Kraken User Loses $18.2M in Crypto Attack via Thorchain

A Kraken user lost $18.2 million in a suspected social engineering attack, with the stolen funds then moving through THORChain, according to on-chain investigator ZachXBT. The case matters beyond one wallet. It shows how account compromise, rapid cross-chain routing, and irreversible withdrawals can turn a single phishing or impersonation event into an eight-figure loss within hours. Here is what is verified so far, what Kraken’s own security guidance says, and why THORChain keeps appearing in these laundering trails.

What Is Verified About the $18.2 Million Theft

The core claim is straightforward. An unidentified Kraken user lost $18.2 million in crypto in a suspected social engineering attack, and the stolen assets were observed moving through THORChain. A Reddit post summarizing the incident, published on March 31, 2026, said the threat actor had started bridging funds about 45 minutes earlier from Ethereum to Bitcoin using a SafePal wallet, citing ZachXBT’s reporting trail. That post is not a primary source, but it aligns with a pattern already documented in multiple ZachXBT-linked investigations involving fast post-theft routing through cross-chain infrastructure.

What can be stated with confidence is narrower than the headline noise. First, the reported loss amount is $18.2 million. Second, the alleged attack vector is social engineering rather than an exchange-wide platform exploit. Third, THORChain is identified as part of the movement path for the funds. Those three points are consistent with the available public references tied to the story. What has not been independently confirmed from a public Kraken incident bulletin is the exact wallet addresses, the precise asset mix, or the exact minute the victim’s account was compromised.

That distinction matters. Social engineering attacks are different from exchange hacks. In these cases, the exchange’s infrastructure is not necessarily breached. Instead, the attacker manipulates the user into handing over credentials, approving malicious actions, or exposing recovery information. Kraken’s own support documentation repeatedly warns that phishing pages, fake support contacts, and lookalike sign-in links can trick users into surrendering credentials and two-factor authentication codes. Kraken says users should only sign in through its official page and notes that once an attacker gets inside an account, they can generate and approve withdrawal addresses, potentially allowing the removal of funds.

Why THORChain Keeps Showing Up in Social Engineering Cases

This is the bigger angle, and it is the one many quick write-ups miss. THORChain is not the cause of the theft. It is part of the escape route. In case after case tied to social engineering, attackers do not leave funds sitting on the original chain for long. They move fast, swap assets, bridge value across networks, and try to break the clean forensic line that investigators use in the first minutes after a theft.

That pattern is visible in earlier 2026 reporting around a much larger social engineering theft that ZachXBT traced. In that January 10, 2026 case, a victim lost more than $282 million in Bitcoin and Litecoin, and the attacker used THORChain to bridge Bitcoin into other ecosystems while also converting portions into Monero. Several outlets summarizing ZachXBT’s findings described the same mechanics: user-approved compromise, rapid asset conversion, and cross-chain movement through THORChain. The scale was different. The playbook was familiar.

Here is why that matters for the Kraken case. Once stolen funds move from Ethereum to Bitcoin through a decentralized cross-chain protocol, recovery odds usually worsen. Centralized exchanges can freeze assets under some circumstances. Permissionless protocols generally do not work that way. The attacker’s goal is not subtlety. It is speed. Minutes count. If the funds are already bridged, split, and swapped before the victim or exchange security team reacts, the trail becomes harder to interrupt even if it remains visible on-chain.

That is also why social engineering remains so dangerous in crypto. It bypasses the strongest part of many systems, the code, by targeting the weakest part, human trust. Kraken’s support pages explicitly warn users not to rely on search engines to find the sign-in page, not to trust unsolicited support outreach, and not to share credentials or seed phrases. The company also says sign-in 2FA alone is not enough and recommends stronger controls such as hardware security keys, Master Key protections, and Global Settings Lock.

What Kraken’s Security Guidance Says Users Should Do

Kraken has not, in the public materials reviewed here, published a detailed incident report on this specific $18.2 million case. But its security guidance is unusually direct, and it helps explain how these attacks unfold. Kraken says phishing scams often begin when users click a fake link, land on a lookalike site, and enter their username, password, sign-in 2FA, or device approval codes. It also warns that scammers may impersonate Kraken support by email, social media, or phone.

The exchange’s guidance gives a practical sequence for suspected compromise. Users should contact support immediately to lock the account, submit a suspicious activity report, change both Kraken and email passwords, and review browser history for fake Kraken URLs. Kraken also states that crypto transactions are irreversible and that once a transaction leaves the account, the funds cannot simply be reversed by support. That is a hard truth, but it is the operational reality behind stories like this one.

There is another detail worth stressing. Kraken says users should never use search engines, social media, or random links to navigate to the sign-in page. That sounds basic. It is not. Search poisoning and ad spoofing remain common entry points in phishing campaigns, especially when attackers exploit urgency. A fake support call, a spoofed email, and a cloned login page can be enough if the victim is rushed.

Why This Case Matters Beyond One Victim

The $18.2 million loss is large on its own. It is also part of a broader pattern. Public reporting over the past year has repeatedly linked ZachXBT’s investigations to major social engineering thefts affecting exchange users and self-custody holders alike. One March 2025 report said Coinbase users lost $46 million to social engineering scams in that month alone. In January 2026, the previously noted $282 million case showed that even very large holders can be manipulated if the attacker controls the communication channel and the victim believes the request is legitimate.

So the real story is not just that funds moved through THORChain. It is that crypto crime keeps shifting toward trust-based compromise, then using decentralized liquidity rails to accelerate laundering. That combination is nasty. It scales. And it does not require breaking exchange cold storage or protocol code.

For users, the lesson is blunt. If someone contacts you first, assume risk. If a page asks for credentials after you arrived through search, stop. If support asks for seed phrases, it is a scam. And if you think you have already interacted with a phishing page, the response window is measured in minutes, not days.

Frequently Asked Questions