“Security above everything.” Then, in ten minutes, about $400,000 was gone.
“Security above everything” is Kraken's own security tagline. This is one customer's documented account of what happened anyway — told in anonymised form from the case file, including the exchange's own account-activity report. It is the reporter's allegation, not a finding of fact. Read it beside Kraken's security promises, and judge for yourself.
A timeline reconstructed from the exchange's own activity report.
- A first-ever device signs in. The login comes from a Windows machine the account had never once used — its entire history is Mac and iOS — on a different network from the account's usual ISP. The unfamiliar device is waved through after an email approval.
- Two devices, at the same time. Within the same two minutes, two separate sessions act on the account at once: a Windows browser on one IP adding brand-new withdrawal addresses, while an iOS phone on another IP deletes the account's long-standing trusted ones. Two sessions simultaneously tearing down and rebuilding the withdrawal list is a textbook takeover signal.
- The whitelist is replaced wholesale. Every saved, trusted address is removed and new ones — labelled to look internal (“Kraken”, “Kraken1”, “Ledger”) — are added in their place.
- Drained in ~60-second windows. About 80,009 XRP and 214,449 XLM — roughly $400,000 — leave the account, withdrawn to addresses that had been added around sixty seconds earlier.
- The block comes too late. The account is locked only after both withdrawals have already completed. The funds are gone.
Two points the reporter adds. On location: the log shows both sessions as “UK” because the mobile network home-routes roaming traffic through the UK — so a phone abroad still appears as a UK exit. The reporter was in fact in another country at the time, meaning the single “UK” location masks two people in two places. On the email approvals: yes, the new device and the new addresses were each “approved via email confirmation” — but that is exactly the point. The behavioural red flags here — a first-ever device, two simultaneous sessions, the wholesale replacement of the withdrawal list, and maximum-value withdrawals sixty seconds after an address is added — are independent of the email, and are precisely what “real-time monitoring for suspicious activity” is supposed to catch.
What's marketed, and what the record shows.
The left column is Kraken's own wording, quoted from its public security page. The right column is what this customer's case records describe. Read both, and decide whether the marketing matched the protection.
“Industry-leading security keeps your assets safe on our platform.”
A device type the account had never once used logged in — and the account was emptied in roughly ten minutes.
“Constant, real-time monitoring for suspicious activity.”
Two separate devices on two IPs acted in the same two minutes — one adding new withdrawal addresses while the other deleted every trusted one — yet not a single withdrawal was paused for a check.
“Email confirmations for adding new withdrawal addresses.” · “Global settings time lock … for when you're away.”
Maximum-value withdrawals still went to addresses added about sixty seconds earlier. The reporter's view: the safeguards that fired leaned on the customer's email, while the platform's own monitoring did not stop the drain.
Tagline: “Security above everything.”
The account was blocked only after both withdrawals had already completed and the funds were gone. Reimbursement was then declined, citing the Terms of Service.
Quotes in the left column are Kraken's own marketing, reproduced from its security page (kraken.com/features/security, checked June 2026). Verify them yourself there.
A first-ever device, a new network, two sessions at once, every trusted address deleted, and maximum-value withdrawals to sixty-second-old addresses. Should “industry-leading” suspicious-activity detection have paused that before the money left? The user says yes. You decide.
The exchange declined to reimburse, relying on Terms of Service that make the customer responsible for account security. The user's position is that, under the UK Consumer Rights Act 2015, a term cannot exclude a firm's liability for its own negligence — so whether the monitoring was adequate is still a live question, not one the small print can simply close.
This is the reporter's argument, summarised — not legal advice, and not a court's conclusion.
Don't take anyone's word — including ours. Read the exchange's published security claims, ask any exchange for your full account-activity report (devices, IPs, timestamps), and trace stolen funds on public explorers (xrpscan.com, stellar.expert). See the resource library for the real complaint channels.