Why did Kraken restrict user accounts after an HTX-linked dust attack?

Kraken temporarily restricted thousands of user accounts to mitigate a 'dust attack' involving 12,000 micro-transfers originating from HTX-linked wallets. The exchange has since restored account access after confirming the security of its platform and user funds.

Kraken implemented temporary account restrictions after detecting a coordinated dusting campaign that involved approximately 12,000 tiny cryptocurrency transfers. These transactions were traced back to wallets associated with the HTX exchange (formerly Huobi). Kraken’s security systems flagged the high-volume activity as a potential threat, leading to the proactive freezing of affected accounts to prevent any potential breach or deanonymization of its users. The exchange has since confirmed that the situation is under control and all restricted accounts have been restored.

Dusting attacks occur when small amounts of crypto—so-called 'dust'—are sent to thousands of addresses to track the movement of funds or deanonymize wallet owners. In this instance, the sheer volume of transfers triggered Kraken’s automated defensive protocols. While the activity originated from HTX-linked infrastructure, HTX management has denied directing the activity, suggesting that the wallets may have been utilized by third parties or automated bots without the exchange's direct involvement.

For US-based crypto investors, this incident highlights the aggressive security stances taken by regulated domestic exchanges like Kraken. In an era of heightened regulatory scrutiny, US platforms often prioritize immediate account lockdowns when unusual on-chain patterns emerge to satisfy anti-money laundering (AML) and safety standards. This event serves as a reminder of the friction that can occur between heavily regulated US entities and offshore platforms with different operational standards.

Moving forward, traders should watch for potential changes in how US exchanges filter deposits from specific offshore origins. While no funds were lost in this attack, the incident may prompt Kraken and its peers to refine their automated triggers to better distinguish between malicious dusting and harmless high-frequency transfers. For now, the primary takeaway is the continued resilience of major exchange security stacks, though the event underscores the importance of maintaining diversified storage solutions outside of centralized platforms.