Kraken Review 2026 — Fees, Security & Features

Kraken began live spot trading in September 2013 and has operated continuously through the Mt. Gox failure (Feb 2014), the 2018 bear market, COVID-March 2020 liquidations, the May 2022 Luna collapse, and the FTX bankruptcy in November 2022. The platform has not suffered a confirmed external breach causing permanent loss of customer funds. The most notable security event was the June 2024 isolated balance-credit vulnerability — disclosed by CertiK researchers who extracted ~$3M, the bug was patched within a few hours, and roughly the full amount was recovered. Treat 'no confirmed loss-of-funds breach' as the accurate claim rather than the looser 'zero hacks' language sometimes repeated in marketing copy.

Kraken publishes Proof-of-Reserves reports roughly every six months (not quarterly, as occasionally claimed). The construction uses a Merkle tree of hashed client balances, allowing each user to verify their own balance was included without exposing other users' data. Armanino performed early attestations; BDO has handled more recent rounds. PoR covers BTC, ETH, USDT, USDC and other major assets — coverage of long-tail tokens varies by report. PoR is a snapshot, not a real-time guarantee, and does not address liabilities not on the attesting auditor's scope, a limitation FTX exploited prior to its November 2022 collapse.

Kraken states approximately 95% of customer crypto is held in geographically distributed, air-gapped cold storage with multi-signature controls and physical access restrictions. The remaining ~5% sits in hot wallets sized to cover normal daily withdrawal float. By comparison, Binance discloses cold-storage ratios in its Proof-of-Reserves attestations but does not publish a specific percentage; Coinbase reports 'the vast majority' in cold storage without a fixed figure. Kraken's approach traces back to lessons from Mt. Gox, where a single hot-wallet key compromise drained customer funds over an extended period before detection.

Kraken has completed SOC 2 Type II examinations covering security, availability, and confidentiality controls — one of relatively few crypto venues to do so (Coinbase, Gemini, and Anchorage are among the others). Regulatory footprint as of late 2025: FinCEN MSB registration in the US, money-transmitter licenses across most US states, FCA registration in the UK (subject to the FCA's restricted promotions regime), CySEC authorisation in Cyprus, MiFID II coverage for derivatives in the EEA via Payward Europe, and ASIC registration in Australia. Following MiCA's full application on 30 December 2024, Kraken operates in the EU through transition arrangements while pursuing full MiCA authorisation. The Wyoming SPDI charter for Kraken Bank was granted in September 2020 but deposit accounts have not yet launched.