Whoever is doing the DDoS is probably doing it to manipulate price and of course they are going to try to cause trouble right when the market starts to move and is most ripe for manipulation.
If your website is down and API unaccessible how is price moved? Who can place market orders while all the rest can't? Why the attackers are so confident they can trade at Kraken while all the rest can't?
We are investigating to see if we can find a connection between the DDoS and trading on our site and will take appropriate action if we can identify someone, but it may be very hard to do so.
Is there a customer or group of customers that have privileged access to your trading engine? They must also have access to the order book, including hidden orders! They can profit only if they know at what price level majority of 'take profit' and 'margin liquidation' orders are grouped.