KuCoin Exchange Hack
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·516uz5…MKWkSummary
On September 25, 2020, the KuCoin cryptocurrency exchange suffered a major security breach in which hackers obtained the private keys to the exchange's hot wallets and stole approximately $281 million in Bitcoin, Ethereum, ERC-20 tokens, and other assets — the largest exchange hack of 2020. KuCoin subsequently recovered approximately 84% of stolen funds through on-chain tracking, project-team token swaps, and law enforcement cooperation, with the remaining 16% covered by the exchange's insurance fund. The hack was attributed to North Korea's Lazarus Group by blockchain analytics firm Chainalysis; separately, in March 2024 the U.S. Department of Justice criminally charged KuCoin and two of its founders for operating an unlicensed money transmitting business and Bank Secrecy Act violations, resulting in a $297.4 million guilty plea settlement in January 2025.
Connected Entities
10 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Harvest Finance→mentioned with→Binance(70%)
- KuCoin→mentioned with→Uniswap(60%)
- Harvest Finance→mentioned with→Bitcoin(75%)
- Harvest Finance→mentioned with→Ethereum(65%)
- KuCoin→mentioned with→Bitcoin(70%)
- Harvest Finance→mentioned with→Uniswap(60%)
- KuCoin→mentioned with→Ethereum(60%)
- Binance→mentioned with→Tether(60%)
- Binance→mentioned with→Ethereum(65%)
- + 16 more
Connected Through
9 shared actors · 600 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- ♦Bitcointoken
- □Binanceorganization
- ⌂Uniswapprotocol
2 submissions awaiting moderator review.
Timeline(10 events)
25 September 2020
Hackers begin draining KuCoin hot wallets at approximately 19:05 UTC after obtaining hot wallet private keys. Approximately $281 million in BTC, ETH, ERC-20 tokens, LTC, BSV, XRP, XLM, TRX, and USDT is stolen.
CoinDesk26 September 2020
KuCoin CEO Johnny Lyu hosts a public livestream disclosing the breach, confirms hot wallet private key leakage, re-deploys hot wallets, and suspends deposits and withdrawals. Exchange pledges full user compensation via insurance fund.
KuCoin Official Announcement26 September 2020
Tether freezes stolen USDT tokens on-chain. Partner exchanges begin blacklisting hacker wallet addresses.
CoinDesk3 October 2020
KuCoin CEO Johnny Lyu announces that suspects have been identified with 'substantial proof' and that law enforcement has been formally engaged.
CoinDeskOctober 2020
Chainalysis publishes analysis documenting how hackers used DeFi protocols (Uniswap, KyberSwap) to launder stolen ERC-20 tokens, and later attributes the attack to North Korea's Lazarus Group based on money laundering behavioral fingerprints.
Chainalysis11 November 2020
KuCoin co-founder announces 84% of stolen assets have been recovered via on-chain tracking, contract upgrades, and judicial recovery. Remaining 16% to be covered by the exchange's insurance fund.
CoinTelegraph13 November 2020
Multiple token project teams publicly object to KuCoin's token swap strategy, stating the burden of remediation was improperly shifted to decentralized communities.
CoinDesk22 November 2020
KuCoin resumes deposit and withdrawal services for all supported tokens, approximately eight weeks after the hack.
CoinDesk26 March 2024
The U.S. Attorney's Office for the Southern District of New York unseals a criminal indictment against KuCoin and co-founders Chun Gan and Ke Tang for operating an unlicensed money transmitting business and Bank Secrecy Act violations. This is a separate matter from the 2020 hack.
DOJ SDNY28 January 2025
KuCoin's operating entity PEKEN GLOBAL LIMITED pleads guilty to unlicensed money transmission and agrees to pay $297.4 million in penalties. KuCoin commits to exiting the U.S. market for at least two years. Co-founders Chun Gan and Ke Tang forfeit $2.7 million each and depart the company.
CoinDeskDecision Log
- slot 426274145 · hash 6tpkmaGsSQ56J6VtAgFXHM8pd3y5jLDFxqJfbbfgQh6V
- slot 426274142 · hash 4qWyHZ4tw9aPP6QpxEspAw8Qy3BNEHmvDXHN6aUrbpsh
- slot 423324588 · hash 4wQzoRFyuwEpvg1Kuh9nSwVS93QVD4588tordfS9fjsy
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 17 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/31/2026, 6:59:40 AM
last updated: 5/31/2026, 6:59:40 AM
7 viewsavoid.net — verified advice for a post-truth world