Kraken says a criminal group is threatening to release videos of internal systems unless the exchange pays up. The company says it won’t negotiate and is working with federal law enforcement to identify those responsible.

Crypto exchange Kraken disclosed Monday that a criminal group is attempting to extort the company by threatening to release videos of internal systems containing client data. Chief Security Officer Nick Percoco said the exchange will refuse all demands and is working with federal law enforcement to pursue arrests.

The extortion follows two distinct insider incidents. The first took place in February 2025, when a video showing Kraken’s internal client support systems surfaced on a criminal forum. Kraken identified the individual responsible, revoked access, tightened controls, and notified affected users. A second, more recent incident followed a similar pattern. Across both events, roughly 2,000 client accounts were potentially viewed, representing 0.02% of the exchange’s customer base.

This story is an excerpt from the Unchained Daily newsletter.

Percoco said the criminals began sending extortion demands shortly after Kraken shut down access in the second incident, threatening to distribute materials from both episodes to media outlets and across social media if the exchange didn’t comply. “Our systems were never breached; funds were never at risk,” Percoco wrote on X. “We will not pay these criminals; we will not ever negotiate with bad actors.”

Kraken said the incidents reflect a broader pattern of insider recruitment targeting not only crypto firms but also gaming and telecommunications companies. The exchange stated it believes there is sufficient evidence to support identification and arrest of those responsible, and has been coordinating with industry partners on disruption efforts. Galaxy Digital, founded by Mike Novogratz, separately disclosed it recently contained a cybersecurity incident involving unauthorized access to an isolated development workspace, though the company said it was unrelated to Kraken.

The disclosure is particularly sensitive given that Kraken’s parent company, Payward Inc., is currently pursuing a multibillion-dollar IPO. Insider threats have become a rising concern across the digital asset industry, with criminal networks increasingly targeting employees with system access rather than attacking exchange infrastructure directly.