Kraken Wrapped Bitcoin (kBTC)

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

APPROVED WITH LIMITS, THE STRONGEST-GOVERNED CEX-ISSUED WRAPPED BITCOIN THIS REVIEW HAS SEEN. kBTC is custodied by Kraken Financial, a Wyoming-chartered Special Purpose Depository Institution — a regulated state bank charter built specifically for digital-asset custody, not an ordinary exchange hot wallet or an offshore joint venture. The contract carries an independent Trail of Bits audit alongside Kraken’s internal review, and Kraken proactively migrated kBTC’s cross-chain infrastructure from LayerZero to CCIP in May 2026, ahead of any kBTC-specific incident and explicitly citing the April 2026 Kelp DAO/LayerZero exploit this registry separately rejected LayerZero over. Redemption still requires a Kraken account, so this remains single-issuer, KYC-gated exposure — capped accordingly, not treated as equivalent to sovereign BTC.

Kill criteria: the events that revoke this verdict
• Any confirmed depeg, unbacked mint, or reserve shortfall for kBTC specifically
• Kraken Financial’s Special Purpose Depository Institution charter is suspended, revoked, or materially restricted by Wyoming regulators
• A freeze or blacklist function is found in the deployed contract without prior disclosure
• A confirmed security incident specifically compromises kBTC minting, redemption, or the SPDI custody wallets, as distinct from general Kraken-exchange incidents unrelated to kBTC backing

The research file

Mechanism

kBTC is minted 1:1 when a Kraken account holder withdraws BTC and selects a destination network — Ethereum, OP Mainnet, Ink, or Unichain at this review, with more planned. Redemption reverses this: depositing kBTC into a Kraken account on the matching network auto-converts it back to BTC. The token contract address is consistent across all four supported chains.

Control and governance

Custody sits with Kraken Financial, a Wyoming Special Purpose Depository Institution: a state bank charter created specifically for regulated digital-asset custody. Reserves are held in segregated wallets with a published verification address a client can check directly, rather than relying solely on issuer self-reporting. The smart contract was reviewed by Kraken’s internal security team and independently audited by Trail of Bits. No freeze or blacklist function was disclosed in Kraken’s own documentation; this review did not independently verify that against the deployed bytecode. In May 2026 Kraken announced kBTC, and all future wrapped assets, would migrate exclusively from LayerZero to Chainlink CCIP, explicitly in response to the April 2026 Kelp DAO exploit — a proactive migration for a product that was never itself exploited, not a reactive cleanup after a loss.

Incident record

No kBTC-specific depeg, custody failure, or contract exploit was identified. Kraken the exchange carries a broader regulatory and security record worth weighing as custodian-trust context, though none of it is a kBTC custody or minting failure: a $30M SEC staking-program settlement in February 2023; an SEC unregistered-exchange suit dismissed with prejudice and no penalty in March 2025; a June 2024 white-hat-disclosed withdrawal-logic bug worth about $3M with no customer funds affected; an April 2026 extortion attempt over limited internal data access affecting about 2,000 accounts, with no funds lost and Kraken refusing to pay; and an $8M fine from an Australian federal court in December 2024 against Kraken’s local operator. None of these touch kBTC’s backing or minting process directly.

Exit

Redemption requires a Kraken account and is subject to Kraken’s geographic and KYC restrictions — structurally the same account-gated redemption pattern as Binance-Peg BTCB, already rejected in this registry, and the one dimension where kBTC does not clear the bar set by its stronger custody and audit story. A client without an eligible Kraken account has no par-redemption path and must rely on secondary-market liquidity.

Comparison

Materially stronger than BTCB (an upgradeable proxy under single-entity control with no disclosed regulated custody charter) and JustCryptos (undisclosed architecture, Poloniex hot-wallet custody, a confirmed $100M-plus breach), both rejected in this registry — a chartered, regulated depository institution plus an independent audit plus a proactive migration to the stronger of the two cross-chain messaging layers this registry has evaluated is a difference in kind, not degree. Against WBTC, also rejected here for a completed custody-concentration transition to a Justin Sun-linked entity, kBTC’s single custodian is a US-regulated bank rather than an offshore joint venture, though single-entity dependence remains real either way.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Kraken — kBTC product page · primary · accessed 2026-08-17
  Supports: mechanism, supported chains
• Kraken Support — what is kBTC · primary · accessed 2026-08-17
  Supports: redemption process
• Kraken Blog — introducing Kraken Wrapped Bitcoin · primary · accessed 2026-08-17
  Supports: launch announcement, custody structure
• CoinDesk — Kraken launches wrapped bitcoin token kBTC · secondary · accessed 2026-08-17
  Supports: launch context
• CoinDesk — Kraken to replace LayerZero with Chainlink for kBTC and future wrapped assets · secondary · accessed 2026-08-17
  Supports: CCIP migration, proactive timing
• SEC.gov — Kraken to discontinue unregistered staking-as-a-service, pay $30M · primary · accessed 2026-08-17
  Supports: 2023 settlement

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.