The short answer
- What Kraken documents
- Cold storage in guarded facilities, ISO/IEC 27001 and SOC 2 Type 1, a bug bounty, passkey 2FA, a separate Master Key and an optional Global Settings Lock.
- What is not confirmed
- The share of assets in cold storage, a proof-of-reserves report newer than 2022, and any insurance for crypto held in accounts.
- What depends on you
- Which protections you switch on, where you keep your Master Key and whether you can tell real support from a scam.
Kraken in the United States
- Kraken does not provide services to residents of Maine and New York. Payward Interactive, Inc. is registered with FinCEN as a money services business (31000270997766).1 source
Shown for your selected market. Other countries
Kraken in the United Kingdom
- Payward Limited is registered with the FCA as a cryptoasset firm under the Money Laundering Regulations (FRN 928768). A registration covers specific activities; it does not protect your investment.1 source
- Newly verified UK retail accounts have a mandatory 24-hour cooling-off period before trading, and UK-resident retail clients cannot trade derivatives.1 source
Shown for your selected market. Other countries
Kraken in Canada
- Kraken operates in Canada as a restricted dealer registered with the Ontario Securities Commission and other provincial regulators; Payward Canada, Inc. is registered with FINTRAC as a money services business (M19343731).1 source
- Canadian-resident clients cannot trade on margin or trade derivatives on Kraken.1 source
Shown for your selected market. Other countries
Kraken in Brazil
- The Brazilian terms name Payward Brasil Sociedade Prestadora de Serviços de Ativos Virtuais Ltda. (CNPJ 61.533.076/0001-77). The contract text does not by itself confirm the authorisation status of each activity.1 source
Shown for your selected market. Other countries
Documentary research from Kraken’s own pages. We have not opened an account or tested the product.
How Kraken stores your crypto
When you keep crypto in a Kraken account, Kraken holds the private keys for you. Kraken says it protects those funds with a mix of and hot wallets, and that its crypto infrastructure sits in secured cages watched around the clock by armed guards, alarms and video. It does not say what share of client assets is kept in cold storage, so that part cannot be checked from the outside.1 source
For account data, Kraken says sensitive information is encrypted at rest and in transit, that it holds ISO/IEC 27001 certification and has completed a SOC 2 Type 1 audit, and that an in-house team tests its own systems alongside a public bug bounty.1 source
The documented facts behind this section (2)
- CustodyKraken says it uses cold storage and hot wallets to protect client funds, with its crypto infrastructure in secured cages watched 24/7 by armed guards, alarms and video. Its security page does not say what share of assets is held in cold storage.Source: Kraken security features page
- CertificationsKraken says sensitive account data is encrypted at rest and in transit, that it holds ISO/IEC 27001 certification and has completed a SOC 2 Type 1 audit, and that an in-house team tests its own systems alongside the public bug bounty programme.Source: Kraken security features page
Proof of reserves and past incidents
Kraken describes checks carried out by an independent accounting firm under agreed-upon procedures; the post we read dates from November 2022. A check like this shows that assets were held on a given date. It is not a full review of liabilities and does not guarantee solvency afterwards.1 source
In June 2024 Kraken said it had patched an isolated deposit bug reported through its bug bounty programme and that no client assets were impacted. That is Kraken’s own account of the event.1 source
We have not yet read a Kraken proof-of-reserves report newer than the November 2022 post, so 2022 is the latest one we cite.
The documented facts behind this section (2)
- Security disclosureKraken runs a bug bounty programme. On 19 June 2024 it said it had patched an isolated deposit bug and that no client assets were impacted (Kraken’s own statement).Source: Kraken blog: bug bounty patches isolated bug (19 Jun 2024)
- Proof of reservesKraken describes proof-of-reserves checks carried out by an independent accounting firm under agreed-upon procedures (post of November 2022). A reserves check is a point-in-time snapshot, not a guarantee of solvency.Source: Kraken blog: proof of reserves (Nov 2022)
How to lock down your Kraken account
- 1PasswordThe first check when you sign in.
- 2Sign-in 2FAA passkey (recommended) or an authenticator app.
- 3Master KeyRecovers 2FA, resets the password or lifts the lock at once. Keep it on another device.
- 4Global Settings LockBlocks account changes. Without the Master Key, unlocking takes 24 hours to 30 days.
Kraken’s account controls come in layers, and most are optional. The first is : sign-in, the Master Key, funding and trading each have their own 2FA, set up separately, and Kraken says it offers no phone or SMS account recovery.2 sources
| Method | What Kraken says |
|---|---|
| Passkey (FIDO2) | Recommended because it resists phishing. It can be a hardware security key, a passkey shared across devices or one tied to a single browser. |
| Authenticator app | Generates short codes. Kraken warns the codes can be phished, or exposed if they sync to a cloud account that is compromised. |
The second layer is the Master Key, which you need if you lose your sign-in 2FA, reset your password or want to remove the Global Settings Lock straight away. Kraken advises keeping it on a different device from your sign-in 2FA, such as a hardware security key.1 source
The third is the Global Settings Lock. Once it is on, it blocks changes to the account and hides sensitive information. Removing it without a Master Key takes at least 24 hours and up to 30 days, depending on your setting, and Kraken emails you about any attempt, which gives you time to react if someone has your password and 2FA.1 source
Kraken also lists email confirmation for new withdrawal addresses, API keys with custom permissions and a configurable account timeout among its security features.1 source
Account checklist
- Use a passkey or hardware security key for sign-in 2FA
- Set up a Master Key on a different device from your sign-in 2FA
- Turn on the Global Settings Lock with a waiting period you can live with
- Add funding 2FA so withdrawals need a second check
- Never share passwords, 2FA codes, seed words or your Master Key
The documented facts behind this section (4)
- Two-factor authenticationKraken supports two 2FA methods: passkeys (FIDO2: a hardware security key, a cross-device passkey or a passkey tied to one browser), which it recommends because they resist phishing, and authenticator apps, whose codes Kraken warns can be phished or exposed if synced to a compromised cloud account. Sign-in, Master Key, funding and trading each have their own 2FA, set up separately. Kraken says it offers no phone or SMS account recovery.Source: How to secure your account with 2FA (Kraken Support, updated 13 Oct 2026) · Kraken security features page
- Master KeyThe Master Key is needed if you lose sign-in 2FA, reset your password or want to remove the Global Settings Lock at once. Kraken advises keeping it on a different device from your sign-in 2FA, for example a hardware security key.Source: How to secure your account with 2FA (Kraken Support, updated 13 Oct 2026)
- Global Settings LockThe optional Global Settings Lock blocks changes to the account and hides sensitive account information, as a last line of defence if your password and sign-in 2FA are compromised. Unlocking it without a Master Key takes at least 24 hours and up to 30 days, depending on your setting, and Kraken emails you about any unlock attempt.Source: What is the Global Settings Lock (GSL)? (Kraken Support, updated 23 Apr 2026)
- Withdrawal addressesKraken lists email confirmation for adding new withdrawal addresses, API keys with custom permissions and a configurable account timeout among its account security features.Source: Kraken security features page
Fake support and other scams
Kraken says it does not publish a support phone line. Phone support starts from its mobile apps, Kraken will not call you unless the call was arranged by email or chat first, and any number found online claiming to be Kraken should be treated as phishing.1 source
On a genuine call, an in-app banner confirms you are connected to Kraken Support, and scheduled calls are verified with a one-time code in the app. Kraken emails come from the @kraken.com domain, including subdomains such as @email.kraken.com.1 source
Kraken Support will never ask for1 source
- Your password
- A 2FA or device-approval code
- Seed words
- Your Master Key
- Remote access to your computer
- Changes to your security settings
The documented facts behind this section (2)
- ScamsKraken says it does not publish a support phone line: phone support is reached only from its mobile apps, any number found online should be treated as phishing, and it will not call without first arranging the call by email or chat. Its staff will never ask for your password, a 2FA or device-approval code, seed words, your Master Key, remote access or changes to your security settings.Source: How to contact Voice Support (Kraken Support, updated 14 Oct 2026)
- Verified calls and emailsDuring a genuine support call an in-app banner confirms you are connected to Kraken Support, and scheduled calls are verified with a one-time code in the app. Kraken emails always come from the @kraken.com domain, including subdomains such as @email.kraken.com.Source: How to contact Voice Support (Kraken Support, updated 14 Oct 2026)
Kraken account vs Kraken Wallet
Kraken offers two very different ways to hold crypto, and the risks sit in different places.1 source
| Kraken account | Kraken Wallet (recovery phrase) | |
|---|---|---|
| Who holds the keys | Kraken | You |
| If you lose access | Kraken can help with account recovery | Kraken cannot recover the phrase |
| Kraken’s access | Holds the assets in your account | None, even if you link your Kraken account |
The documented facts behind this section (1)
- Kraken WalletThe Kraken exchange is custodial: Kraken holds the assets in your account and can help with account recovery. Kraken Wallet is a separate self-custody wallet; with a recovery-phrase wallet, you control the phrase and keys, and Kraken cannot recover the phrase, reverse transactions or access the wallet. Linking your Kraken account does not give Kraken access to it.Source: Kraken Wallet vs Kraken Exchange (Kraken Support, updated 15 Sep 2026)
How Kraken compares with Coinbase and Crypto.com
The three exchanges document their safeguards differently. This table only sets side by side what each one says on its own pages; it is not a ranking.
| Kraken | Coinbase | Crypto.com | |
|---|---|---|---|
| Cold storage | Uses cold storage and hot wallets; no share stated1 source | Over 99% of customer assets1 source | 100% of user crypto offline (US App page)1 source |
| Two-factor authentication | Passkeys (recommended) or an authenticator app2 sources | Required to access the account; security keys rated highest1 source | 6-digit codes required for withdrawals and whitelisting1 source |
| New withdrawal addresses | Email confirmation; optional Global Settings Lock2 sources | Optional allowlist: new addresses wait 48 hours1 source | Optional 24-hour lock on new whitelisted addresses1 source |
| Reserves and accounts | Proof-of-reserves check by an accounting firm (post of Nov 2022)1 source | Audited financial statements filed annually with the SEC1 source | Proof-of-reserves report by Mazars (Dec 2022)1 source |
| Support never asks for | Password, 2FA codes, seed words, Master Key1 source | Password, 2-step codes, seed phrase1 source | Login details, private keys, MFA codes, recovery phrase1 source |
Is Kraken regulated?
Kraken serves each market through a different local company, with different limits. A registration covers specific activities and is not a guarantee against loss.
United States Your selected market
- Kraken does not provide services to residents of Maine and New York. Payward Interactive, Inc. is registered with FinCEN as a money services business (31000270997766).1 source
United Kingdom Your selected market
- Payward Limited is registered with the FCA as a cryptoasset firm under the Money Laundering Regulations (FRN 928768). A registration covers specific activities; it does not protect your investment.1 source
- Newly verified UK retail accounts have a mandatory 24-hour cooling-off period before trading, and UK-resident retail clients cannot trade derivatives.1 source
Canada Your selected market
- Kraken operates in Canada as a restricted dealer registered with the Ontario Securities Commission and other provincial regulators; Payward Canada, Inc. is registered with FINTRAC as a money services business (M19343731).1 source
- Canadian-resident clients cannot trade on margin or trade derivatives on Kraken.1 source
Brazil Your selected market
- The Brazilian terms name Payward Brasil Sociedade Prestadora de Serviços de Ativos Virtuais Ltda. (CNPJ 61.533.076/0001-77). The contract text does not by itself confirm the authorisation status of each activity.1 source
Is Kraken safe?
Kraken documents several safeguards: cold storage in guarded facilities, ISO/IEC 27001 certification, a bug bounty, passkey 2FA, a separate Master Key and an optional Global Settings Lock. But these are largely its own statements, it does not say what share of assets is in cold storage, and its published proof of reserves dates from 2022. Your own account setup matters as much.4 sources
Is Kraken legit?
Kraken serves customers through named local companies: Payward Interactive, Inc. is registered with FinCEN in the US, Payward Limited with the FCA in the UK, and Payward Canada, Inc. with FINTRAC, with Kraken operating as a restricted dealer in Canada. Being legitimate does not make it risk-free; see the limits above.1 source
Has Kraken been hacked?
We have not found a Kraken disclosure of a breach of client funds in the sources we read. In June 2024 Kraken said it patched an isolated deposit bug reported through its bug bounty and that no client assets were impacted; that is Kraken’s own statement.1 source
What is the Kraken Global Settings Lock?
An optional setting that blocks changes to your account and hides sensitive information. Removing it without a Master Key takes at least 24 hours and up to 30 days, depending on your setting, and Kraken emails you about any unlock attempt, giving you time to react if someone has your password and 2FA.1 source
Does Kraken have a phone number?
Kraken says it does not publish a support phone line. Calls start from its mobile apps or are scheduled in advance by email or chat, and any number found online should be treated as phishing.1 source
Is Kraken Wallet the same as a Kraken account?
No. A Kraken account is custodial: Kraken holds the assets and can help you recover access. Kraken Wallet is self-custody; with a recovery-phrase wallet, Kraken cannot recover the phrase, reverse transactions or access your funds.1 source
Is it safe to keep crypto on Kraken?
Kraken says it protects client funds with cold storage and hot wallets, but its security page does not say what share is kept in cold storage. It describes proof-of-reserves checks by an independent accounting firm, which are a snapshot in time and not a guarantee of solvency. The exchange is custodial, so Kraken holds the assets in your account. With Kraken Wallet you hold the phrase and keys yourself.3 sources
Sources
Every platform fact on this page comes from these official pages. Each “sources” marker on this page links to pages from this list.
support.kraken.com
- Where is Kraken licensed or regulated? (Kraken Support)
- How to secure your account with 2FA (Kraken Support, updated 13 Oct 2026)
- What is the Global Settings Lock (GSL)? (Kraken Support, updated 23 Apr 2026)
- How to contact Voice Support (Kraken Support, updated 14 Oct 2026)
- Kraken Wallet vs Kraken Exchange (Kraken Support, updated 15 Sep 2026)
blog.kraken.com
help.coinbase.com
How we research · Educational content, not investment advice. Cryptoassets are high risk and you could lose all the money you invest. Rules and availability vary by country.
