# Is Kraken safe? Check before you connect | TradingAgentStack

> Kraken: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-24.

Canonical: https://tradingagentstack.com/check/kraken/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Kraken

# Is Kraken safe to connect?

Exchange · Multi-asset centralized exchange (spot, margin, futures). Checked 2026-10-24; every line links its source.

**Worst case:** Kraken holds your coins; regional rules have already forced it to delist XMR and auto-convert leftover balances to BTC, and a leaked key with both Withdraw and Add-Address permissions can send funds to an attacker.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Give bots keys with only query and order permissions; never combine 'Withdraw Funds' with 'Add Withdrawal Addresses'

2. Set IP whitelisting and a key expiration date on every API key

3. If you hold XMR on Kraken, check your region's availability notice and withdraw well before any deadline to avoid forced conversion

Kraken also has a full listing with an Agent Risk Score [Agent risk 76%](https://tradingagentstack.com/methodology/#agent-risk-score): [Kraken on TradingAgentStack](https://tradingagentstack.com/tool/kraken/).

## What it can do with your money

| Who holds the keys | The exchange holds your funds Custodial exchange account. [source](https://support.kraken.com/articles/360000380966-why-is-my-deposit-or-withdrawal-on-hold-) |
| --- | --- |
| Can funds be sent out to any address? | Yes. Withdrawals available; some are held temporarily (see the hold rules below). [source](https://support.kraken.com/articles/360000380966-why-is-my-deposit-or-withdrawal-on-hold-) |
| Can it hold or freeze your funds? | Kraken's help center lists hold reasons: a 72-hour withdrawal hold after ACH/PayPal/card/digital-wallet purchases, up to 7 days for ACH (Plaid) deposits, up to 24 hours on withdrawals to new addresses after a password change, holds requested by your bank for 'irregular activities', name mismatches, and over-limit deposits. Some holds release automatically, others need manual review by support. Kraken's full Terms could not be retrieved for this check. [source](https://support.kraken.com/articles/360000380966-why-is-my-deposit-or-withdrawal-on-hold-) |
| What a leaked API key can do | Each permission is chosen per key, including 'Withdraw Funds' and a separate 'Add Withdrawal Addresses' permission. Kraken says a third-party trading key would almost never need Withdraw Funds, and warns a key with both permissions could add an attacker's address and withdraw with no further verification. Optional IP whitelisting and Key Expiration (e.g. a key valid for one week) are available; neither is described as mandatory. [source](https://support.kraken.com/articles/withdrawal-addresses-api-permission) |
| Monero and Zcash | **XMR**: trade+deposit+withdraw where available (XMR/USD pair status 'online' in Kraken public API on 2026-10-24); delisted for EEA clients (trading/deposits halted 2024-10-31, balances left after 2024-12-31 converted to BTC) and Canada (trading disabled 2025-09-02); not offered to UK clients since 2021 [source](https://en.coin-turk.com/where-to-buy-monero-2026-exchanges-that-still-list-xmr/) **ZEC**: trade+deposit+withdraw (ZEC/USD pair status 'online' in Kraken public API on 2026-10-24) **Regions**: XMR not available to EEA, Canadian or UK clients [source](https://support.kraken.com/articles/support-for-monero-xmr-in-europe) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `kraken.com`

- X: `@krakenfx`

- X: `@krakensupport`

Where we confirmed these
- https://support.kraken.com/articles/201351886-how-to-follow-kraken-on-social-media (lists @krakenfx and support handle @krakensupport)

- https://www.coingecko.com/en/exchanges/kraken (twitter.com/krakenfx)

- https://docs.kraken.com/exchange/guides/rest/api-keys (official docs on kraken.com)

## Deadlines

- **2027-07-10**: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service. [source](https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2025-09-02 | XMR trading disabled for Canadian clients; accounts moved to withdraw-only for XMR (delisting) |  | clients told to withdraw or convert | [source](https://support.kraken.com/articles/notice-of-delisting-xmr-canada) |
| 2025-08-17 | Kraken paused XMR deposits after Qubic mining pool claimed >50% of Monero hashrate (withdrawals and trading stayed open); date is Cointelegraph's report date |  | temporary deposit pause 'until safe' | [source](https://cointelegraph.com/news/kraken-pause-monero-deposits-after-51-attack) |
| 2024-10-31 | XMR delisted for EEA clients; XMR still held after 2024-12-31 was force-converted to BTC (distributed by 2025-01-06) (delisting) |  | forced conversion to BTC at market rate | [source](https://support.kraken.com/articles/support-for-monero-xmr-in-europe) |
| 2024-06-19 | Researchers (CertiK) exploited a Kraken balance bug to withdraw nearly $3M | ~$3M | funds returned to Kraken; Kraken said client assets were not at risk | [source](https://www.theblock.co/post/300888/kraken-discloses-bug-exploited-for-nearly-3-million) |

## Check a link

Got a link, @handle or repo that claims to be Kraken? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Kraken

We email you if we add an incident, a freeze report, a known fake or a deadline for Kraken. Free; unsubscribe anytime.

## More checks: Exchanges
[Binance](https://tradingagentstack.com/check/binance/)[Bybit](https://tradingagentstack.com/check/bybit/)[OKX](https://tradingagentstack.com/check/okx/)[Coinbase Advanced](https://tradingagentstack.com/check/coinbase-advanced/)[Hyperliquid](https://tradingagentstack.com/check/hyperliquid/)[Bitget](https://tradingagentstack.com/check/bitget/)[Gemini](https://tradingagentstack.com/check/gemini/)[KuCoin](https://tradingagentstack.com/check/kucoin/)[MEXC](https://tradingagentstack.com/check/mexc/)[Gate](https://tradingagentstack.com/check/gate/)[HTX](https://tradingagentstack.com/check/htx/)[Crypto.com Exchange](https://tradingagentstack.com/check/crypto-com-exchange/)[BingX](https://tradingagentstack.com/check/bingx/)[Bitfinex](https://tradingagentstack.com/check/bitfinex/)[Bitvavo](https://tradingagentstack.com/check/bitvavo/)[Bitstamp](https://tradingagentstack.com/check/bitstamp/)[WhiteBIT](https://tradingagentstack.com/check/whitebit/)[Pionex](https://tradingagentstack.com/check/pionex/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)