I suspected the API too but he mentioned not using it for a while, so. (unless the keys were altered long ago and used only now? anyway, the person couldn't transfer out anything since you need email verification for any address you add)


Kraken support is handled by real people. In every communication, I've got a developed discussion and not a canned speech copy-pasted.
Most support tickets can be resolved the same day, but when it's about IT security it takes time to do a proper investigation to check if even it's an IT issue...


Users are automatically logged out after X minutes inactive.