that comes down to the design of the network. Every bitcoin payment is assembled from individual, clearly delimited pieces of balance known as UTXOs. A UTXO is a single, not yet spent incoming payment that your wallet manages as a self-contained building block. If you inadvertently include the dust UTXO when paying, its history travels into the new transaction.

There are two things you should refrain from doing in this situation. Do not click any link that turns up alongside an unexpected token in your wallet, and do not try to "send the amount back". Both are common patterns that turn a harmless contamination into a real loss.

Coin Control and UTXO Selection: How to Isolate Contaminated Amounts

Good wallet software lets you choose which pieces of balance a payment may use. This function is called coin control. Coin control is the manual selection of the inputs from which a transaction is built. It lets you keep a marked amount permanently away from your other holdings without having to delete it. Deleting is not possible anyway, because what is on the blockchain stays there.

In practice that means marking the dust input in your wallet as unspendable and leaving it there. On an account at an exchange you do not have that option, because the exchange manages the keys and makes the selection itself. That is one of the reasons larger holdings belong in self-custody; which devices are suitable is set out in the hardware wallet comparison.

Getting the order right matters here: self-custody does not protect you from receiving dust. Any public address can receive something at any time, and that is not a weakness but how the system works. Self-custody only gives you control over what happens to what you have received.

Account Frozen: Which Documents Shorten the Review

If your account really is restricted, the quality of your documentation decides how long that state lasts. Proof of the source of funds for the affected holdings is worth having: purchase confirmations from the exchange, bank statements for the transfer, and for transfers from your own wallet the transaction IDs.

For the unsolicited incoming payment itself, one thing helps above all: the transaction ID of the inflow in question, together with a note that you did not request it and have not moved it on. Anyone who has already moved the dust on should state that openly too. The reviewer sees the chain anyway, and an omission costs more time than it saves.

Set yourself a realistic expectation. A sanctions review is not a customer service matter that pressure speeds up. The review ends when the assessment is settled.

Holdings at a Sanctioned Platform: The Authorisation Route Under Article 5ad

One special case concerns everyone who still has holdings sitting at HTX or another listed platform. The regulation provides a narrowly drawn exception for that. Under the newly added paragraph 4 of Article 5ad, the competent authorities of a member state may authorise transactions that are strictly necessary to withdraw funds or close accounts.

The text ties this authorisation to conditions, and you should know them before you make plans:

• Eligible are nationals of a member state, of an EEA state or of Switzerland, as well as natural persons holding a temporary or permanent residence permit there.
• The transaction must be necessary in order to terminate the contractual relationship with the listed entity.
• The application must be filed no later than three months after the date of application named in the annex. For HTX that date of application is August 23, 2026.
• The funds must be transferred to a financial or credit institution established or registered under the law of a member state.

Each authorisation is granted for a maximum of three months. The authority of your member state is responsible, not the exchange, and the decision lies within its discretion; the law gives you no entitlement to a particular outcome.

Regulated or Not: What Your Choice of Exchange Changes About This Risk

The case is easy to read the wrong way. Kraken did here what sanctions law requires. An exchange that does not screen incoming funds from listed wallets in the first place is the more dangerous place for you. There the problem grows quietly until a supervisory authority picks it up.

What you can steer is the distribution. An account holding your entire wealth turns every review into a total outage. Two providers and your own storage turn it into an inconvenience.

Our Own Analysis: The Regulation Checked in Full Text

For this article we read the governing legal act ourselves rather than taking it second hand. cryptoticker.io compiled this analysis itself on August 27, 2026.

Method: the German Official Journal version of Regulation (EU) 2026/1848 was retrieved in full HTML text via EUR-Lex the same day, stripped of its markup and searched for the entries on HTX and for the amendments to Article 5ad. Exactly two passages of the legal act were checked, each in full: the entry in Annex XLV and the newly added paragraph 4 of Article 5ad.

Result: the annex lists "HTX (HUOBI GLOBAL SA)" with a date of application of August 23, 2026. Paragraph 4 of Article 5ad contains verbatim the four conditions named above, together with the maximum duration of three months per authorisation and the member state's duty to inform other member states and the Commission within two weeks.

What we could not check belongs in the picture too. First, how an individual national authority actually decides such an application, because the provision expressly grants it discretion. Second, the British designation, which we could document only through reporting; the official full text was not available to us for that. Third, all the details of the attack itself, meaning the number of transfers, the period and the amount held back, which come from reporting and were not counted by us.

What to Watch Over the Coming Weeks

Two developments will decide whether this episode remains a one-off. The first is the question of authorship: as long as it is open who initiated the transfers, it also remains open whether the pattern repeats. The second concerns the other European providers. Kraken is the exchange where the episode became public; that says nothing about whether other platforms received nothing from the same source.

For you nothing dramatic follows from that, but something concrete does: over the coming days, check the incoming lists of your accounts and wallets for amounts you cannot place, and leave them untouched.

Dust Attack and Account Freeze: What to Take Away

1. Do not move tiny amounts of unknown origin. Go through the incoming payments on your wallets and accounts, mark inflows you cannot explain and do not spend them together with the rest of your holdings. Where you want to make the selection yourself, you need your own keys, and the devices for that are listed in the hardware wallet comparison.
2. Check where your funds sit and who is responsible for them. A European-licensed exchange freezes accounts just the same, but it does so within a framework that has supervision and a complaints route. You will find the overview of licensing and registered office among the regulated crypto exchanges.
3. Spread your holdings instead of putting everything in one account. Anyone using two providers is not left unable to act while a review runs. Which platforms lend themselves to that and what they cost is shown in the comparison of the best crypto exchanges.

You can read this article's two sources yourself: the text of Regulation (EU) 2026/1848 on EUR-Lex and the account of the episode at crypto.news.

(As of August 27, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)