Is Kraken Safe? What Its Security Record Actually Shows

Kraken is one of the better-run exchanges in the industry, and that is worth saying plainly before anything else. It has operated since 2011, holds roughly 95% of client assets in air-gapped cold storage with multi-signature controls, publishes regular proof-of-reserves attestations, and has never lost client funds to a platform breach. Measured against the exchanges that failed between 2022 and 2023, that is a materially different risk profile.

But "safe" is not one question. It is four, and they have different answers. This page grades each separately, because the honest answer to "is Kraken safe" depends entirely on which risk you are asking about and how much bitcoin you are protecting.

Safe from what? Four risks, graded separately

1. Platform breach: strong record, with real incidents.

Kraken has not suffered a catastrophic loss of client funds. It has had incidents worth understanding.

In June 2024, someone claiming to be a security researcher exploited a zero-day flaw in Kraken's systems to withdraw roughly $3 million from the company's treasury, then demanded payment rather than returning it. Kraken treated it as a criminal matter. Note the important detail: the funds came from Kraken's treasury, not from client accounts.

More recently, two separate insider incidents in February 2025 and early 2026 involved customer support employees improperly accessing client data. Roughly 2,000 accounts were affected, about 0.02% of Kraken's user base. The exposure was limited to support-level information: names, addresses, KYC documentation, and support ticket history. No trading functions, financial controls, or account credentials were reached. In April 2026, Kraken disclosed an extortion attempt in which attackers claimed to hold video of internal systems showing client data. Kraken declined to pay and said no systems were breached and no client funds were at risk.

The pattern here matters more than any single event. Kraken's technical perimeter has held. The pressure point has been people with legitimate access, which is the same category of risk that produced the far larger Coinbase breach. Every exchange at scale employs support contractors, and support staff need to see customer data to do their jobs. That is a structural exposure, not a Kraken failing.

2. What you actually hold: a claim, not bitcoin.

This is the risk that has nothing to do with anyone doing anything wrong, and for large positions it is the one that matters most.

When your bitcoin sits on Kraken, you do not hold bitcoin. You hold a claim against Kraken for bitcoin. Kraken holds the keys. That distinction is invisible while everything works and decisive when it does not.

In an insolvency, a court has to decide whether the bitcoin is your property or part of the company's estate, and the answer turns on how custody was structured and what the account terms say. Assets pooled in an omnibus account under the exchange's name are harder to trace to you individually than bitcoin held in a wallet titled in your name. There is also a mechanism most holders have never heard of: under Section 547 of the bankruptcy code, an estate can claw back certain transfers made in the months before a filing, so withdrawing ahead of trouble is not automatically the end of the story.

None of that is a prediction about Kraken, which is in materially better condition than the platforms that failed in 2022. It is a statement about what a claim is. A pooled claim on a solvent company and segregated, client-titled bitcoin are different instruments that only look identical while everything is working.

Further reading: The Architecture of Failure · Can bitcoin be clawed back in a bankruptcy? · Can a custodian take title to your bitcoin?

3. Regulatory events: real, and survivable.

In February 2023, Kraken settled SEC charges over its staking-as-a-service program, paying $30 million and shutting the program down for US clients. It relaunched a compliant US staking product in January 2025 across 37 states and two territories, and the regulatory position on protocol staking has since shifted in the industry's favor.

The relevant lesson is not that Kraken behaved badly. It is that a regulatory action can remove a product you were using, on a timeline you do not control, without anyone being hacked. If your plan depends on a specific exchange feature continuing to exist, that plan has a dependency you cannot manage.

4. Your own account: the risk you actually control.

Most individual losses at any exchange are not platform breaches. They are account compromises: SIM swaps, phishing, credential reuse, and social engineering built on leaked personal data. This risk scales directly with how much you hold and how visible you are.

Kraken supports hardware-key two-factor authentication, which is meaningfully stronger than SMS. Use it. Then understand its limit: account security protects your account. It does not change who holds the keys.

Proof of reserves: what it proves, and for how long

Kraken deserves credit here. It runs one of the more rigorous proof-of-reserves programs in the industry: a Merkle-tree attestation performed by an independent third-party accountant, letting any client cryptographically verify their own balance is included without exposing anyone's personal details. The current attestation, dated June 30, 2026, verified client assets backed one-to-one and beyond across BTC, ETH, SOL, XRP, ADA, USDC, USDT, and USDG. Most exchanges publish nothing comparable.

Now the part that rarely gets said. An attestation is a photograph, not a video.

It proves that on one date, holdings matched liabilities. It does not prove anything about the day after. Kraken attests periodically rather than continuously, which means that for most of any given year, the most recent proof is months old.

This is not a Kraken criticism. It is the ceiling of the method, and it applies to every exchange that uses it. Our research team has written about this at length, because the gap between "proof of reserves" and "proof of ownership" is where a lot of holders assume protection that does not exist.

Further reading: The Proof of Reserves Illusion · Proof of reserves vs proof of ownership · Is proof of reserves enough? · Why proof of reserves did not prevent bitcoin hacks

Insurance: read the scope, not the headline

Kraken carries insurance through Lloyd's of London syndicates. Two limits are worth understanding before you treat that as a backstop.

It covers hot-wallet platform losses. That is roughly 5% of assets, the portion held online for liquidity. The 95% in cold storage is protected by the cold storage itself, not by that policy.

It does not cover you individually. If your account is compromised through phishing, a SIM swap, or social engineering, that is not a platform breach and the policy does not respond to it. This is the single most common misunderstanding about exchange insurance, and it is where most real-world individual losses actually occur.

And no exchange insurance is FDIC insurance. FDIC covers US dollar deposits at insured banks. It does not cover bitcoin anywhere, on any platform, including Kraken.

For comparison, and so the standard is concrete: Onramp's custody operations are insured through Canopius, a Lloyd's of London syndicate, under a $50 million active policy underwritten up to $100 million, at no cost to clients. The useful comparison is not the headline figure but what sits underneath it. Coverage over a pooled exchange book is a different proposition from coverage over a structure where each client's bitcoin is in its own segregated on-chain wallet and no single institution can move it alone.

The honest verdict, and who it fits

Kraken is a reasonable choice for active trading and for balances you can afford to have frozen, hacked, or tied up in a legal process. The security engineering is real, the proof-of-reserves program is above industry standard, and the track record on client funds is clean. For someone trading regularly, the liquidity and tooling are the point.

It is a poor resting place for a position that would change your life if you lost it. Not because Kraken is badly run, but because the architecture is single-custodian by design. One company holds the keys, one account controls access, one insolvency proceeding decides what you own. Those are properties of the model, not flaws in the operator, and no amount of good management removes them.

The question worth asking is not whether Kraken is safe in the abstract. It is whether single-custodian exchange custody is the right architecture for the specific amount you are protecting, and that answer changes as the amount grows.

If you are at that point, the alternatives are worth understanding: self-custody, where you hold the keys and take on the operational burden permanently; collaborative custody, where you hold most keys and a provider holds a backstop; and multi-institution custody, where three independent institutions hold keys, any transaction requires two of them, and your bitcoin sits in a segregated on-chain wallet titled to you that you can verify on any block explorer. Each is a real trade-off, and self-custody is a legitimate path we respect. What they share is that no single company failing takes your bitcoin with it.

Further reading: Bitcoin custody: self vs third party · How does multi-institution custody work? · Moving your bitcoin off an exchange

Frequently asked questions

Has Kraken ever been hacked?

Kraken has never lost client funds to a platform breach. It has had incidents. In June 2024, someone exploited a zero-day flaw to withdraw roughly $3 million from Kraken's own treasury, not from client accounts. In February 2025 and early 2026, two insider incidents involved support employees improperly accessing data for about 2,000 accounts, roughly 0.02% of users, limited to names, addresses, KYC documents, and support tickets. No credentials or trading functions were reached.

Is Kraken insured?

Kraken carries insurance through Lloyd's of London syndicates covering hot-wallet platform losses, which is roughly 5% of assets held online. It does not cover individual account compromises from phishing, SIM swaps, or social engineering, and no exchange insurance is FDIC insurance. FDIC covers US dollar deposits at insured banks and does not cover bitcoin on any platform.

What happens to my bitcoin if Kraken goes bankrupt?

You would hold a claim against Kraken rather than the bitcoin itself, and a court would decide whether those assets are your property or part of the estate. The outcome depends on how custody was structured and what the account terms say. Assets pooled in an omnibus account are harder to trace to an individual than bitcoin held in a wallet titled in your name. Section 547 of the bankruptcy code also allows an estate to claw back certain transfers made in the months before a filing.

Does Kraken's proof of reserves mean my bitcoin is safe?

It proves that on the attestation date, Kraken's holdings matched or exceeded client balances, verified by an independent third-party accountant using a Merkle tree that lets you confirm your own balance is included. The current attestation is dated June 30, 2026. It does not prove anything about any other date, and it proves reserves in aggregate, not that specific bitcoin is legally yours. Proof of reserves is necessary but not sufficient.

Is Kraken safer than Coinbase?

Both are regulated US exchanges with real security programs. Kraken has the stronger proof-of-reserves practice and a cleaner breach record on client data; Coinbase is larger, publicly traded, and files SEC disclosures. The more useful point is that the difference between them is smaller than the difference between any single-custodian exchange and a custody model where no one institution can move your bitcoin alone.