Is Kraken Safe? Security Features, Proof of Reserves and What Is Not Protected (2026)

Kraken says the crypto in your account is held in custody on your behalf and is not Kraken’s property, publishes a periodic proof-of-reserves report, and lists US money transmitter licenses on its disclosures page. It also says, in plain words, that your account and digital assets are not covered by insurance and are not protected by FDIC or SIPC in the United States. As of November 2026, that last point is the one that matters most when you decide how much to keep on any exchange.

I run Ecommerce Paradise, where most readers are building high-ticket stores, and crypto questions come up once a store starts making profit or a customer asks to pay with it. This guide separates what Kraken says about its own protections from what regulators say. I only state things I could read on an official Kraken page or a government page, and where a figure is not shown, I say so.

Disclosure: some links below are affiliate links, which means I may earn a commission at no extra cost to you. This is general information, not financial advice, and I am not a licensed financial advisor. Terms change, so check the provider before you act. I will not tell you to buy, sell or hold anything, and no exchange is the right fit for everyone.

Quick Answer: What Protects You and What Does Not

The table summarizes the main protections, who states them, and the limit that matters. Each row comes from a Kraken or regulator page I opened for this guide.

How Kraken Says It Holds Your Crypto

The primary source is Kraken’s global terms of service, which the page showed as last updated November 6, 2026. The custody section says digital assets in your account are held in custody by Kraken on your behalf and that title stays with you, except as the terms provide. It also says those assets are not Kraken’s property, are not loaned to Kraken, and are not subject to Kraken’s creditors’ claims.

The terms then add a sentence most people skip. Kraken says a court may disagree with its treatment of your assets, which could expose them to creditor claims. Kraken also says it will not sell, transfer or lend your assets unless you instruct it to, a valid court order requires it, or the terms allow it, and it names Bonded Staking and OTC options collateral as examples of terms-based exceptions.

The mechanics are worth knowing. Kraken says it may use shared blockchain addresses that it controls and that it keeps separate ledgers for customer accounts and its own accounts. In plain terms, your coins are tracked on Kraken’s books, not necessarily sitting at a wallet address with your name on it.

Cold Storage and Physical Security: What Kraken Shows

Kraken’s security page says it uses cold storage and hot wallet solutions to secure funds. It does not state a cold storage percentage, so I am not repeating any number I have seen elsewhere. If a third party quotes a share held offline, ask where Kraken itself published it.

The same page says its infrastructure sits in secure cages with 24/7 surveillance, guards, alarms and video monitoring, and that sensitive account data is encrypted at rest. It lists an ISO/IEC 27001:2022 certification and a SOC 2 Type 1 examination without dates, and says it runs a bug bounty program. These are Kraken’s own statements, and I did not see an independent report on that page.

Insurance: What Kraken and Regulators Say Is Not There

This is the section to read twice. Kraken’s global terms say Kraken is not a bank or other depository institution and that your account is not a deposit or bank account. They also say neither your account nor your digital assets are covered by insurance against losses, and that they are not subject to FDIC or SIPC protection or similar schemes anywhere. The security page I loaded does not mention insurance at all.

Kraken’s legal disclosures page repeats the point for US readers. It says digital assets and Kraken accounts are not subject to FDIC or SIPC protections in the United States, and several state sections say virtual currency is not legal tender and not backed by the US government. Some sections add that any surety bond may not cover all customer losses.

Cash and USD Balances

The terms I read describe a fiat balance narrowly. It may be used only to buy digital assets or to be redeemed to an approved financial account, and Kraken says it pays no interest on fiat balances. Where permitted, Kraken says it may invest fiat in liquid instruments such as US Treasuries and keep the earnings. The terms I read do not describe how fiat is segregated or held in trust, and they give no separate insurance statement for fiat, so I would not assume a pass-through arrangement like the ones some competitors describe. If this matters to you, read the current terms yourself.

What the FDIC and SIPC Say

The FDIC’s deposit insurance page lists crypto assets among the things not covered. It gives the standard limit as $250,000 per depositor, per ownership category, at each FDIC-insured bank, and it applies only to deposit products at insured banks.

SIPC covers a different risk. Its page on what it protects says its protection limit is $500,000, including $250,000 for cash, when a member brokerage firm fails financially. It says it does not protect a digital or crypto asset that does not qualify as a security under the Securities Investor Protection Act, and it lists Bitcoin and Ether among its examples of digital commodities. Both sources point the same direction as Kraken’s own terms.

Proof of Reserves: What Kraken Publishes

Kraken’s proof of reserves page is more detailed than most exchange pages, and it is also candid about limits. The snapshot date shown when I loaded it was June 30, 2026, which is more than four months before this guide’s November 2026 date. Kraken describes the reviewer as an independent third-party accountant and does not name the firm on the page. The security page says audits happen periodically, and the proof-of-reserves page says reviews run at a regular cadence, so I cannot give you a fixed schedule. The disclaimer on the security page describes an Agreed Upon Procedures report under AICPA standards, so check what that engagement covers before reading it as a full audit.

The page lists spot balances, staked balances (aggregated with spot), margin balances adjusted for positions and futures collateral as in scope. The reserve ratios it showed for June 30, 2026 are in the table below. Kraken notes these may change materially between reports because of product and custody changes.

Two cautions. First, the page’s FAQ lists BTC, ETH, SOL, USDC, USDT and XRP as in-scope assets, while the ratio table also shows ADA and USDG, so the page is not fully consistent about scope. Second, I did not see fiat balances in the scope list, so a crypto-only report says nothing about cash.

How You Can Check Your Own Balance

Kraken says you can log in, open the Proof of Reserves tab, choose a report date and use its verify option, which checks that your balance is included in the Merkle tree the accountant reviewed. Advanced users can recompute the hashes in code, and the page provides examples in several languages. That is a real transparency feature, but it checks inclusion of your balance, not the solvency of every possible liability.

What Kraken Says a Reserve Review Cannot Show

Kraken’s page lists its own limitations. It says reviews cannot prove exclusive control of private keys, cannot detect hidden encumbrances or show that funds were not borrowed to pass the review, and cannot protect against keys being lost or funds stolen after a review. It also says the accountant must be competent and independent to limit collusion. I find that candor useful, and it is a reason to treat a reserve report as one data point and not a guarantee.

Account Security Features You Control

Most real-world losses come from account takeovers, not from an exchange failing. Kraken’s tools are mostly opt-in, so the safety of your account depends on what you turn on. Here is what Kraken’s own support pages describe.

Two-Factor Authentication and Passkeys

Kraken’s 2FA guide, last updated October 13, 2026 when I read it, lists two methods: passkeys and authenticator apps. Passkeys come as hardware security keys, cross-device passkeys and device-bound passkeys. The article describes separate 2FA functions for sign-in, the Master Key, funding (deposits and withdrawals) and trading, and for funding and trading it lists only authenticator apps.

Kraken recommends passkeys over authenticator apps because they resist phishing. It advises registering more than one passkey, keeping the Master Key on a different device from your sign-in 2FA, and turning off cloud sync for authenticator apps because synced codes are exposed if the linked account is compromised. The guide does not mention SMS as a method, and Kraken’s account security article advises avoiding SMS 2FA.

Master Key

Kraken’s Master Key article calls it an optional extra feature. Once enabled, it is needed to reset your sign-in password, which helps even if your email account is compromised. It can also turn off the Global Settings Lock immediately. Accepted methods are a passkey (recommended), an authenticator app, or a legacy static password that Kraken does not recommend.

Global Settings Lock

The Global Settings Lock is Kraken’s last line of defense if your password and sign-in 2FA are both compromised. While it is on, it blocks adding withdrawal addresses or bank accounts, changing your email or password, and adding or changing 2FA, your Master Key, your PGP key or API keys. It still shows balances and trading history.

You choose an unlock period when you enable it, with a default of three days on the page I read. Unlocking without a Master Key takes at least that full period, Kraken Support cannot shorten it, and you get an email when an unlock is requested. A Master Key set up before the lock is enabled can remove it immediately, and a Master Key cannot be added or changed while the lock is on. Set up the Master Key first.

Withdrawal Addresses

A common question is whether Kraken offers a withdrawal address whitelist. On the Kraken pages I could load, I did not find a feature called a whitelist, and Kraken’s account security article does not use the word. What I did find is an email confirmation. Kraken’s article on adding a withdrawal address, last updated October 22, 2026 when I read it, says addresses added from a trusted device are approved automatically, others need approval through an emailed link, and that link is valid for one hour. Kraken’s security page lists email confirmations for adding new withdrawal addresses.

The same article says withdrawals to new addresses can be held for up to 24 hours, but only after you change your password while having neither sign-in 2FA nor a Master Key enabled. Kraken’s closest recommendation to a whitelist is the Global Settings Lock, which blocks new withdrawal addresses entirely while it is on. Check the current withdrawal settings in your own account, because this area changes.

PGP Email and Phishing Guidance

Kraken lists PGP signed and encrypted email on its security page. Its account security article, last updated September 30, 2026 when I read it, calls PGP optional and useful if you are comfortable with encryption tools. The same article says to bookmark the official sign-in page, use only Kraken’s official apps, and never install remote access software at someone else’s request. It says Kraken Support will never ask for your password.

The article also recommends a dedicated email address for Kraken with its own unique password and 2FA, a password of at least 15 characters from a password manager, and a carrier PIN and port freeze against SIM swaps. These are inexpensive steps, and they address the way accounts are actually lost.

Regulatory Registrations, as Kraken Lists Them

Kraken’s legal page says its regulatory status differs by product, service and jurisdiction and points to per-jurisdiction disclosures. On the US disclosures (last updated October 20, 2026 when I read them), two entities appear: Payward Interactive, Inc. and Payward Financial, Inc. Both are listed as FinCEN-registered money services businesses with NMLS IDs.

The page lists money transmitter licenses across a long list of states and territories for Payward Interactive, and a shorter list for Payward Financial, which also appears with a Wyoming Special Purpose Depository Institution charter. California is shown as pending: Kraken says it applied for a Digital Financial Assets Law license and may operate while the application is reviewed. A few state sections note that their money transmitter license does not cover virtual currency transmission.

Two limits matter. The disclosures page does not state an SEC, CFTC or FINRA registration for a US entity, and it does not describe US fiat bank accounts or deposit insurance for the Wyoming institution. You can read what FinCEN says about registration on its MSB registration page, which also links a public registrant search. A registration shows an entity filed with the regulator. It does not insure your balance.

Publicly Documented Regulatory Actions

I am keeping this section to what I could read on sec.gov. It is not a complete history.

The 2023 Staking Settlement

The SEC’s press release dated February 9, 2023 says the SEC charged Payward Ventures, Inc. and Payward Trading Ltd., both known as Kraken, with failing to register the offer and sale of their crypto staking-as-a-service program. It says Kraken agreed to pay $30 million and to stop offering or selling securities through staking services or programs, without admitting or denying the allegations. Kraken’s current terms still reference a bonded staking annex, so check which staking products are offered to you before assuming anything.

The 2023 Civil Action and Its 2025 Dismissal

In litigation release 26278, dated March 27, 2025, the SEC says it filed a joint stipulation to dismiss with prejudice its civil enforcement action against Payward, Inc. and Payward Ventures, Inc., a case filed in November 2023. It says the dismissal was a discretionary decision to support reforming its approach to crypto regulation, was not based on any assessment of the merits, and does not necessarily reflect its position in other cases. Other regulators and courts may have actions I did not review.

What Is Not Protected

A fair reading of the sources leaves several gaps, and they are more useful to know than any reassurance.

• Price risk: Kraken’s terms say using the services, including trading, is at your own risk. No insurer or regulator protects you from a drop in value.
• Unauthorized access: the terms say you accept the risks of authorized or unauthorized access to your account, to the extent the law allows, and that you are responsible for activity under it.
• Irreversible sends: the terms say withdrawals and redemptions are final and non-reversible, and the FTC says crypto payments typically are not reversible.
• Unsupported deposits: the terms say depositing unsupported assets may cause permanent loss that Kraken is not liable for.
• Platform liability: the liability section excludes indirect and consequential damages, also excludes amounts exceeding $100 to the extent not already excluded, and the terms say services are provided as is.
• Withdrawal suspensions: Kraken reserves the right to suspend withdrawals for an indeterminate time, in its sole discretion, to ensure compliance with the terms or legal, regulatory or administrative obligations.
• Bankruptcy: Kraken’s terms say a court may disagree with its custody treatment, and I could not find a page that tells you how a court would rule.

Scams Are the Biggest Practical Risk

The FTC’s guidance on cryptocurrency scams says only scammers demand payment in crypto, that promises of guaranteed profits are a red flag, and that scammers impersonate well-known companies. It says crypto payments are generally not reversible, and it points to ReportFraud.ftc.gov, the SEC, the CFTC, the FBI’s IC3 and the exchange you used for reporting.

Crypto and a Store: Keeping Business Money Separate

If you run a store, the most important habit has nothing to do with Kraken’s settings. Keep business money and personal money apart. Ad platforms, suppliers and payment processors run on bank accounts and cards, so an exchange account is usually a side decision and not an operating tool.

If you are thinking about accepting crypto from customers, remember that the payment arrives as an asset that can move in price before you convert it. Some store owners look at stablecoins for supplier payments, which I cover in my piece on stablecoin supplier settlements. Whatever route you take, the exchange terms above still apply to anything you hold there.

Business expenses are the other side. Fees paid on an exchange, the cost of moving funds and the price at which you convert all need records your accountant can use, and my guide to crypto tax software covers the record-keeping. Before business funds go near an exchange account, set up the company properly with my business formation checklist.

A dedicated business account matters too, and my walkthrough for opening a Mercury account shows one option.

A store only throws off profit if it sells things people want at real margins. If you have not picked a niche, start with what high-ticket dropshipping is. After that, my high-ticket niches list is the next stop.

Reliable sourcing matters just as much, and my guide on how to find suppliers for high-ticket dropshipping shows how I approach it.

A Safety Checklist for Store Owners Holding Crypto for Business

• Decide in writing what the crypto is for (customer payments, supplier settlement or an investment) and who can touch it.
• Use a dedicated email address for the exchange with a unique password and its own 2FA, and register more than one passkey.
• Set up a Master Key on a different device before you enable the Global Settings Lock, then enable the lock.
• Approve a new withdrawal address only if you just added it yourself, and treat an unexpected address email as an alarm.
• Do not park money you need for ad spend, supplier invoices, payroll or taxes on an exchange.
• Keep records of every deposit, withdrawal, fee and conversion for your accountant.
• Check Kraken’s proof-of-reserves date and its current terms yourself, because both change.
• Remember that no insurer or regulator covers price losses, and the FTC says only scammers demand payment in crypto.

A Balanced Look: Reasons for Comfort and Reasons for Caution

On the comfort side, Kraken’s terms say customer assets are not its property and not subject to its creditors’ claims, it publishes a proof-of-reserves report with a self-check tool, it offers passkeys, a Master Key and a Global Settings Lock, it lists US registrations and licenses, and the SEC filed a joint stipulation in 2025 to dismiss its 2023 civil action with prejudice (not based on the merits, per the SEC).

On the caution side, Kraken itself says accounts and assets are not insured or FDIC or SIPC protected, a court may disagree with its custody treatment, reserve reviews have stated limits, I could not find a cold storage percentage, and the SEC’s 2023 staking settlement is part of the record. Your own account hygiene decides a large share of your risk. I am not recommending that anyone open an account, buy crypto or hold any amount of it.

If you want to compare costs, my Kraken fees and pricing guide goes deeper.

My Is Coinbase Safe guide covers the same questions for the other major exchange. If you decide to open an account, you can create a Kraken account here, and I would start with the security settings before adding money.

Frequently Asked Questions

Is Kraken FDIC insured?
Kraken’s terms say it is not a bank and that your account is not a deposit or bank account. They say the account and your digital assets are not covered by insurance and are not subject to FDIC or SIPC protection. The FDIC lists crypto assets as not covered.

Is crypto on Kraken covered by SIPC?
No, according to Kraken’s own terms and disclosures. SIPC says it does not protect a digital or crypto asset that does not qualify as a security under its governing law, and it lists Bitcoin and Ether as examples of digital commodities.

Does Kraken publish proof of reserves?
Yes. Kraken’s page describes reviews by an independent third-party accountant and showed a June 30, 2026 snapshot with reserve ratios for several assets. It does not give a fixed cadence beyond “regular”, does not name the firm on the page, and lists limits on what a review can prove.

What security settings should I turn on at Kraken?
Kraken recommends passkeys for sign-in 2FA, a Master Key stored on a different device, and the Global Settings Lock, set up in that order. It also recommends a dedicated email address, a long unique password and avoiding SMS 2FA. Check the current Kraken support pages for the exact steps.

Has Kraken had regulatory problems?
The SEC announced a $30 million settlement over Kraken’s staking program in February 2023, and in March 2025 it filed a joint stipulation to dismiss a separate 2023 civil action with prejudice, saying the decision was not based on an assessment of the merits. I did not review other regulators, so check state and federal sources for the latest.

Related Articles

If you found this useful, these guides go deeper on related topics:

• Kraken Review 2026: Is This Crypto Exchange Right for Ecommerce Entrepreneurs?
• Kraken Promo Code 2026: New-User Offers, Referral Terms and What to Skip
• Coinbase vs Kraken 2026: Fees, Coins, Safety and Who Each Fits Best
• Kraken Alternatives (2026): 7 Exchanges Compared on Fees, Coins and Availability
• Best Crypto Wallets 2026: Exchange, Hardware and App Picks Compared

Not financial advice. Terms, insurance statements, licenses and fees change, so check Kraken and the regulators directly before you act.

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.

He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.

80

SHARES

Share on Facebook

Post on X

Save

Share