I just got my account emptied on Kraken then other day. As users of Kraken will know, with the default security settings, when you make a withdrawal, you get this Email:
....
So didn't you have enable the 2FA (with the google authenticator app)? I think, it's better safe than sorry? Especially here in this 'world', the cryptocurrency world that it's not really regulated at all.
My Kraken account got emptied 36 hours ago. Lost about 12k Euro of BTC.
I am now in discussion with them on this, similar status.
Who and how did they compromize my account? I do not know.
I did not have the sms verification setup - my mistake.
But, the IP that withdrew funds is on the other side of the world (Somewhere in canada/us?) And definitely i was not warned of the transaction prior to it. Only got an email after the funds were sent...
I don't suggest you to use the 2FA with the sms (that I don't think exists on kraken) because your sim mobile can be compromised , I know I'm paranoid but as I said before 'better safe than sorry, and your text messages can be intercepted.
I would suggest rather to use the google authenticator app, much more safe than the sms verification.
About the Canada/us IP, it is most probable that the attacker used a sort of VPN or proxy to hide his original IP address.