KuCoin

Is KuCoin safe?

KuCoin is a large offshore exchange with a long list of coins and a poor regulatory record. It did right by customers after a big hack in 2020, but in January 2025 its operator pleaded guilty to a US federal charge, and Austria's regulator has still not let its MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary-licensed EU entity start operating. We score it 49/100, below Binance at 52.

If you need a coin only KuCoin lists, keep the balance small and short-lived.

The 2020 hack and how it was handled

On 25 September 2020 KuCoin found that the private keys to its hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary had been stolen. Attackers took about $281 million in bitcoin, ether and ERC-20 tokens. The analytics firm Chainalysis later linked the attack to North Korea's Lazarus Group.

KuCoin's response was effective. It worked with token issuers to freeze or upgrade affected contracts, and with other exchanges to block deposits from the thieves. Within a few weeks it said it had recovered most of the stolen value and would cover the rest from its insurance fund. Trading and withdrawals resumed, and KuCoin said no user lost money. That earns a score in the 60s: a large hack, fully repaid, but one that shows how much was sitting in hot wallets.

A long list of enforcement actions

Year	Authority	Outcome
2023	New York attorney general	$22 million paid; KuCoin left New York
2025	US Department of Justice	Guilty plea; more than $297 million in penalties
2025	FINTRAC (Canada)	C$19.55 million penalty as an unregistered foreign money services business; under appeal
2026	FMA (Austria)	EU entity barred from starting business; new-business ban February to May
2026	VARA (Dubai)	Alert of 5 March: KuCoin has no Dubai licence; four KuCoin companies told to stop serving residents
2026	VARA (Dubai)	June fine (amount not published) on Peken Global for serving Dubai customers without a licence

The US case is the most serious. On 27 January 2025 Peken Global, the Seychelles company behind KuCoin, pleaded guilty to operating an unlicensed money transmitting business. Prosecutors said KuCoin did not have effective anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary or know-your-customer programmes, did not report suspicious transactions and was used to move proceeds of darknet markets, ransomware and fraud. Peken agreed to a criminal forfeiture of $184.5 million and a fine of about $112.9 million, and to keep KuCoin out of the US for at least two years. Founders Chun Gan and Ke Tang agreed to step away from management under deferred prosecution agreements.

Dubai added its name in March 2026. Its Virtual Assets Regulatory Authority said on 5 March that KuCoin holds no licence to provide virtual asset services in or from Dubai, named four KuCoin companies (Peken Global, MEK Global, Phoenixfin and KuCoin Exchange EU GmbH) and said it had told them to stop offering services and marketing to residents. In June 2026 VARA followed up with fines on Peken Global alone, finding that it had offered broker-dealer or exchange services to Dubai customers without a licence. The amount was not published. VARA said Peken cooperated and intends to apply for a Dubai licence; the other three companies were not part of that action.

The MiCA licence that came with a freeze

KuCoin EU Exchange GmbH, based in Vienna, received a MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence from Austria's Financial Market Authority on 27 November 2025, covering custody, exchange and transfer of crypto-assets across the European Economic Area. Within three months the FMA said the company no longer had a money-laundering officer, a sanctions officer or deputies for either role, and on 19 February 2026 it banned new business. The FMA lifted that ban on 18 May 2026 once the posts were filled again.

The bigger obstacle remains. Under a separate decision of 18 February 2026, KuCoin EU may not start business at all until it meets governance requirements and fills further senior-management roles, and the FMA's May notice said those conditions were still not met. So the licence exists on paper, but in October 2026 we found no FMA notice saying KuCoin EU may operate. Since the MiCA transition period ended on 30 June 2026, EU residents should not expect the global KuCoin site to be a licensed option either.

Reserves and custody

KuCoin publishes a monthly proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary with a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary, so you can check that your balance was counted against its wallets. The snapshot of 30 September 2026 showed reserves of 109% for bitcoin, 117% for ether, 110% for USDT and 127% for USDC against customer balances. Mazars reviewed an earlier report in late 2022 before leaving the crypto sector. KuCoin's page says an independent third party now verifies each report, and its press releases name the security firm Hacken, which is not an accounting firm. There are no audited financial statements, so the company's other debts are not visible. KuCoin says most customer assets are in cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, but outside the Austrian entity its terms give no clear legal segregation if the company fails.

KuCoin also offers lending, bots and high-leverage futures, each with its own risks on top of the exchange's.

How to limit your risk on KuCoin

1. Use a hardware security key or authenticator app, set a trading password and turn on the anti-phishing phrase.
2. Turn on the withdrawal address whitelist.
3. Move coins off the exchange after buying them. Its legal record means a sudden freeze in your country is a real possibility.
4. Check that you are on the real site. Fake KuCoin pages and "support" accounts are common on social media and Telegram.

How we scored it

Legal record (18) is KuCoin's weakest factor, with a US guilty plea plus penalties in New York and Canada. Licensing (40) is held back because its only strict licence, the Austrian MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary authorisation, cannot yet be used. Security history (62) is its best factor, because the 2020 hack was fully covered, and reserves (60) benefit from monthly reports with customer liabilities. For a comparison, Bitget is another offshore exchange with a large customer-protection fund.