~£400k of XRP/XLM withdrawn minutes after a first-ever new-device login. Two sessions were on the account at once — the intruder adding withdrawal addresses while I, logged in on my own phone, removed my registered one and tried to delete theirs.

On 10 July 2025 my Kraken account was accessed from a device type it had never once been used on, on a network it had never used. The account's own activity record shows two sessions on two different IP addresses acting at the same time. One of them was the intruder, adding brand-new withdrawal addresses labelled to look internal (“Kraken”, “Kraken1”, “Ledger”). The other was me: logged in on my own phone, I removed my own registered withdrawal address and tried to delete the ones the intruder had just added. An account holder and an intruder were changing the withdrawal list at the same moment — exactly the kind of conflict a real-time monitoring system should treat as a red flag. About 80,009 XRP and 214,449 XLM — roughly £400,000 — were withdrawn to addresses that had been added around sixty seconds earlier. By the time the account was blocked, both withdrawals had already completed and the funds were gone. I reported it immediately. The answer I received was that, under the Terms of Service, I was responsible. I have never recovered the money. I'm sharing this in anonymised form so that anyone who has been through the same thing knows they are not the only one — and so the pattern is on the record.