Evidence refresh: August 15, 2026. This review uses current Kraken security, legal, fee, staking, availability, incident, and proof-of-reserves disclosures plus the U.S. Securities and Exchange Commission's 2023 staking settlement release. We did not open an account, deposit funds, trade, stake, or contact support for this review. Product terms, eligibility, rates, and fees can change after the check date.
Quick answer: Kraken offers several useful account-security controls and a comparatively long operating history, but ETH held there remains under exchange-controlled custody. It may be a defensible choice for someone who needs a centralized exchange and is eligible for the exact product they want. It is not the same as self-custody, deposit insurance, or a guarantee against loss.
Security Controls You Can Actually Use
Kraken's current security page says accounts can use FIDO2-compliant two-factor authentication with passkeys, email confirmations for new withdrawal addresses, granular API permissions, configurable timeouts, and a Global Settings Lock. These are meaningful controls only when the account owner enables and protects them.
The same page says Kraken uses both cold-storage and hot-wallet systems, encrypts sensitive data at rest and in transit, holds ISO/IEC 27001:2022 certification, and has completed a SOC 2 Type 1 examination. Those are useful signals about documented controls; they do not prove that every future incident will be prevented or that an individual account cannot be phished.
In June 2024, Kraken disclosed a deposit-and-funding bug that a third-party security company exploited before reporting. Kraken said it patched the issue and that no client assets were impacted or vulnerable. That is Kraken's account of the incident, not proof that software risk is absent.
Rather than repeat an absolute “never hacked” slogan, treat the disclosed record as one input. Incident definitions differ, private events may not be public, and a long history cannot establish future safety. For most individuals, phishing-resistant sign-in, locked settings, verified withdrawal addresses, and a small test withdrawal are the controls they can evaluate directly.
Custody and Legal Protection
Kraken's global terms, last updated August 4, 2026, say digital assets in an account are held in custody for the customer and that title remains with the customer. The terms also say a court could disagree with Kraken's treatment and subject those assets to creditor claims. Kraken may use shared blockchain addresses it controls while maintaining separate internal ledgers. Read the current global terms.
The same terms state that Kraken is not a bank or depository institution and that accounts and digital assets are not protected by FDIC, SIPC, or comparable coverage. In practical terms, Kraken controls the keys and the withdrawal system while ETH remains in the account, even though the contract says customer title remains intact.
That custody model may be appropriate for active trading, fiat access, or supported staking. It is a poor fit for ETH you do not need on an exchange if your priority is removing exchange counterparty risk. Our Ethereum wallet guide explains the separate responsibilities and failure modes of self-custody.
Proof of Reserves: Useful, but Bounded
Kraken's Proof of Reserves page says clients can verify that in-scope account balances were included and backed by assets at the time of a review. That is more informative than an unsupported reserve claim.
Kraken also states the limits plainly: a review proves control over on-chain funds at a point in time, but cannot prove exclusive possession of every private key, identify hidden encumbrances, prove funds were not borrowed for the review, or show what happened after the review date. Treat it as a transparency control, not a full financial-statement audit, insolvency guarantee, or replacement for the exchange-bankruptcy risk check.
Current Fees: Verify the Product and Exact Quote
Checked August 15, 2026, Kraken's public general spot table displayed Tier 1 at 0.40% maker and 0.80% taker. Its cross-platform tiers, effective July 9, 2026, use qualifying 30-day spot volume or eligible Assets on Platform, whichever produces the better tier. See the current fee schedule and tier-change explanation.
Kraken says Instant Buy volume does not count toward the 30-day spot-volume test, and some request-for-quote products use an all-inclusive quoted price rather than the same maker/taker schedule. Product, region, order type, and withdrawal network can therefore change the all-in cost.
A holdings-based discount is not free: moving extra ETH or other eligible assets onto a custodial exchange to reach a lower tier increases the balance exposed to platform and account-access risk. Compare the same order type and exact preview on the day you intend to trade.
Do not reuse a stale withdrawal-fee number. Review the live withdrawal confirmation before sending, then test the destination with a small amount when the network fee and minimum make that practical.
Staking, Regulation, and Availability
In February 2023, the SEC announced a $30 million settlement with two Kraken entities over the prior U.S. staking-as-a-service program. The entities agreed to cease that offer and, without admitting or denying the allegations, consented to injunctive relief described by the SEC.
That history does not make the stale claim “U.S. customers cannot stake” accurate today. On January 30, 2025, Kraken announced a new on-chain staking product for eligible clients in 37 states and two territories. Availability remains state-, asset-, and product-specific.
Kraken's staking overview, updated July 30 and checked August 15, 2026, lists ETH under bonded staking. It says bonded assets are unavailable for trading or external transfer while staked, rewards vary with what Kraken earns on-chain minus its fee, and the bonded commission tier is 25% below $1 million of eligible staked assets. Read the current staking overview.
Kraken's availability page was updated August 11, 2026. It says general services are unavailable to residents of Maine and New York and lists additional transfer, funding, asset, and product restrictions elsewhere. Check the current licensing and availability page before opening or funding an account.
Who Kraken May — and May Not — Suit
Kraken may suit an eligible customer who needs a custodial exchange, values passkey support and settings locks, wants a public spot-fee schedule, and understands the limits of point-in-time reserve reviews. It may also fit someone using supported bonded staking who accepts the commission, liquidity delay, and custody.
It may not suit residents of excluded jurisdictions, anyone seeking FDIC or SIPC protection for ETH, someone who wants exchange counterparty risk removed, or a trader who has not compared the exact all-in quote. Long-term ETH that does not need exchange access presents a separate self-custody decision.
Six Checks Before Funding
- Confirm that Kraken and the exact trading or staking product are available in your jurisdiction.
- Compare the same ETH order type, total preview, and withdrawal network rather than one headline fee.
- Use a unique password, phishing-resistant passkey or security key, and a separately secured email account.
- Enable Global Settings Lock and verify every new withdrawal address through a trusted channel.
- Send a small test transfer before moving a material balance when fees and minimums make that practical.
- Keep only the ETH needed for the exchange task, and do not treat Proof of Reserves as a solvency guarantee.
The Bottom Line
Kraken can be a defensible custodial exchange choice for an eligible user who enables its strongest controls and accepts its terms. “Safe” is still relative to the task: a well-secured trading balance, bonded staking position, and long-term holding each carry different custody, liquidity, and account-access risks.
The evidence supports a balanced conclusion, not a universal ranking. Check the live product terms and quote, keep exchange exposure deliberate, and use self-custody for ETH whose purpose does not require an intermediary only if you are prepared to manage the backup and transaction-verification responsibilities yourself.
Sources and Freshness
Product disclosures were checked August 15, 2026. The source's own effective or update date is stated above where material. Rates, fees, eligibility, and terms can change.
- Kraken security protocols and account controls
- Kraken Global Terms of Service — updated August 4, 2026
- Kraken Proof of Reserves methodology and limitations
- Kraken fee schedule
- Cross-platform fee-tier changes — effective July 9, 2026
- Kraken staking overview — updated July 30, 2026
- New U.S. on-chain staking product — January 30, 2025
- Kraken licensing and availability — updated August 11, 2026
- Kraken's June 2024 deposit-and-funding bug disclosure
- SEC staking settlement release — February 9, 2023
