{"investigation":{"slug":"xt-exchange","entity_name":"XT Exchange","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"XT Exchange (XT.com), founded in 2018 and registered in Seychelles, is a centralized cryptocurrency exchange that has been flagged by multiple regulatory authorities — including the UK FCA, Dubai VARA, Thailand SEC, and the Seychelles FSA — for operating without proper licensing. The exchange suffered a $1.7 million hot wallet exploit in November 2024 due to a compromised private key, and has accumulated substantial user complaints alleging unjustified account freezing, asset seizure, and blocked withdrawals. Independent analysis has also raised concerns about inflated trading volumes and inadequate proof-of-reserves transparency.","sections":[{"content":"XT.com is a centralized cryptocurrency exchange founded in 2018 by Weber Woo and Ada Too, both of whom have since departed the company. It is operated by Fibtc Ltd, a company registered in Seychelles, and claims to be 'the world's first social-infused exchange.' As of late 2025, the platform reports over 7.8 million registered users, more than 1 million monthly active users, and supports over 1,000 tokens across 1,300 trading pairs. Services include spot trading, futures trading with up to 20x leverage, margin trading, OTC trading, staking, and NFT marketplace access. The current CEO is Albin Warin, a French entrepreneur who joined as Global Ecosystem Director in March 2022 and assumed the CEO role in January 2023. The company lists Dubai, UAE as its current headquarters, with alleged operational centers in Japan, South Korea, Singapore, and Poland.","heading":"Background and Overview","sources":[{"url":"https://iq.wiki/wiki/xt","name":"iq.wiki","type":"other","credibility":3},{"url":"https://www.crunchbase.com/person/albin-warin-032c","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://medium.com/@XT_com/web3-tv-interviews-xt-com-ceo-albin-warin-on-crypto-market-and-nfts-at-crypto-expo-dubai-2023-d49552b22615","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"XT.com has received formal regulatory warnings from at least four separate jurisdictions, none of which have found the exchange to hold valid operating licenses.\n\nThe UK Financial Conduct Authority (FCA) issued a warning on March 25, 2025, stating that XT.com 'may be promoting financial services or products without our permission' and is not authorized or registered by the FCA. The FCA noted that UK customers dealing with XT.com cannot access the Financial Ombudsman Service or the Financial Services Compensation Scheme.\n\nDubai's Virtual Assets Regulatory Authority (VARA) issued a Consumer and Marketplace Alert on November 29, 2024, warning that 'XT.com is not appropriately licensed to provide virtual asset services in/from Dubai.' VARA stated that engaging with the platform exposes users to 'significant financial risks and potential legal consequences' and advised investors to avoid the platform entirely. Website access may be restricted without prior notice, per the alert.\n\nThailand's Securities and Exchange Commission, in an announcement dated May 30, 2025, filed charges against XT.com with the Economic Crime Suppression Division and requested the Ministry of Digital Affairs block access to the platform effective June 28, 2025. The Thai SEC cited violations of the Digital Asset Business Act for operating without a license while targeting Thai users through local-language content and payment methods.\n\nThe Financial Services Authority of Seychelles (FSA) — the jurisdiction where XT.com's operating entity Fibtc Ltd is incorporated — issued a notice stating that XT.com 'is not linked to any entity licensed or regulated by the FSA in any capacity.' This means the exchange operates without a valid license even in its own country of registration.","heading":"Regulatory Warnings and Unlicensed Operations","sources":[{"url":"https://www.fca.org.uk/news/warnings/xtcom","name":"fca.org.uk","type":"other","credibility":3},{"url":"https://www.vara.ae/en/regulations/regulatory-notices/vara-consumer-and-marketplace-alert-xt/","name":"vara.ae","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2025/05/30/thailand-to-block-okx-bybit-and-others-citing-lack-of-license","name":"coindesk.com","type":"other","credibility":3},{"url":"https://fsaseychelles.sc/media-corner/regulatory-updates","name":"fsaseychelles.sc","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/dubais-regulator-alert-xt-other-entities/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://beincrypto.com/thailand-sec-blocks-crypto-exchanges/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 28, 2024, XT.com suffered a security exploit in which approximately $1.7 million in cryptocurrency was stolen from the exchange's hot wallets. The breach was first identified by blockchain security firm PeckShield. The attack vector was a compromised private key that granted the attacker unauthorized access to the platform's hot wallet infrastructure. Across 12 different token types, the stolen assets were consolidated and converted to approximately 461.58 ETH, valued at roughly $1.7 million at the time, and moved to a newly created external wallet address.\n\nFollowing detection of the breach, XT.com suspended all withdrawals on the platform for approximately 12 hours. The exchange stated that user funds were not affected, citing a reserve ratio of 1.5x user assets. Independent security firm Halborn, analyzing the incident, noted that the use of multi-signature or multi-party computation (MPC) wallets for hot wallet protection would have significantly reduced the risk of this type of attack.\n\nThe exchange reported $3.3 billion in 24-hour trading volume at the time of the incident and held approximately $47.7 million in disclosed reserves. The incident occurred in the context of a broader wave of centralized exchange hacks in 2024, including BingX ($43 million) and Indodax ($22 million) in September of that year.","heading":"November 2024 Security Breach","sources":[{"url":"https://www.coindesk.com/business/2024/11/28/crypto-exchange-xt-is-hacked-for-1-7-m","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-xt-exchange-hack-november-2024","name":"halborn.com","type":"other","credibility":3},{"url":"https://cer.live/blog/xt-com-hit-by-access-control-exploit-1-7m-lost","name":"cer.live","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/crypto-exchange-xt-com-withdrawal-halt-1-7-million-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://beincrypto.com/xt-dot-com-hacked-withdrawals-suspended/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/xt-exchange-assures-users-after-1-7-million-asset-theft-disrupts-services/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"A recurring pattern of user complaints alleges that XT.com systematically freezes accounts and seizes funds belonging to profitable traders. A formal scam report filed on the CCXT GitHub repository describes accounts being locked with the stated reason 'Your account has been restricted from logging in due to triggering risk control,' with profits beyond principal capital allegedly transferred to the company without legal justification. The reporter noted that multiple other users appeared to have experienced identical treatment, describing it as a pattern potentially targeting automated trading bots.\n\nTrustpilot reviews spanning 2025 and into 2026 include numerous accounts of: accounts frozen mid-withdrawal with no resolution timeline; endless document submission loops following full KYC completion; and support responses limited to generic 'please wait' messages with no escalation path. Trustpilot itself is alleged to have taken action against fake positive reviews submitted on behalf of XT.com, which the BrokerhiveX analysis also flagged.\n\nXT.com's own risk control documentation acknowledges that the platform may freeze accounts, require video KYC, block withdrawals, or restrict logins for users it determines have engaged in 'illegal arbitrage.' Critics contend that these policies are applied opaquely, without disclosed criteria, and function as a mechanism to confiscate profitable accounts.\n\nAs of May 2026, the platform holds a 2.1/5 rating on Trustpilot with the majority of reviews being 1-star, and over 150 complaints have been catalogued by the platform FX110.","heading":"Account Freezing and Asset Seizure Complaints","sources":[{"url":"https://github.com/ccxt/ccxt/issues/18315","name":"github.com","type":"other","credibility":3},{"url":"https://www.trustpilot.com/review/xt.com","name":"trustpilot.com","type":"other","credibility":3},{"url":"https://www.brokerhivex.com/en/broker-reviews/68bb286d71f3f","name":"brokerhivex.com","type":"other","credibility":3},{"url":"https://xtsupport.zendesk.com/hc/en-us/articles/900006675406-XT-s-Risk-Control-Protocol","name":"xtsupport.zendesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Independent analysts and aggregators have raised concerns about the authenticity of XT.com's reported trading volumes. CoinPaprika data shows a substantial discrepancy between the exchange's reported 24-hour volume (approximately $2.49 billion) and the estimated real volume (approximately $1.14 billion), suggesting that as much as 54% of reported volume may not reflect genuine market activity.\n\nBrokerhiveX, in a detailed review, described XT.com's compliance rating as 1/10, noting that the exchange 'once advertised global compliance on its official website but never disclosed its license number,' and that no valid financial license was found in the databases of the MAS (Singapore), VARA (UAE), the Seychelles FSA, or any other recognized regulatory body.\n\nXT.com's Proof of Reserves (PoR) approach has also been criticized as less transparent than industry peers. While the exchange claims a 1:1 reserve ratio using Merkle Tree verification, independent observers have noted that XT.com does not publish the comprehensive reserve disclosures — including per-asset user liabilities alongside reserve balances — that exchanges such as Binance, Bitget, and Bybit provide. A January 2024 reserves disclosure reported total assets of approximately $56.22 million USD, but the methodology and third-party verification credentials of that disclosure have not been independently confirmed.","heading":"Trading Volume Integrity and Transparency Concerns","sources":[{"url":"https://coinpaprika.com/exchanges/xt/","name":"coinpaprika.com","type":"other","credibility":3},{"url":"https://www.brokerhivex.com/en/broker-reviews/68bb286d71f3f","name":"brokerhivex.com","type":"other","credibility":3},{"url":"https://www.xt.com/en/accounts/proof-of-reserves","name":"xt.com","type":"other","credibility":3},{"url":"https://xtsupport.zendesk.com/hc/en-us/articles/27400354423961-XT-COM-Announcement-on-Reserves-Disclosure","name":"xtsupport.zendesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"XT.com has historically permitted unverified users to withdraw up to $200,000 per day without completing Know Your Customer (KYC) procedures, a policy that drew criticism from compliance professionals who argued it creates significant money laundering risk. Multiple regulatory bodies, including Thailand's SEC and VARA, have specifically cited AML concerns in their enforcement actions against the exchange.\n\nThe exchange is registered under Fibtc Ltd in Seychelles but does not hold a Virtual Asset Service Provider license from the Seychelles FSA, which is required under the Virtual Asset Service Providers Act, 2024. Despite listing Dubai as its headquarters, it holds no VARA license in the UAE. Despite serving European users through Polish operational entities, no EU/EEA licensing has been disclosed.\n\nThe Thai SEC explicitly warned investors that using unlicensed platforms such as XT.com could result in 'inadvertent participation in criminal activities such as money laundering.'","heading":"KYC, Compliance, and AML Concerns","sources":[{"url":"https://www.coindesk.com/policy/2025/05/30/thailand-to-block-okx-bybit-and-others-citing-lack-of-license","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.vara.ae/en/regulations/regulatory-notices/vara-consumer-and-marketplace-alert-xt/","name":"vara.ae","type":"other","credibility":3},{"url":"https://fsaseychelles.sc/media-corner/regulatory-updates","name":"fsaseychelles.sc","type":"other","credibility":3},{"url":"https://cryptonews.com/reviews/xt-exchange-review/","name":"cryptonews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"AVOID.NET's intake records indicate that ZachXBT, the on-chain investigator known for exposing fraud and theft in the crypto ecosystem, flagged XT Exchange as a concern. Specific public posts by ZachXBT directly addressing XT.com were not independently located in open-source searches conducted for this investigation, though the exchange's name appears in blockchain security communities in the context of the November 2024 hack. The ZachXBT flag, as reported in this investigation's intake, is treated as a low-confidence signal pending direct citation from ZachXBT's Telegram channel or X posts. The November 2024 hack was initially flagged by PeckShield, a different on-chain security firm.","heading":"ZachXBT Flag","sources":[{"url":"https://t.me/s/investigations","name":"t.me","type":"other","credibility":3},{"url":"https://x.com/zachxbt","name":"x.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"XT.com founded by Weber Woo and Ada Too, registered in Seychelles as Fibtc Ltd","source":"","date_original":"2018-01-01"},{"date":"2022-03","event":"Albin Warin joins XT.com as Global Ecosystem Director","source":"","date_original":"2022-03-01"},{"date":"2023","event":"Albin Warin becomes CEO of XT.com","source":"","date_original":"2023-01-01"},{"date":"2024-01-08","event":"XT.com publishes reserves disclosure claiming approximately $56.22 million in total assets","source":""},{"date":"2024-11-28","event":"$1.7 million stolen from XT.com hot wallets via compromised private key; withdrawals suspended for approximately 12 hours. PeckShield identifies the breach.","source":""},{"date":"2024-11-29","event":"Dubai VARA issues Consumer and Marketplace Alert warning that XT.com is not licensed to provide virtual asset services in Dubai","source":""},{"date":"2025-03-25","event":"UK FCA issues warning that XT.com may be promoting financial services without FCA permission and is not authorized or registered","source":""},{"date":"2025-05-30","event":"Thailand SEC files charges against XT.com with the Economic Crime Suppression Division for operating without a license under the Digital Asset Business Act","source":""},{"date":"2025-06-28","event":"Thailand blocks access to XT.com following SEC enforcement action","source":""},{"date":"2026-04-09","event":"Seychelles FSA issues notice stating XT.com is not linked to any entity licensed or regulated by the FSA under the Virtual Asset Service Providers Act","source":""}],"sources_used":[{"url":"https://iq.wiki/wiki/xt","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260804160209/https://iq.wiki/wiki/xt","credibility":3,"archive_timestamp":"2026-08-04T16:02:09+00:00"},{"url":"https://www.crunchbase.com/person/albin-warin-032c","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/@XT_com/web3-tv-interviews-xt-com-ceo-albin-warin-on-crypto-market-and-nfts-at-crypto-expo-dubai-2023-d49552b22615","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.fca.org.uk/news/warnings/xtcom","name":"fca.org.uk","type":"other","archive_url":"http://web.archive.org/web/20260317025825/https://www.fca.org.uk/news/warnings/xtcom","credibility":3,"archive_timestamp":"2026-03-17T02:58:25+00:00"},{"url":"https://www.vara.ae/en/regulations/regulatory-notices/vara-consumer-and-marketplace-alert-xt/","name":"vara.ae","type":"other","archive_url":"http://web.archive.org/web/20260411060413/https://www.vara.ae/en/regulations/regulatory-notices/vara-consumer-and-marketplace-alert-xt/","credibility":3,"archive_timestamp":"2026-04-11T06:04:13+00:00"},{"url":"https://www.coindesk.com/policy/2025/05/30/thailand-to-block-okx-bybit-and-others-citing-lack-of-license","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260720143934/https://www.coindesk.com/policy/2025/05/30/thailand-to-block-okx-bybit-and-others-citing-lack-of-license","credibility":3,"archive_timestamp":"2026-07-20T14:39:34+00:00"},{"url":"https://fsaseychelles.sc/media-corner/regulatory-updates","name":"fsaseychelles.sc","type":"other","archive_url":"http://web.archive.org/web/20260825085414/https://fsaseychelles.sc/media-corner/regulatory-updates","credibility":3,"archive_timestamp":"2026-08-25T08:54:14+00:00"},{"url":"https://www.cryptopolitan.com/dubais-regulator-alert-xt-other-entities/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20251028103521/https://www.cryptopolitan.com/dubais-regulator-alert-xt-other-entities/","credibility":3,"archive_timestamp":"2025-10-28T10:35:21+00:00"},{"url":"https://beincrypto.com/thailand-sec-blocks-crypto-exchanges/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251110230831/https://beincrypto.com/thailand-sec-blocks-crypto-exchanges/","credibility":3,"archive_timestamp":"2025-11-10T23:08:31+00:00"},{"url":"https://www.coindesk.com/business/2024/11/28/crypto-exchange-xt-is-hacked-for-1-7-m","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-xt-exchange-hack-november-2024","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260812011243/https://www.halborn.com/blog/post/explained-the-xt-exchange-hack-november-2024","credibility":3,"archive_timestamp":"2026-08-12T01:12:43+00:00"},{"url":"https://cer.live/blog/xt-com-hit-by-access-control-exploit-1-7m-lost","name":"cer.live","type":"other","archive_url":"https://web.archive.org/web/20260829024921/https://cer.live/blog/xt-com-hit-by-access-control-exploit-1-7m-lost","credibility":3,"archive_timestamp":"2026-08-29T02:49:21+00:00"},{"url":"https://cointelegraph.com/news/crypto-exchange-xt-com-withdrawal-halt-1-7-million-hack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260417003625/https://cointelegraph.com/news/crypto-exchange-xt-com-withdrawal-halt-1-7-million-hack","credibility":3,"archive_timestamp":"2026-04-17T00:36:25+00:00"},{"url":"https://beincrypto.com/xt-dot-com-hacked-withdrawals-suspended/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptoslate.com/xt-exchange-assures-users-after-1-7-million-asset-theft-disrupts-services/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260521114442/https://cryptoslate.com/xt-exchange-assures-users-after-1-7-million-asset-theft-disrupts-services/","credibility":3,"archive_timestamp":"2026-05-21T11:44:42+00:00"},{"url":"https://github.com/ccxt/ccxt/issues/18315","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20251110002033/https://github.com/ccxt/ccxt/issues/18315","credibility":3,"archive_timestamp":"2025-11-10T00:20:33+00:00"},{"url":"https://www.trustpilot.com/review/xt.com","name":"trustpilot.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.brokerhivex.com/en/broker-reviews/68bb286d71f3f","name":"brokerhivex.com","type":"other","archive_url":"http://web.archive.org/web/20251216143334/https://www.brokerhivex.com/en/broker-reviews/68bb286d71f3f","credibility":3,"archive_timestamp":"2025-12-16T14:33:34+00:00"},{"url":"https://xtsupport.zendesk.com/hc/en-us/articles/900006675406-XT-s-Risk-Control-Protocol","name":"xtsupport.zendesk.com","type":"other","archive_url":"http://web.archive.org/web/20250914001403/https://xtsupport.zendesk.com/hc/en-us/articles/900006675406-XT-s-Risk-Control-Protocol","credibility":3,"archive_timestamp":"2025-09-14T00:14:03+00:00"},{"url":"https://coinpaprika.com/exchanges/xt/","name":"coinpaprika.com","type":"other","archive_url":"https://web.archive.org/web/20260829025906/https://coinpaprika.com/exchanges/xt/","credibility":3,"archive_timestamp":"2026-08-29T02:59:06+00:00"},{"url":"https://www.xt.com/en/accounts/proof-of-reserves","name":"xt.com","type":"other","archive_url":"http://web.archive.org/web/20260811175130/https://www.xt.com/en/accounts/proof-of-reserves","credibility":3,"archive_timestamp":"2026-08-11T17:51:30+00:00"},{"url":"https://xtsupport.zendesk.com/hc/en-us/articles/27400354423961-XT-COM-Announcement-on-Reserves-Disclosure","name":"xtsupport.zendesk.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptonews.com/reviews/xt-exchange-review/","name":"cryptonews.com","type":"other","archive_url":"http://web.archive.org/web/20251219090439/https://cryptonews.com/reviews/xt-exchange-review/","credibility":3,"archive_timestamp":"2025-12-19T09:04:39+00:00"},{"url":"https://t.me/s/investigations","name":"t.me","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/zachxbt","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:27.435277+00:00","updated_at":"2026-08-30T03:55:00.683765+00:00"}}