Sign in

Kraken

avoid.net/kraken→62/100·87% conf.
[AI-DRAFTED · AWAITING VERIFICATION]
62/100
[CAUTIONARY]87% conf.

Summary

Kraken (operated by Payward, Inc.) is one of the largest and longest-running cryptocurrency exchanges in the world, founded in 2011 and publicly launched in 2013 in San Francisco. The exchange holds a Wyoming special purpose depository institution bank charter and serves approximately 15 million users across 190+ countries. While Kraken is a legitimate, operating business and has not been the subject of exit-scam or market-manipulation allegations, it has accumulated a substantial regulatory enforcement record across multiple jurisdictions, experienced a zero-day security exploit in 2024, and faced an active extortion attempt in April 2026 tied to insider-related data access incidents.

Have evidence about Kraken?

No evidence submitted yet — be the first.

On-chain audit

Editorial decisions, corrections, and updates are anchored on Solana.

audit log →version history →

Company Overview and Background

Kraken was founded on July 28, 2011 by Jesse Powell, Thanh Luu, and Michael Gronager in San Francisco, California. The exchange opened to the public in September 2013, initially offering trading in Bitcoin, Litecoin, US dollars, and euros. The parent entity is Payward, Inc. Jesse Powell served as CEO from founding until April 2023, when he transitioned to board chairman and was succeeded by COO Dave Ripley. As of October 2024, Kraken operates under a co-CEO structure with Dave Ripley and Arjun Sethi. In September 2020, Kraken Financial became the first cryptocurrency company to receive a Special Purpose Depository Institution (SPDI) bank charter in Wyoming. As of 2025, Kraken reports approximately 15 million registered users, $207 billion in quarterly trading volume, and ranks 14th globally by exchange volume. In March 2025, Kraken announced the acquisition of NinjaTrader, a US retail futures trading platform, for $1.5 billion — described as the largest deal ever combining traditional finance and cryptocurrency. Kraken's parent company Payward also announced a $550 million acquisition of derivatives exchange Bitnomial in April 2026.

Sources

CFTC Enforcement Action (2021)

In September 2021, the Commodity Futures Trading Commission (CFTC) imposed a $1.25 million civil monetary penalty against Payward Ventures, Inc. (d/b/a Kraken) and required the exchange to cease and desist from further violations of the Commodity Exchange Act. The CFTC found that from approximately June 2020 through July 2021, Kraken offered margined retail commodity transactions in digital assets — including Bitcoin — to US customers who were not eligible contract participants. These transactions were deemed unlawful because they were required to take place on a designated contract market and did not. The CFTC further found that Kraken illegally operated as an unregistered Futures Commission Merchant by accepting orders, entering into transactions, and extending credit to margin the trades. The core regulatory issue was that Kraken maintained custody of assets and controlled liquidation rights, preventing actual delivery as required under the Commodity Exchange Act.

Sources

OFAC Sanctions Violations Settlement (2022)

In November 2022, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) announced a settlement with Payward, Inc. (Kraken) for $362,158.70 to resolve potential civil liability for apparent violations of US sanctions against Iran. OFAC found that between approximately October 14, 2015 and June 29, 2019, Kraken processed 826 transactions totaling approximately $1,680,577.10 on behalf of individuals who appeared to have been located in Iran at the time of the transactions. The root cause identified by OFAC was Kraken's failure to apply geolocation controls on an ongoing transactional basis; the exchange applied such controls only at the time of customer onboarding, despite having access to IP address information that indicated subsequent transactions were being conducted from sanctioned locations. OFAC noted mitigating factors including voluntary self-disclosure, cooperation with the investigation, and significant remedial measures. The potential maximum civil penalty was nearly $273 million; the reduced settlement reflected these mitigating factors. As part of the settlement, Kraken also agreed to invest an additional $100,000 in sanctions compliance controls.

Sources

SEC Staking-as-a-Service Settlement (2023)

On February 9, 2023, the US Securities and Exchange Commission (SEC) announced charges against Payward, Inc. and Payward Ventures, Inc. (together, Kraken) for failing to register the offer and sale of their crypto asset staking-as-a-service program. The SEC alleged that Kraken's program, which pooled customer crypto assets and provided them to blockchain validators in exchange for rewards shared with customers, constituted an unregistered securities offering. Kraken agreed to immediately cease the staking service for US customers and to pay $30 million in disgorgement, prejudgment interest, and civil penalties. The settlement did not include an admission of wrongdoing.

Sources

SEC Unregistered Securities Exchange Lawsuit (2023–2025)

In November 2023, the SEC charged Payward Inc. and Payward Ventures Inc. with operating Kraken's crypto trading platform as an unregistered securities exchange, broker, dealer, and clearing agency in violation of federal securities laws. According to the SEC's complaint, since at least September 2018, Kraken allegedly made hundreds of millions of dollars by unlawfully facilitating the buying and selling of crypto asset securities. The SEC also alleged that Kraken improperly commingled customer funds with its own corporate funds. On March 3, 2025, the SEC filed a joint stipulation with Kraken to dismiss the case with prejudice — meaning the case cannot be refiled. The dismissal came without any penalties, without any admission of wrongdoing, and without requiring operational changes from Kraken. The SEC indicated the dismissal reflected a broader shift in its regulatory approach to the crypto industry under new leadership, consistent with similar dismissals against Coinbase, Gemini, and other exchanges in early 2025.

Sources

Australian Regulatory Fine — Unlawful Margin Products (2024)

In August 2024, the Australian Securities and Investments Commission (ASIC) won a court case against Bit Trade Pty Ltd, the entity operating Kraken's Australian exchange. The court determined that Bit Trade had been offering a 'margin extension' credit product to Australian retail customers since October 5, 2021, without a target market determination as required by Australian design and distribution obligation (DDO) law. The product was available to retail customers — who were not properly screened — each time they accessed margin trading on the Kraken platform, constituting a fresh contravention on each occasion. In December 2024, an Australian court imposed a penalty of AU$8 million (approximately US$5.1 million) on Bit Trade. More than 1,100 retail customers had accessed the high-risk margin products and collectively lost over US$5 million. The court found that fiat-based margin products breached Australian regulations, while crypto-asset-based margin products did not. From August 30, 2024, Kraken restricted Australian retail clients who had not qualified as Wholesale Investors from opening new margin positions in fiat.

Sources

Zero-Day Security Exploit and CertiK Dispute (2024)

In June 2024, Kraken disclosed a significant security incident involving the exploitation of a zero-day vulnerability in its platform. On June 9, 2024, Kraken received a bug bounty alert from a security researcher describing a vulnerability that allowed users to artificially inflate their account balance without completing a deposit. While the vulnerability did not directly jeopardize existing client assets, it allowed perpetrators to inflate balances on the exchange and extract funds from Kraken's treasury. The vulnerability was exploited by three individuals who, in aggregate, withdrew approximately $3 million worth of cryptocurrency from Kraken's treasury before the company could patch the flaw. Kraken Chief Security Officer Nick Percoco described the researchers as having turned to 'extortion' after initially reporting the bug, refusing to return the funds and demanding a ransom to identify the vulnerability. Blockchain security firm CertiK later publicly claimed responsibility, stating it had detected several critical flaws and asserting it had acted as a white-hat researcher. CertiK admitted it 'made errors in judgment and poorly communicated with Kraken.' According to Kraken, all funds were ultimately returned, though a small amount was lost to transaction fees; Kraken subsequently distributed approximately $2.9 million to affected users via a USDT airdrop. The incident sparked significant industry debate about the ethics of security research versus extortion.

Sources

Insider Threat and Extortion Attempt (2025–2026)

In April 2026, Kraken publicly disclosed that it was the target of an extortion campaign by a criminal group threatening to release videos purportedly demonstrating insider access to internal systems containing client data. Kraken's investigation identified two separate instances of inappropriate access by individuals within its support team. The first was discovered in February 2025 after Kraken received a tip about a video circulating on a criminal forum; the individual was identified, their access was revoked, and additional security controls were implemented. A second, more recent incident involved a separate support employee providing access to limited customer data. Across both incidents, approximately 2,000 client accounts — representing approximately 0.02% of Kraken's user base — had their support data accessed. Kraken stated that its core trading systems were never breached and that client funds were never at risk. The exposed information was limited to client support data. Kraken refused to pay the extortion demands, stating: 'Our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors.' The exchange notified affected users, tightened internal access controls, and stated it was cooperating with law enforcement across multiple jurisdictions. Kraken described the incidents as part of a broader criminal pattern of insider recruitment targeting crypto, gaming, and telecommunications companies.

Sources

Founder Controversies and Leadership

In September 2022, co-founder and then-CEO Jesse Powell drew widespread media attention following a New York Times report on internal workplace controversies at Kraken. The report cited internal communications and employee accounts alleging that Powell made statements questioning whether women were of equal intelligence to men, called American women 'brainwashed,' argued that employees should not be able to choose their preferred pronouns, and made other culturally divisive statements. Powell denied that these controversies prompted his departure and announced he would step down as CEO; Dave Ripley formally assumed the CEO role in April 2023, with Powell remaining as board chairman. Separately, in July 2023 it was reported that the FBI had opened a criminal investigation into Powell over allegations that he hacked and cyberstalked Verge Center for the Arts, a Sacramento nonprofit he co-founded in 2007 and from whose board he was removed in 2022 following alleged violations of its guiding principles. FBI agents conducted a search of Powell's Los Angeles home and seized electronic devices. In April 2025, federal prosecutors informed Powell's attorney that the government had closed its investigation without bringing criminal charges. Powell stated the allegations were 'baseless.'

Sources

Phishing and Impersonation Risks

Kraken has been the target of ongoing impersonation and phishing campaigns by unaffiliated third parties. One documented case involved a victim losing $100,000 after searching for 'Kraken' online, landing on a spoofed website designed to mimic the exchange, and having their real Kraken account credentials compromised within minutes of entry. These incidents are not attributable to Kraken itself but represent an elevated ambient risk for users of the platform due to its brand recognition. Kraken maintains a dedicated scam reporting form and publishes guidance on how to identify phishing attempts.

Sources

Timeline

2011-07-28

Kraken (Payward, Inc.) founded by Jesse Powell, Thanh Luu, and Michael Gronager in San Francisco.

Wikipedia

2013-09-01

Kraken opens to the public offering Bitcoin, Litecoin, USD, and EUR trading.

The Block

2020-09-16

Kraken Financial granted Special Purpose Depository Institution (SPDI) bank charter in Wyoming — first cryptocurrency company to obtain a US bank charter.

Wikipedia / Contrary Research

2021-09-28

CFTC imposes $1.25 million civil penalty against Kraken for offering illegal off-exchange digital asset margin trading without registration.

CFTC Press Release

2022-11-28

OFAC settles with Kraken for $362,158 over 826 transactions processed on behalf of individuals in Iran between 2015 and 2019.

OFAC

2022-11-30

Kraken lays off approximately 1,100 employees, representing roughly 30% of its workforce.

Wikipedia

2023-02-09

SEC charges Kraken and the exchange settles for $30 million over failure to register staking-as-a-service program as a securities offering; US staking program discontinued.

SEC.gov

2023-04-01

Dave Ripley formally assumes role of CEO; Jesse Powell moves to board chairman.

Kraken Blog

2023-07-07

CoinDesk reports FBI is investigating Kraken co-founder Jesse Powell over alleged hacking and cyberstalking of Verge Center for the Arts nonprofit.

CoinDesk

2023-11-20

SEC files lawsuit charging Kraken with operating as an unregistered securities exchange, broker, dealer, and clearing agency; also alleges improper commingling of customer and corporate funds.

SEC.gov / CoinDesk

2024-06-09

Kraken receives a bug bounty alert about a zero-day vulnerability allowing artificial inflation of account balances; three individuals, later identified as including CertiK researchers, exploit the flaw and extract approximately $3 million from Kraken's treasury before the patch is deployed.

CoinDesk / BleepingComputer

2024-08-30

ASIC wins court case against Bit Trade (Kraken Australia) for distributing an unlawful margin product to retail customers; Kraken restricts fiat margin trading for non-wholesale Australian clients.

ASIC

2024-10-01

Kraken transitions to co-CEO structure with Dave Ripley and Arjun Sethi; lays off approximately 15% of workforce (around 400 employees).

Wikipedia

2024-12-13

Australian court orders Bit Trade (Kraken Australia) to pay AU$8 million (approximately US$5.1 million) for unlawful margin product distribution affecting more than 1,100 retail customers.

Decrypt / ASIC

2025-02-01

First insider threat incident identified: Kraken discovers a support employee had been recruited to provide improper access to limited client data after a tip about a video circulating on a criminal forum.

BleepingComputer

2025-03-03

SEC files joint stipulation with Kraken to dismiss its November 2023 lawsuit with prejudice, without penalties or required operational changes, citing shift in regulatory approach to crypto.

CoinDesk / Bloomberg

2025-03-20

Kraken announces agreement to acquire NinjaTrader, a US retail futures trading platform, for $1.5 billion — the largest deal combining traditional finance and cryptocurrency.

Kraken Press Release / BusinessWire

2025-04-08

Federal prosecutors inform Jesse Powell's attorney that the DOJ/FBI investigation into the Verge Center for the Arts nonprofit allegations has been closed without charges.

CoinDesk

2025-05-01

Kraken completes $1.5 billion acquisition of NinjaTrader.

BusinessWire

2026-04-13

Kraken publicly discloses it is being extorted by a criminal group threatening to release videos showing insider access to internal systems; approximately 2,000 accounts affected across two support-staff incidents; Kraken refuses to pay and engages law enforcement.

CoinDesk / BleepingComputer

2026-04-17

Kraken's parent company Payward announces agreement to acquire derivatives exchange Bitnomial for $550 million in cash and stock.

CoinDesk

model: claude-code-investigator

generated: 4/20/2026, 5:55:08 AM

avoid.net — verified advice for a post-truth world