Kraken has frozen as much as $4.2 million in user funds after reports connected an ongoing address-poisoning campaign to HTX-linked wallets, according to a report from WuBlockchain published on August 20, 2026. The freeze is a containment move: the exchange locks flagged balances to stop stolen or at-risk funds from moving, while the underlying scam keeps surfacing across on-chain activity.
The specific figure and the HTX link come from a single report at the time of writing, and neither exchange has published a detailed post-mortem. What is not in dispute is the attack method itself, which has become one of the most common ways ordinary users lose crypto without ever clicking a phishing link or signing a malicious transaction.
The mechanics of an address-poisoning attack
Address poisoning preys on a habit almost everyone has: copying a wallet address from your own transaction history instead of retyping it. Attackers generate a vanity address that matches the first and last few characters of an address you already use, then send you a tiny or zero-value transfer from it. That transaction now sits in your history, looking almost identical to a legitimate counterparty.
The next time you go to send funds and grab an address from your recent transactions, you may copy the attacker's lookalike by mistake. Wallets and block explorers truncate long addresses to something like 0x71C7...9F3a, so the decoy passes a glance-level check. The money goes to the attacker, and on a public blockchain, it does not come back.
The "HTX-linked" detail in this case points to the poisoning addresses interacting with HTX deposit flows, which is why the exchange trail runs through both HTX and Kraken. When stolen funds land on a centralized exchange, that exchange can freeze them, which is what appears to have happened here.
The freeze protects funds but locks users out
A freeze is a double-edged outcome. On one hand, catching $4.2 million before it is laundered through mixers or cross-chain bridges is a genuine win, and centralized exchanges like Kraken are often the only chokepoint where stolen crypto can still be intercepted. On the other, freezes are blunt. Legitimate account holders whose funds get swept into an investigation can face long lockouts while the exchange sorts out who owns what, with limited visibility into the timeline.
That tension is the core counterparty tradeoff of holding assets with a custodian. The same control that lets an exchange claw back a scammer's haul also means your balance can be frozen, delayed, or tied up in a case you had nothing to do with. It is the mirror image of holding your own keys, where nobody can freeze your funds but nobody can reverse a mistaken send either.
The risk reaches beyond exchange traders
Address poisoning is not an exchange-only problem. Anyone who moves crypto between wallets is exposed, and that includes people funding a crypto card. If you top up a card balance by copying a deposit address, the same lookalike trap applies. A single fat-fingered paste can send a top-up to an attacker instead of your card provider, with no chargeback and no support line that can undo an on-chain transfer.
This is one reason spending from your own wallet does not remove the need for discipline. Self-custody protects you from a provider freezing your balance, but it puts the full weight of address verification on you. Cards that pull from stablecoin balances you top up manually carry the same exposure as any other on-chain send.
Practical defenses that actually work
The fix is unglamorous and effective. Verify the entire address, not just the truncated preview. Check the middle characters, not only the first and last four, since that is exactly the span attackers leave unchanged. Better still, stop copying addresses from transaction history altogether. Use a saved and labeled address book entry that you verified once, or scan a QR code directly from the recipient.
For larger transfers, send a small test amount first, confirm it arrives at the correct destination, then send the rest. The few minutes and the network fee are cheap insurance against sending five or six figures to a decoy. Hardware wallets help here too, because they force you to confirm the destination on a separate screen the malware on your computer cannot alter.
None of these steps would have prevented every case in this incident, and the frozen funds may still take time to return to their rightful owners. The lesson is narrower and more durable: on a chain where transfers are final, the address bar is the last line of defense, and a lookalike is designed to slip past a tired glance.
Overview
Kraken has frozen up to $4.2 million in user funds tied to an HTX-linked address-poisoning campaign, per a WuBlockchain report on August 20, 2026. The scam plants a lookalike address in a victim's transaction history so a future copy-paste sends funds to the attacker. The freeze intercepts stolen crypto but can also lock out legitimate users, the standard tradeoff of custodial control. The same risk applies to anyone funding a wallet or a crypto card, and the defense is to verify the full address, use saved address book entries, and send a test transfer first.
