23 min ago2 min readKraken received nearly 12,000 low-value transactions. (PiggyBank/ Unsplash)SummaryKraken briefly locked some users out of accounts following a "dust attack" involving nearly 12,000 tiny transfers from wallets linked to sanctioned rival HTX.The activity, appearing to spread sanctioned funds to trigger account restrictions, occurred Aug. 17-24.Kraken's compliance team restored access while holding the funds and is investigating the attack, which leverages blockchain transparency to bypass sanctions.Crypto exchange Kraken briefly locked some customers out of their accounts after wallets labeled by Arkham Intelligence as belonging to rival HTX, which is under European Union sanctions, sent nearly 12,000 low-value transfers to Kraken-linked addresses.Arkham data shows transactions from HTX wallets to other exchanges taking place between Aug. 17 and Aug. 24, though these could have been initiated by users. Kraken said the transactions, each valued from a few cents to a few dollars, appeared designed to spread sanctioned funds across other platforms and trigger account restrictions when the assets landed in customer deposit addresses.“We don’t know who is behind these attacks, but they likely expect that if sanctioned funds land in a client account, it triggers a full account lock,” Kraken said in a statement shared with CoinDesk.HTX, which counts TRON blockchain founder Justin Sun as an adviser, said an internal review found no official accounts were responsible for related microtransactions. In a post on X, it said it was investigating whether the sending wallet was misidentified or a third party was responsible.Some Kraken customers were briefly locked out on the first day the activity was noticed. The exchange said its compliance team restored access while continuing to hold the sanctioned funds, and is working with authorities to “ensure these attacks don’t have their intended impact.”The tactic, known as a dust attack, turns sanctions screening into a form of offense. Public blockchains allow anyone to send crypto to any address, meaning an attacker can create a link between sanctioned funds and an otherwise unrelated user for little cost.The U.K. sanctioned HTX in May, imposing an asset freeze after authorities said they had reasonable grounds to suspect it provided financial services to Russia-linked payment network A7 and crypto exchange Garantex, which is itself under sanctions. HTX has rejected the U.K.’s allegations. The European Union added HTX to a transaction ban in July as part of a wider crackdown against Russia. The EU ban took effect on Aug. 23, while the transactions were occurring.This isn’t the first time sanctioned crypto has been leveraged against others. In 2022, an unidentified sender sent ether from sanctioned mixer Tornado Cash to a number of celebrities. U.S. authorities later said they would not prioritize enforcement over delayed reports from recipients of unsolicited, nominal transfers.CoinDesk reached out to HTX for comment, and hadn’t heard back at the time of writing.12345678910Anvil: The Missing Collateral LayerAnvil: The Missing Collateral LayerAnvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.Jul 29, 2026Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.Why it matters:Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.View Full Report