Is Kraken safe to connect?
Exchange ยท Multi-asset centralized exchange (spot, margin, futures). Checked 2026-10-24; every line links its source.
Worst case: Kraken holds your coins; regional rules have already forced it to delist XMR and auto-convert leftover balances to BTC, and a leaked key with both Withdraw and Add-Address permissions can send funds to an attacker.
Safe setup in 3 steps
- Give bots keys with only query and order permissions; never combine 'Withdraw Funds' with 'Add Withdrawal Addresses'
- Set IP whitelisting and a key expiration date on every API key
- If you hold XMR on Kraken, check your region's availability notice and withdraw well before any deadline to avoid forced conversion
Kraken also has a full listing with an Agent Risk Score Agent risk 76%: Kraken on TradingAgentStack.
What it can do with your money
| Who holds the keys | The exchange holds your funds Custodial exchange account. source |
|---|---|
| Can funds be sent out to any address? | Yes. Withdrawals available; some are held temporarily (see the hold rules below). source |
| Can it hold or freeze your funds? | Kraken's help center lists hold reasons: a 72-hour withdrawal hold after ACH/PayPal/card/digital-wallet purchases, up to 7 days for ACH (Plaid) deposits, up to 24 hours on withdrawals to new addresses after a password change, holds requested by your bank for 'irregular activities', name mismatches, and over-limit deposits. Some holds release automatically, others need manual review by support. Kraken's full Terms could not be retrieved for this check. source |
| What a leaked API key can do | Each permission is chosen per key, including 'Withdraw Funds' and a separate 'Add Withdrawal Addresses' permission. Kraken says a third-party trading key would almost never need Withdraw Funds, and warns a key with both permissions could add an attacker's address and withdraw with no further verification. Optional IP whitelisting and Key Expiration (e.g. a key valid for one week) are available; neither is described as mandatory. source |
| Monero and Zcash | XMR: trade+deposit+withdraw where available (XMR/USD pair status 'online' in Kraken public API on 2026-10-24); delisted for EEA clients (trading/deposits halted 2024-10-31, balances left after 2024-12-31 converted to BTC) and Canada (trading disabled 2025-09-02); not offered to UK clients since 2021 source ZEC: trade+deposit+withdraw (ZEC/USD pair status 'online' in Kraken public API on 2026-10-24) Regions: XMR not available to EEA, Canadian or UK clients source |
Official links
- Website:
kraken.com - X:
@krakenfx - X:
@krakensupport
Where we confirmed these
Deadlines
- 2027-07-10: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service. source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2025-09-02 | XMR trading disabled for Canadian clients; accounts moved to withdraw-only for XMR | clients told to withdraw or convert | source | |
| 2025-08-17 | Kraken paused XMR deposits after Qubic mining pool claimed >50% of Monero hashrate (withdrawals and trading stayed open); date is Cointelegraph's report date | temporary deposit pause 'until safe' | source | |
| 2024-10-31 | XMR delisted for EEA clients; XMR still held after 2024-12-31 was force-converted to BTC (distributed by 2025-01-06) | forced conversion to BTC at market rate | source | |
| 2024-06-19 | Researchers (CertiK) exploited a Kraken balance bug to withdraw nearly $3M | ~$3M | funds returned to Kraken; Kraken said client assets were not at risk | source |