Kraken security features: what protects your account
Kraken offers two-factor authentication, withdrawal whitelists and cold storage. Crypto balances are not FDIC insured, so you protect your password.
Vahe HakobyanEditor-in-chief
Updated Oct 6, 20263 min readFact-checked
On this page
These controls sit in your account settings and on the API page. They limit who can sign in, move crypto or trade through software.
What account security features can I turn on?
Kraken offers a master key, a global settings lock, two-factor authentication, withdrawal whitelists and an anti-phishing phrase. Two-factor authentication adds a second step when you sign in or withdraw. You can use an authenticator app or a hardware security key. A withdrawal whitelist limits transfers to addresses you approve.
How do API keys and sessions stay safe?
API keys let software trade or withdraw without your password. Kraken lets you set permissions and an IP whitelist for each key. Session controls show active logins and let you end unknown connections.
- Give each API key only the permissions the tool needs.
- Turn off withdrawal permission unless the tool needs it.
- Set an IP whitelist so the key works only from approved addresses.
- Delete keys you no longer use.
- Check active sessions and sign out unknown devices.
How does Kraken protect stored crypto?
Kraken holds most customer crypto in cold storage. Cold storage keeps private keys offline. Kraken also publishes proof-of-reserves reports that show the crypto it says it holds. These reports are a snapshot, not a full audit of every balance.
What security limits should I know?
Kraken's protections reduce risk, but they do not remove it. Crypto balances are not FDIC insured, so bank deposit protection does not apply. You are responsible for your password, your devices and your two-factor backup. Phishing can capture a password and a live two-factor code.
Frequently asked questions
Kraken does not provide FDIC insurance for crypto balances. Any private coverage it carries is limited and is not deposit insurance.
With your Master Key or a spare security key, you can sign in. Without a backup, you must contact Kraken support and verify your identity; access can be delayed.
Kraken does not support SMS for two-factor authentication. Use an authenticator app or a hardware security key instead.
Kraken's proof-of-reserves reports are not a full third-party audit of every customer balance. They are snapshots that show assets at a point in time.
