~£400k of XRP/XLM withdrawn within minutes of a first-ever new-device login; two IPs active at once, saved addresses deleted then replaced.

On 10 July 2025 my Kraken account was accessed from a device type it had never once been used on, on a network it had never used. Within minutes, every one of my long-standing, whitelisted withdrawal addresses was deleted and replaced with brand-new ones. The account's own activity record shows two different IP addresses acting at the same time — something a real-time monitoring system should treat as a red flag. About 80,009 XRP and 214,449 XLM — roughly £400,000 — were then withdrawn to addresses that had been added around sixty seconds earlier. By the time the account was blocked, both withdrawals had already completed and the funds were gone. I reported it immediately. The answer I received was that, under the Terms of Service, I was responsible. I have never recovered the money. I'm sharing this in anonymised form so that anyone who has been through the same thing knows they are not the only one — and so the pattern is on the record.