Kraken Hit by 12,000 Unsolicited Transfers in Dust Attack

Nearly 12,000 unsolicited crypto transfers were sent to Kraken-linked addresses over eight days in August, triggering a wave of account freezes at the exchange. The incident, reported by Bloomberg, reignites a long-standing compliance question: what liability do exchanges bear when sanctioned funds arrive in wallets without the recipient's consent? The tactic is known as a dust attack. Small, unsolicited transfers from sanctioned or flagged addresses are sent to target wallets, potentially implicating recipients in sanctions violations under strict liability frameworks. Under the EU's regulatory structure in particular, receiving funds from a sanctioned address can trigger compliance obligations regardless of intent, forcing exchanges to freeze affected accounts while they investigate the source. The attack creates a dilemma for exchanges. Freezing accounts protects them from regulatory exposure but harms users who have done nothing wrong. Not freezing risks sanctions liability. There is currently no clean resolution under existing frameworks, which were designed for traditional finance where unsolicited fund movements are rare. For individual users, the incident is a reminder that wallet addresses are public and anyone can send funds to them. If you receive an unexpected small transfer from an unknown address, do not interact with it. Moving or swapping dust from a flagged address can propagate the taint to your other holdings and trigger exchange-side freezes on your account.