A masked fraudster tried to hack a Kraken user’s account

Scams are not uncommon in the world of cryptocurrencies, but recently a strange account hacking attempt came into the spotlight. A fraudster tried to access the account of a Kraken user by proving his false identity in a low-quality rubber mask. In theory, the mask was supposed to resemble the real client, but Kraken quickly realized the ugliness and blocked access.

How did the scammer with the rubber mask try?

Already during the initial investigations, the staff of the stock exchange noticed several signs that suggested that the entry attempt was fake. For example, the fraudster could not name the devices in the account accurately, so he failed the first round of verification. A Kraken employee then initiated a video call to ask additional questions and examine the user identity document.

One of Kraken’s unique security measures is the possibility to ask for proof of the customer’s identity in a video call. This is particularly the case when strange activities are detected in the user account. In this case, the attacker was wearing a simple rubber mask that vaguely resembled the customer, but Kraken employees spotted this immediately. According to the company’s director of security, Nick Percoco, the clerk immediately recognized that something was wrong.

“Our manager thought: This is absolutely ridiculous. This guy is wearing a rubber mask” Percoco said.

There are deepfakes and then there’s this guy. He’s trying to gain access to a @krakenfx client’s account. Nice try, buddy! pic.twitter.com/gFD9LUM2D4

— Nick Percoco (@c7five) October 15, 2024

Adding to the poor quality of the disguise was the fake ID presented by the scammer, which Percoco said was apparently Photoshopped and then printed onto cardboard.

Kraken strives to minimize the success of these types of attacks. To this end, according to Percoco, the company pays a lot of attention to details and gives priority to suspicious cases that arise during video calls. “Sometimes we see attempts like this, where (fraudsters) stick a mustache on themselves. They present (the ID) and it looks similar because they wear similar glasses, have mustaches and have blond hair. But these never pass (the inspections)” explains Percoco.

The lesson of the Kraken case: extra protection never hurts

Kraken’s case highlights the need for cryptocurrency users to be cautious. While the company’s security measures worked effectively, Percoco cautions that not all crypto exchanges pay this much attention to detail. Certain companies, especially those that outsource customer service, may be more prone to errors.

How can we protect ourselves?

To protect cryptocurrency accounts, Percoco recommends two-factor authentication for all accounts, including email. In addition, it highlights the FIDO2 authentication and the importance of using passcodes, which provide stronger security and effectively make the device a “password”. Such key codes are cryptographically linked to websites, making it virtually impossible for fraudsters to deceive the user.

“Keycodes are cryptographically linked to the websites and apps you use, so they can’t trick you into thinking you’re logged into Kraken” – summarizes Percoco.

Conclusion

The security case of Kraken clearly shows that it is important to be extra careful and use appropriate security measures in the field of cryptocurrencies. This rubber mask authentication was unsuccessful, but it can be a good reminder for users of crypto exchanges: in the world of digital finance, you should always be prepared for similar attempts.