Negative Kraken Erfahrungen

---

Kraken always claims that it is the most secure crypto portal. But this is definitely not true. Here is my story: In September 2021, after half a year of inactivity, I wanted to log-in again into my account. I went to kraken.com and entered my user name and password. After that I received an eMail from Kraken at 1:48pm for a „device confirmation“. Since I am entering Kraken always with my secure company notebook, I have to confirm my device for every login. As usual the eMail listed my browser „Chrome (Windows)“ and an IP address which I never checked. I confirmed my device by using the code given in the eMail. Then I had to enter the one-time code for the 2 factor authentication which is generated by the app on my mobile. I tried several times, but I could not log-in. At 1:49pm I received an eMail from Kraken with the following description: „Account blocked, unblock it urgently, clicking on the link below." Since this was an original Kraken eMail and since I wanted to log-in, I clicked on the given link. At 1:52pm I received two further Kraken eMails „You have successfully updated your 2FA method.“ But I still couldn’t log-in and I also couldn’t reset my password. At 1:54pm another Kraken eMail: "Bitcoin - Purchase Successful, Transaction Summary: Transaktion ID: XXXXXX, Payment Method: Euro account Balance“. Shortly after the next Kraken eMail: "Kraken Alert: Withdrawal Requested“. The eMail stated that I should immediately contact Kraken support, if I didn’t authorize the withdrawal. So I desperately started searching for the contact possibilities on the Kraken homepage. I lost valuable minutes in finding the correct form and filling out the right options. I finally sent it with the title „My account got hacked“. At 2:15pm Kraken support confirmed my request. It took me multiple calls and eMails until my account was finally unlocked 4 days later by Kraken support. Only now I learned that someone bought BTC with my balance of > 10.000€ on my account at 1:53pm. At 2:11pm (exactly during the time I struggled with filling out the request form) the BTC have been transferred to another address. So I contacted Kraken again, and they said that I should file a report to police which I did. Never heard something again from the police, even after 6 months. The perfidious point here is, that all eMails for device confirmation or the withdrawal have been original Kraken eMails. The hackers exploited the fact that they could just enter a free text in the description field of the withdrawal eMail. And this is a real security hole in the Kraken system. All the eMails I received at the beginning where original Kraken eMail and where expected by me, because I was used to them from my previous Kraken logins.

---