Kraken has restricted trading and funding for World Mobile Token (WMTX) and MultiversX (EGLD), leaving two crypto assets in cancel-only mode as separate security incidents surrounding the tokens add urgency to what initially appeared to be exchange funding problems.
For WMTX, Kraken paused deposits and withdrawals at 08:13 UTC on September 20. Just over four hours later, at 12:22 UTC, the exchange escalated the restriction by placing WMTX trading pairs into cancel-only mode. Existing orders can be cancelled, but customers cannot submit new orders and trades will not execute.
The WMTX incident remained unresolved on Kraken’s status page on September 21.
EGLD has been restricted for longer. Kraken first reported a problem with its MultiversX funding gateway at 13:58 UTC on September 16, warning that deposits and withdrawals could be delayed. On September 19, the exchange escalated the incident by placing EGLD trading pairs into cancel-only mode while keeping deposits and withdrawals paused.
The developments add to a series of recent funding disruptions across crypto exchanges, but the circumstances surrounding WMTX and EGLD have since become considerably more serious than ordinary wallet maintenance.
WMTX Restrictions Follow Unauthorized Token Minting
Kraken has not publicly identified the underlying cause of its WMTX restriction beyond saying that deposits and withdrawals were paused while the exchange worked to resolve the issue. Developments elsewhere, however, provide important context.
World Mobile confirmed that an exploit involving the SingularityNET bridge resulted in WMTX being minted on Ethereum without authorization. The project said it was working with exchanges and other parties to freeze affected deposits while security teams moved to revoke minting authorities.
The incident appears connected to a wider attack cluster involving several blockchain projects. Security researchers linked activity around WMTX to the attacker involved in recent incidents affecting SingularityNET-related infrastructure, while a separate attack sequence had already hit Fetch.ai and NuNet.
Other exchanges reacted independently. Bitvavo said on September 20 that it was aware of an active WMTX security incident and initially suspended deposits and withdrawals before halting trading. Bitso also restricted WMTX activity, citing a security incident and significant price volatility.
That broader response makes it unlikely that Kraken’s restriction is simply an isolated problem with its own wallet systems.
At the same time, Kraken’s status dashboard lists its WMTX-on-Base funding component as degraded, while Base reported no network-wide incident on September 20. The distinction matters because an exchange can restrict an asset even while the blockchain carrying that asset remains operational. Similar differences between an underlying network and the infrastructure used to access it have appeared during other recent episodes of crypto infrastructure degradation.
EGLD Restriction Escalates as MultiversX Responds to Exploit Attempt
The EGLD situation followed a different timeline.
Kraken’s funding problem began on September 16, several days before MultiversX disclosed the security event now affecting the network. That means there is not enough evidence to say the original Kraken gateway problem was caused by the later exploit.
But the situation changed materially on September 19.
MultiversX has since confirmed that an attacker attempted to exploit a virtual-machine-level atomicity issue, producing invalid state changes. Network progression was paused to prevent further impact, and users were told not to submit or rebroadcast transactions or use EGLD and ESDT deposit and withdrawal routes through exchanges and bridges.
Kraken moved EGLD trading into cancel-only mode on the same date.
By September 21, MultiversX said the MultiversX security incident had been contained. The project said the attacker’s accounts had been identified and frozen with assistance from major exchanges and that law enforcement was involved.
Its recovery plan has also become clearer. MultiversX is preparing a coordinated hard fork from a known-good checkpoint, with the code being rehearsed on testnet and devnet before validators deploy it. Exchanges and bridges are expected to reopen in stages after the network restart.
That staged approach resembles other recent cases where restoring block production did not immediately mean restoring full economic activity. Liquid Network, for example, entered a controlled network recovery in which blocks resumed before normal transactions and peg operations were reopened.
Why Cancel-Only Mode Matters More Than a Funding Pause
For investors, the most important detail in both Kraken incidents is the move from funding restrictions to trading restrictions.
A deposit or withdrawal suspension isolates an exchange from the blockchain while still allowing customers already holding the asset on the platform to trade internally. Cancel-only mode goes further: price discovery on that venue effectively stops because existing orders can be removed but no new trades can execute.
That is a logical defensive step when an exchange is uncertain whether incoming tokens are legitimate, whether the underlying chain state can be trusted or whether a security incident could affect settlement.
The risk is particularly obvious in an unauthorized-minting scenario. If newly created tokens reach an exchange and are credited before they are identified as illegitimate, an attacker can potentially sell them for Bitcoin, stablecoins or other liquid assets and withdraw the proceeds. This is why exchanges frequently suspend deposits over security concerns before the full technical picture becomes public.
WMTX illustrates that problem directly. The Base network can continue functioning normally while an issue involving token minting or bridge authorization still creates enough uncertainty for exchanges to stop accepting and trading the asset.
EGLD presents a different but equally difficult problem. Here, exchanges must eventually determine that the recovered MultiversX state is canonical, that deposits correspond to valid balances and that transactions processed around the incident will not later conflict with the state accepted after the hard fork.
Reopening Trading Will Be the Real Test
The next important signal is therefore not simply whether Kraken changes the incidents from “investigating” to “resolved.”
For WMTX, investors should watch whether World Mobile can establish the full amount of unauthorized supply, determine where those tokens moved, complete the removal of compromised minting authority and give exchanges enough confidence to reopen deposits and trading. If different venues reopen at different times, liquidity could remain fragmented even after the immediate attack has been contained.
For EGLD, the checklist is longer. MultiversX must complete the hard fork, demonstrate that the repaired state is internally consistent, coordinate validators, reconcile activity with exchanges and bridges and then allow outside infrastructure providers to verify the recovered chain independently.
Kraken has dealt with several operational restrictions recently, including maintenance that temporarily took parts of Kraken’s futures infrastructure offline. WMTX and EGLD are fundamentally different because the exchange is responding to uncertainty surrounding the assets and their external infrastructure rather than conducting planned maintenance.
That makes reopening more complicated than simply fixing an exchange server.
In both cases, Kraken needs confidence in what it will be accepting, holding and allowing customers to trade. Until that confidence returns, cancel-only mode effectively creates a quarantine between questionable external activity and the exchange’s internal market.
For WMTX and EGLD holders, the eventual reopening conditions may consequently reveal more than the reopening itself. If trading and funding resume quickly after clear technical remediation, the incidents may remain contained security events. If restrictions persist after the projects declare their systems recovered, that would indicate exchanges still have unresolved questions about token validity, chain state or settlement risk.
Right now, that verification process is the part investors should be watching most closely.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape.