Is Kraken safe? What the record actually shows

The track record: trading since 2013, no customer-funds breach

Kraken was founded in 2011 by Jesse Powell, Thanh Luu and Michael Gronager, and its origin is a security story. Powell had travelled to Tokyo to help Mt. Gox recover from a hack, saw how badly it was run, and decided the industry needed an exchange built properly. The first two years were build, not business: the exchange opened for trading in September 2013, with Bitcoin, Litecoin and euro pairs. It has run ever since, through the Mt. Gox collapse and the 2022 failures that took down Celsius, Voyager, BlockFi and FTX.

The claim that Kraken has never been hacked is close to true but not true as stated, so it is worth stating precisely. No documented breach of Kraken's systems has resulted in customer funds being stolen from customer balances. Kraken's systems have been exploited once, in June 2024, when roughly $3 million left the company, and that case is covered below. On withdrawals, Kraken has never halted them because it could not meet redemptions, which is the failure mode that actually wipes people out. It has had outages and maintenance windows during which withdrawals were unavailable, notably a January 2018 platform upgrade scheduled for two hours that ran to nearly 48.

The parent is Payward, Inc., privately held and based in San Francisco, run by co-CEOs Arjun Sethi and Dave Ripley, with Powell as chairman since stepping down as CEO in 2023. Payward filed confidentially for a US listing in November 2025 and paused those plans in March 2026. Until it lists it publishes no audited financial statements, a gap that returns below.

Who regulates Kraken, jurisdiction by jurisdiction

Kraken is not one company with one licence but a group of entities, each authorised for something specific, and those differences decide what you are protected against. The table is from Kraken's own licensing disclosure, August 2026.

For EU and EEA users the first row matters most. Payward Europe Solutions Limited was authorised as a crypto-asset service provider under MiCA by the Central Bank of Ireland on 25 June 2025, the first MiCA authorisation Ireland granted. The licence passports across the EEA and brings obligations on capital, custody, governance and segregation of client assets. It does not bring a compensation scheme.

In the UK, read the register wording carefully. Payward Limited's FCA registration is under the money laundering regulations, so the FCA supervises Kraken's anti-money-laundering controls. It does not make the crypto business FCA-authorised the way an investment firm is, and it does not put your crypto under the Financial Services Compensation Scheme. Kraken says as much itself: fiat held as e-money is safeguarded in separate client accounts but is not FSCS-covered.

In the US the activities are split across a FinCEN-registered money services business for spot, a CFTC-registered futures commission merchant for derivatives, a broker-dealer for securities, and a Wyoming special purpose depository institution. SIPC membership on the broker-dealer side does not extend to spot crypto.

Proof of reserves: what it proves and what it does not

An independent accounting firm snapshots every client balance in the assets under review, anonymised, and hashes them into a Merkle tree, combining all balances into one cryptographic fingerprint, the Merkle root, without exposing individual holdings. Kraken separately proves control of the on-chain addresses holding the matching assets by signing messages with the private keys. If the on-chain total meets or exceeds the client total, reserves were fully backed at that instant.

The part that matters to you is self-verification. Kraken gives you a record ID and a nonce so you can check that your own balance was in the tree that was counted. Be precise about what that buys you. Merkle-tree self-verification is not rare, Binance and several other large exchanges offer a version of it, and an omitted account is detectable only by the holder of that account, and only if they actually run the check, which almost nobody does. It therefore deters quietly excluding large accounts rather than proving the liability list is complete. Kraken's genuine differentiator is who runs the review: an independent accounting firm under agreed-upon-procedures standards, where Binance moved to self-attestation.

Now the limits, most of which Kraken states itself. It is a snapshot, not a continuous guarantee. It covers a defined list of assets, and in the 30 June 2026 review that was Bitcoin, Ether, Solana, XRP, Cardano, USDC, Tether and USDG, across spot, staking, margin and futures collateral, not everything on the platform. Kraken states the procedure cannot prove exclusive possession of the private keys, and cannot identify hidden encumbrances or prove funds were not borrowed to pass the review. The latest snapshot as of August 2026 was dated 30 June 2026.

Above all, proof of reserves is not an audit. An audit examines a company's whole position: liabilities, borrowings, related-party dealings, whether it can meet its obligations. A proof of reserves compares the in-scope client liabilities against the on-chain assets at a single moment. It does not prove that the client-liability list it started from was complete, and it covers none of Kraken's other obligations, such as corporate borrowings or assets already pledged elsewhere.

Where your coins sit, and the insurance question

Kraken holds client crypto in a mix of cold storage, meaning keys generated and kept offline, and hot wallets for day-to-day withdrawals. It describes infrastructure in secure cages under 24-hour surveillance in undisclosed locations, with no single employee able to access the physical systems alone, and a security program certified to ISO/IEC 27001 that has been through SOC 2 examination. Kraken does not publish an exact cold-to-hot split, and the roughly 95% figure circulating on review sites comes from third parties.

Then insurance, which is widely misunderstood. Kraken's own legal disclosures state that digital assets and Kraken accounts are not covered by insurance against losses, and are not subject to Federal Deposit Insurance Corporation or Securities Investor Protection Corporation protections in the United States, or those of any comparable organisation anywhere else. Its help centre is blunter: exchanges do not qualify for deposit insurance programs because they are not savings institutions.

One narrow exception: fiat held through Kraken's e-money entities is safeguarded in segregated client accounts, keeping it separate from the firm's own funds if the firm fails. Safeguarding is real protection but not a compensation scheme, and Kraken states that UK e-money is not FSCS-covered. So there is no bank-style guarantee here, or anywhere else in crypto. What you get is a licensed custodian with segregation obligations and a long clean record, which beats an unlicensed offshore platform and is not the same as insured money.

The settings that matter more than Kraken's own security

Almost every retail crypto loss happens at the account level, not the exchange level: phishing pages, SIM swaps, malware, reused passwords, a convincing support impersonator on Telegram. Kraken's controls are only as good as the ones you switch on, and by default you use almost none of them.

If you do only two, make them a passkey for sign-in and address whitelisting behind the Global Settings Lock.

• Sign-in 2FA with a passkey or hardware security key. Both resist phishing in a way authenticator codes do not, and Kraken itself advises replacing SMS 2FA, which is what a SIM swap defeats.
• Separate 2FA layers for withdrawals, trading and API access, so a hijacked session cannot move funds without a second challenge.
• A Master Key, a backup credential protecting against password resets. Kraken advises setting one up before enabling the Global Settings Lock.
• The Global Settings Lock, which freezes settings and withdrawal addresses on a timer, so an attacker holding your password cannot add a new address. Kraken support cannot speed up its removal, which is the point.
• Withdrawal address whitelisting, so funds only go to addresses you approved in advance, with email confirmation for new ones.
• API keys scoped to the minimum permissions the tool needs, with withdrawal rights off unless you need them.

The incidents and fines, in proportion

A platform trading since 2013 through a shifting regulatory environment has a file. Pretending otherwise is how affiliate pages lose credibility, so here is the actual list, in full. Two of the entries below need reading carefully, and it is worth setting them up first.

The June 2024 case below reads both ways. Kraken says customer balances were never at risk and that cold storage was never touched, and on its account the money came from its own treasury and came back. Detecting a critical flaw in minutes and patching it within the hour is what a mature security operation looks like. Equally, a bug that let a balance be inflated reached production, and the reassuring half of that account is Kraken's own description of its own incident, which no outside party has verified.

What is absent from the list is the category that actually destroys people: a solvency failure, a halt on withdrawals because the money was not there, or a theft of customer holdings. Kraken has not had one. The other regulatory items are compliance and registration failures, a different order of problem. The Australian entry at the end is the exception and deserves to be read as one, because real retail customers were sold a credit product a court found had been distributed unlawfully, and they lost real money using it.

• September 2021, CFTC: a $1.25 million penalty for offering margined retail commodity transactions to US customers who were not eligible contract participants, without registering as a futures commission merchant.
• November 2022, OFAC: a settlement of $362,158.70 plus $100,000 committed to additional sanctions compliance controls, resolving 826 apparent violations of the Iranian Transactions and Sanctions Regulations. Those were transactions worth about $1.68 million processed for users who appeared to be in Iran, because Kraken had not implemented geolocation and IP blocking promptly. Kraken disclosed it voluntarily and OFAC treated the violations as non-egregious.
• February 2023, SEC: Kraken paid $30 million and shut its US staking-as-a-service program, which the SEC said was an unregistered securities offering. Settled without admitting or denying the findings. The case concerned US clients only and European staking was never part of it, so if you stake on Kraken in the EU this action did not touch your product. US customers lost access to a product rather than to their assets, and Kraken relaunched on-chain staking for US clients in January 2025 across most states.
• November 2023, SEC: a lawsuit alleging Kraken operated as an unregistered exchange, broker, dealer and clearing agency, dismissed with prejudice in March 2025 with no penalty and no admission. The SEC said the dismissal reflected its wider change of approach to crypto rather than any assessment of the merits, which is worth reading honestly rather than as vindication.
• June 2024, the CertiK incident: a bug in Kraken's funding system let a balance be credited before a deposit had fully settled. Kraken says it identified the flaw within minutes of a 9 June bug bounty report and patched it within about an hour, but the reporter had shared it with two others who withdrew close to $3 million. Kraken called the subsequent demand extortion, and the funds were returned that month.
• August and December 2024, ASIC: the one item here where customers lost money. On 23 August 2024 the Australian Federal Court found that Bit Trade Pty Ltd, Kraken's Australian operator, had breached its design and distribution obligations by making a margin extension product available from 5 October 2021 without first issuing a target market determination. The court held the product was a credit facility. ASIC says over 1,100 Australians were charged more than US$7 million in fees and interest on it and suffered trading losses of more than US$5 million between them, including one investor who lost almost US$4 million. On 12 December 2024 the court ordered Bit Trade to pay a penalty of A$8 million plus ASIC's costs.

Frozen accounts: the risk people underestimate

The most common complaint about Kraken, and about every regulated exchange, is not hacking. It is a sudden restriction: withdrawals blocked, documents requested, days or weeks of waiting with your money visible on screen and untouchable. That is the direct cost of regulation, and much of the intervention is automated, so it lands on innocent people too.

Kraken lists its own reasons: a detected security issue or malicious activity targeting you, attempted transfers to wallets associated with prohibited, illegal or scam-related activity, a chargeback or reversal by your bank or card issuer, incomplete verification or failure to respond to a request for information, and terms violations. A restriction may disable crypto withdrawals while still allowing conversion to fiat and a bank withdrawal, reduce funding limits, or hold transfers for review. Kraken states that restrictions applied for scam prevention cannot be lifted before 90 days, probably the most useful thing to know before you deposit.

You reduce the odds by keeping verification current, replying quickly with documents, funding from your own bank account rather than someone else's, avoiding card deposits that can be reversed, and not sending funds to addresses linked to gambling services, mixers or scam infrastructure. None of it is a guarantee. If you need unconditional access to your money at all times, a custodial exchange is the wrong place for it.

It is worth knowing that this is where Kraken's public reputation is weakest. On Trustpilot on 15 August 2026 Kraken scored 3.2 from around 8,000 reviews, against Coinbase's 4.0 from around 23,000. Both companies solicit reviews and unhappy people write more of them, so treat that as a rough signal rather than a verdict. It is still the clearest single number that runs against Kraken.

Kraken against Coinbase and Binance, on safety alone

These three are not equivalent, and on safety specifically they trade off differently. Fees, coin selection and interface are separate arguments this section ignores.

Where Coinbase is genuinely better: financial transparency. It is listed, so its accounts are audited and public, its custody arrangements appear in filings that carry legal liability, and it discloses a specific crime insurance limit rather than declining to insure at all. Proof of reserves is a clever substitute for public accounts; audited public accounts are the real thing. Read the insurance line carefully though, because a corporate crime policy covers theft at company level, not your account, and does nothing if your own credentials are compromised or the price falls. Coinbase is not incident-free either: in May 2025 criminals bribed outsourced support contractors for access to internal tools and took contact and identity data for roughly 69,000 customers, then demanded $20 million, which Coinbase refused. No funds or private keys were taken directly, but that data is still circulating and fuels impersonation calls.

Where Kraken is clearly stronger than Binance, at least in the EU: Binance did not hold a MiCA licence when the transitional period for existing national registrations ended on 30 June 2026, and told EU users it would restrict services, having withdrawn its Greek application in late June and said it would apply in France instead. Binance is the largest exchange in the world by volume and generally the cheapest to trade on, and its 2019 hot wallet hack was covered in full from its own SAFU reserve. But regulatory limbo in your jurisdiction is a different category of risk, and SAFU is a self-funded reserve the company controls, not an insurance contract with an outside underwriter.

What no exchange can protect you from

FTX is why this question gets asked thousands of times a month, so it is worth naming what happened. FTX was not brought down by a hacker. Customer deposits were routed to an affiliated trading firm, with no meaningful board, no functioning financial controls, no credible auditor and no regulator with real visibility into where the money sat. It collapsed because it was lying about where the money was.

The structural differences at Kraken are specific: supervised entities in Ireland, the UK, the US, Australia and elsewhere, client-asset segregation obligations under MiCA, published attestations you can check against your own balance, and no history of halting withdrawals because it could not meet redemptions. Those were precisely the things absent at FTX. They lower the probability of that failure considerably, not to zero.

Every custodial exchange carries counterparty risk. Your balance is an entry in someone else's database and a claim on their reserves, not coins you control. Not your keys, not your coins is not a slogan, it is the legal position. A hardware wallet takes the exchange out of the equation and hands you a different risk, because losing your seed phrase means losing the funds permanently.

Then the risk that dwarfs all of it: price. Nothing here protects you from Bitcoin falling 60%, or a smaller token going to zero. A perfectly secure, fully licensed exchange with published reserves will custody your asset flawlessly while it loses most of its value. Crypto is a high-risk asset and you can lose money on it regardless of platform. Nothing here is investment advice, and how much to hold, if anything, is not a question an exchange review can answer.

Kraken's referral offer, factually

Kraken runs a refer-a-friend program, and here are the mechanics as stated on Kraken's own pages in August 2026. The public referrals page shows a reward of up to $20 for you and a matching amount for the friend you invite, paid in USDG, with a cap of around $200 in total. Other regional campaigns have advertised higher figures, and Kraken's referral terms confirm that amounts, caps and criteria are set per plan rather than fixed globally.

The conditions are easy to fall foul of. The person you invite must be genuinely new to Kraken, meaning they have never created an account before, and the two of you must live in the same country, or both live in eligible European Economic Area countries. They then have to deposit fiat from a bank account and complete a qualifying trade within the criteria window, currently 15 days. Stablecoin trades do not count, so buying USDT will not trigger it. Kraken says to allow around 14 days for the bonus to credit.

Offers change often and terms differ by country, so check the current figures on Kraken's referrals page before relying on any number, including these. And to be blunt: a $20 bonus is not a reason to choose where to keep your money. A bonus does not offset risk.

Frequently asked questions