← KuCoinreviewed 2026-09-07 · 37 claims checked
Fact-check findings
What an automated fact-checker found when it re-read KuCoin against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #25[disputed][awaiting moderator]in section: KYC and AML Program Failures
“When a KYC program was finally implemented in August 2023, it was not retroactively applied to existing customers.”
reviewerKuCoin finally implemented a KYC program in August 2023, and it was not retroactively applied to existing customers.The page's own cited source (Orrick) and independent reporting both say the KYC program was implemented in July 2023, not August. This also creates an internal inconsistency with the page's own timeline, which correctly lists the KYC rollout as 2023-07.Proposed correction (not yet applied)When a KYC program was finally implemented in July 2023, it was not retroactively applied to existing customers. - #33[disputed][awaiting moderator]in the timeline
“2021-06”
reviewerChainalysis publicly attributed the September 2020 KuCoin hack to Lazarus Group in June 2021.The timeline date is off by roughly four months; the Chainalysis attribution was published February 9, 2021, the same month as the CEO's recovery update in the preceding timeline entry, not June 2021.Proposed correction (not yet applied)2021-02
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #29[unverifiable][awaiting moderator]in section: KYC and AML Program Failures
“KuCoin employees reportedly openly promoted the platform's lack of KYC requirements as a feature to attract customers.”
reviewerKuCoin employees reportedly openly promoted the platform's lack of KYC requirements as a feature to attract customers.This more specific characterization (employees actively marketing the absence of KYC) could not be independently confirmed in the sources checked, though it is broadly consistent with the well-documented no-KYC policy itself.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #19[partially supported][awaiting moderator]in section: CFTC Civil Enforcement Action
“The matter was ultimately resolved with a $500,000 civil monetary penalty levied against Peken Global Limited and a permanent injunction barring the exchange from serving US traders.”
reviewerThe CFTC matter was ultimately resolved with a $500,000 civil monetary penalty against Peken Global and a permanent injunction barring the exchange from serving US traders.The penalty amount and outcome are accurate, but the section presents the resolution as a single undated coda to the 2024 filing without disclosing it did not occur until March 2026; the CFTC's final order is also missing from the page's timeline. - #32[partially supported][awaiting moderator]in the timeline
“KuCoin CEO Johnny Lyu reports recovery of approximately 84% of stolen hack funds through exchange partners, law enforcement, and insurance.”
reviewerIn February 2021, Johnny Lyu reported recovery of approximately 84% of stolen hack funds through exchange partners, law enforcement, and insurance.This timeline entry conflates insurance into the 84% recovery figure, when the cited reporting (and the page's own sections[1] text) makes clear insurance covered the additional 16% on top of the 84% actively recovered.
confirmed
32 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“KuCoin is a global cryptocurrency exchange founded in 2017 that has accumulated one of the most serious regulatory and security records in the industry.”
reviewerKuCoin is a global cryptocurrency exchange founded in 2017.Founding year and general regulatory/security record are well documented across multiple independent sources. - #2[confirmed][no action needed]in the summary
“The exchange suffered a $285 million hot-wallet hack in September 2020 attributed to North Korea's Lazarus Group, and in January 2025 pleaded guilty to operating an unlicensed money transmitting business in the United States, agreeing to pay over $297 million in fines and forfeitures and exit the US market for at least two years.”
reviewerKuCoin suffered a $285 million hot-wallet hack in September 2020 attributed to Lazarus Group.Both figures independently corroborated by DOJ and Chainalysis primary sources. - #3[confirmed][no action needed]in the summary
“On-chain investigator ZachXBT has publicly alleged that KuCoin continues to enable illicit fund flows by ignoring victim and law enforcement requests.”
reviewerZachXBT has publicly alleged KuCoin continues to enable illicit fund flows by ignoring victim and law enforcement requests.Accurately characterized as an allegation from a named third party, not an adjudicated fact. - #4[confirmed][no action needed]in section: Background and Corporate Structure
“KuCoin was founded in September 2017 by Chun Gan (known as 'Michael'), Ke Tang (known as 'Eric'), and Johnny Lyu.”
reviewerKuCoin was founded in September 2017 by Chun Gan ('Michael'), Ke Tang ('Eric'), and Johnny Lyu.Founder identities and aliases confirmed by Wikipedia and DOJ filings. - #5[confirmed][no action needed]in section: Background and Corporate Structure
“The exchange raised approximately 5,500 BTC through an initial coin offering at launch.”
reviewerKuCoin raised approximately 5,500 BTC through an ICO at launch.Figure matches independently. - #6[confirmed][no action needed]in section: Background and Corporate Structure
“By September 2025, Peken Global Limited had re-domiciled to the Turks and Caicos Islands.”
reviewerKuCoin relocated to Singapore in 2018 and shifted its operating entity Peken Global Limited to the Seychelles; by September 2025 it had re-domiciled to Turks and Caicos.Corroborated by both the Seychelles and Turks and Caicos financial regulators' public statements; the CFTC's March 2026 order also refers to Peken Global as Turks and Caicos-incorporated. - #7[confirmed][no action needed]in section: Background and Corporate Structure
“The exchange grew to serve approximately 1.5 million registered US users and tens of millions globally before its US market exit.”
reviewerKuCoin grew to serve approximately 1.5 million registered US users before its US market exit.US user figure matches independent secondary reporting on the DOJ/CFTC allegations. - #8[confirmed][no action needed]in section: Background and Corporate Structure
“In November 2018, KuCoin raised $20 million in a Series A funding round led by IDG Capital, Matrix Partners, and Neo Global Capital.”
reviewerIn November 2018, KuCoin raised $20 million in a Series A round led by IDG Capital, Matrix Partners, and Neo Global Capital.Confirmed. - #9[confirmed][no action needed]in section: September 2020 Hot Wallet Hack ($285 Million)
“By the time KuCoin's operations team began transferring remaining assets to cold storage, attackers had already executed over 500 ETH and ERC-20 transactions across more than 150 different cryptocurrencies.”
reviewerOn September 26, 2020, KuCoin's hot wallets were breached; detection occurred around 2:51 AM UTC+8; over 500 ETH/ERC-20 transactions across 150+ cryptocurrencies were drained.Detection time and token count match independent research. - #10[confirmed][no action needed]in section: September 2020 Hot Wallet Hack ($285 Million)
“The total value of stolen assets was estimated at approximately $281 to $285 million, making it the largest cryptocurrency exchange hack of 2020 and the third-largest of all time at that point.”
reviewerTotal stolen was approximately $281-285 million, the largest exchange hack of 2020 and third-largest of all time at that point.Both the dollar range and the historical ranking are corroborated. - #11[confirmed][no action needed]in section: September 2020 Hot Wallet Hack ($285 Million)
“The hack was later attributed to Lazarus Group, a North Korean state-sponsored hacking collective, by blockchain analytics firm Chainalysis.”
reviewerChainalysis attributed the hack to Lazarus Group based on mixer payment patterns and shared deposit addresses; attackers used Uniswap to obscure funds.Confirmed directly against the Chainalysis primary source. - #12[confirmed][no action needed]in section: September 2020 Hot Wallet Hack ($285 Million)
“KuCoin CEO Johnny Lyu reported in February 2021 that approximately 78% of stolen funds ($222 million) were recovered through cooperation with exchange partners, 6% ($17.45 million) through law enforcement coordination, and the remaining 16% ($45.55 million) was covered by an insurance fund.”
reviewerJohnny Lyu reported in February 2021 that 78% ($222M) was recovered via exchange partners, 6% ($17.45M) via law enforcement, and 16% ($45.55M) was covered by insurance.Figures match verbatim across two independent sources. - #13[confirmed][no action needed]in section: US Department of Justice Criminal Charges and Guilty Plea
“On March 26, 2024, the United States Attorney's Office for the Southern District of New York (SDNY) unsealed a criminal indictment against KuCoin and two of its co-founders, Chun Gan and Ke Tang, both Chinese nationals.”
reviewerOn March 26, 2024, SDNY unsealed a criminal indictment against KuCoin, Chun Gan, and Ke Tang for BSA/unlicensed money transmitting charges.Confirmed. - #14[confirmed][no action needed]in section: US Department of Justice Criminal Charges and Guilty Plea
“The DOJ alleged that since its founding in 2017, KuCoin received over $5 billion and sent over $4 billion in suspicious and criminal proceeds — totaling approximately $9 billion in alleged illicit flows — including proceeds from darknet markets, malware, ransomware, and fraud schemes.”
reviewerDOJ alleged KuCoin received over $5 billion and sent over $4 billion in suspicious/criminal proceeds, including nearly $3.2 million from Tornado Cash.Figures corroborated by multiple independent outlets covering the same indictment. - #15[confirmed][no action needed]in section: US Department of Justice Criminal Charges and Guilty Plea
“KuCoin also allegedly received nearly $3.2 million from Tornado Cash, a protocol on OFAC's Specially Designated Nationals list.”
reviewerKuCoin allegedly received nearly $3.2 million from Tornado Cash, an OFAC-sanctioned mixer.Confirmed. - #16[confirmed][no action needed]in section: US Department of Justice Criminal Charges and Guilty Plea
“The plea agreement required payment of $112.9 million in criminal fines and $184.5 million in forfeiture — totaling more than $297 million — and mandated that KuCoin exit the US market for a minimum of two years.”
reviewerOn January 27, 2025, KuCoin pleaded guilty to one count of operating an unlicensed money-transmitting business, agreeing to pay $112.9M in fines and $184.5M in forfeiture (>$297M total) and exit the US market for a minimum of two years.Fully confirmed against the DOJ's own announcement. - #17[confirmed][no action needed]in section: US Department of Justice Criminal Charges and Guilty Plea
“Co-founders Chun Gan and Ke Tang each entered two-year deferred prosecution agreements, forfeited $2.7 million, and agreed to cede all management and operational roles at KuCoin.”
reviewerCo-founders Chun Gan and Ke Tang each entered two-year deferred prosecution agreements, forfeited $2.7 million, and ceded management/operational roles.Confirmed by an independent legal-industry summary matching DOJ terms exactly. - #18[confirmed][no action needed]in section: CFTC Civil Enforcement Action
“In parallel with the DOJ criminal charges, on March 26, 2024, the US Commodity Futures Trading Commission (CFTC) filed a civil enforcement action in the Southern District of New York against KuCoin's operating entities — Mek Global Limited, PhoenixFin PTE Ltd., Flashdot Limited, and Peken Global Limited.”
reviewerThe CFTC filed a parallel civil action on March 26, 2024 against Mek Global, PhoenixFin, Flashdot, and Peken Global covering July 2019-June 2023.Confirmed against CFTC's own press release. - #20[confirmed][no action needed]in section: Canadian FINTRAC Penalty
“In September 2025, Canada's Financial Transactions and Reports Analysis Centre (FINTRAC) issued a C$19.6 million (approximately USD $14 million) administrative penalty against KuCoin's parent company, Peken Global Limited. The penalty was described as the largest AML fine in Canadian history at the time of issuance.”
reviewerIn September 2025, FINTRAC issued a C$19.6 million (~USD $14 million) penalty against Peken Global Limited, described as the largest AML fine in Canadian history at the time.Amount and 'largest ever' framing corroborated by the regulator and multiple news outlets, though sources describe it specifically as FINTRAC's largest AMP rather than citing a comparison across all Canadian AML enforcement bodies. - #21[confirmed][no action needed]in section: Canadian FINTRAC Penalty
“KuCoin announced it would appeal the penalty before the Federal Court of Canada, characterizing the fine as 'excessive and punitive.'”
reviewerFINTRAC cited failure to register, failure to report ~3,000 large transactions (2021-2024), and failure to file 33 STRs; KuCoin is appealing to the Federal Court of Canada, calling the fine 'excessive and punitive.'Quote and appeal venue confirmed by an independent outlet. - #22[confirmed][no action needed]in section: ZachXBT Allegations: Ongoing Illicit Fund Flows (2026)
“In April 2026, ZachXBT alleged that KuCoin had facilitated the laundering of over $13 million in recently stolen cryptocurrency across two separate incidents.”
reviewerIn April 2026, ZachXBT alleged KuCoin facilitated laundering of over $13 million across two incidents: a fake Ledger Live app theft ($9.5M, 50+ victims, 150+ addresses, AudiA6 mixer) and the Bitcoin Depot theft ($3.5M/~50 BTC, 25+ addresses).All sub-figures independently verified against the cited article. - #23[confirmed][no action needed]in section: ZachXBT Allegations: Ongoing Illicit Fund Flows (2026)
“ZachXBT further alleged in May 2026 that KuCoin 'does not assist victims or law enforcement' and that the exchange allows illicit activity to continue 'as long as it generates fees.'”
reviewerZachXBT alleged in May 2026 that KuCoin 'does not assist victims or law enforcement' and allows illicit activity 'as long as it generates fees'; victims reported KuCoin requested sealed police documents then went silent.Quotes and victim anecdote confirmed word-for-word against the cited article. - #24[confirmed][no action needed]in section: KYC and AML Program Failures
“Until at least July 2023 — approximately six years after launch — KuCoin did not require customers to provide any identifying information to open accounts and trade.”
reviewerUntil at least July 2023, KuCoin did not require customers to provide any identifying information; KYC was not retroactively applied to existing customers.Confirmed. - #26[confirmed][no action needed]in section: KYC and AML Program Failures
“The DOJ further alleged that KuCoin never registered with the US Financial Crimes Enforcement Network (FinCEN) as a money services business, despite knowingly serving a significant US customer base that generated at least $184.5 million in fees.”
reviewerKuCoin never registered with FinCEN despite a US customer base that generated at least $184.5 million in fees.The $184.5M figure is internally consistent with the DOJ forfeiture amount, which independent reporting confirms was calculated as disgorgement of US-derived fee revenue. - #27[confirmed][no action needed]in section: KYC and AML Program Failures
“The CFTC complaint characterized KuCoin's public statements that US customers could not access the platform as a 'sham,' noting that the exchange imposed no actual IP-level restrictions and allowed VPN access without restriction.”
reviewerThe CFTC complaint characterized KuCoin's claim that US customers could not access the platform as a 'sham,' since it imposed no IP-level restrictions and allowed VPN access.Consistent with CFTC's own press release describing the same allegation, though the exact word 'sham' could not be independently confirmed as a direct quotation from the complaint via the sources fetched. - #28[confirmed][no action needed]in section: Illicit Transaction Flows: Darknet, Ransomware, and Sanctions
“The 2020 Lazarus Group hack itself introduced a significant money laundering dimension, as North Korean state actors used KuCoin deposit addresses as part of a broader laundering infrastructure involving mixers and decentralized finance protocols.”
reviewerThe 2020 Lazarus Group hack introduced a money-laundering dimension, using KuCoin deposit addresses alongside mixers and DeFi protocols.Confirmed against the Chainalysis primary source. - #30[confirmed][no action needed]in the timeline
“KuCoin exchange launched by founders Chun Gan, Ke Tang, and Johnny Lyu following a 5,500 BTC ICO raise.”
reviewerKuCoin exchange launched September 2017 following a 5,500 BTC ICO raise.Confirmed, consistent with sections[0]. - #31[confirmed][no action needed]in the timeline
“KuCoin hot wallets compromised; private keys stolen. Approximately $281-$285 million in cryptocurrency drained across 150+ tokens.”
reviewerKuCoin's hot wallets were compromised on 2020-09-26; $281-285M in crypto drained across 150+ tokens.Confirmed, consistent with sections[1]. - #34[confirmed][no action needed]in the timeline
“KuCoin implements KYC program for the first time, approximately six years after launch. Program not applied to existing customers.”
reviewerKuCoin implemented a KYC program for the first time in July 2023, approximately six years after launch, not applied to existing customers.This timeline entry is itself accurate; it is sections[6]'s 'August 2023' reference that is wrong and should be aligned to match this entry. - #35[confirmed][no action needed]in the timeline
“KuCoin pleads guilty in Manhattan federal court to operating an unlicensed money-transmitting business. Agrees to pay $297.4 million and exit US market for minimum two years. Founders Gan and Tang enter deferred prosecution agreements and resign.”
reviewerOn 2025-01-27, KuCoin pled guilty, agreed to pay $297.4 million, exit the US market for a minimum of two years, and founders entered DPAs and resigned.Confirmed, consistent with sections[2]. - #36[confirmed][no action needed]in the timeline
“Canadian FINTRAC issues record C$19.6 million (USD ~$14 million) penalty against Peken Global Limited for AML violations including failure to register, ~3,000 unreported large transactions, and 33 unfiled suspicious transaction reports.”
reviewerOn 2025-09-25, FINTRAC issued a record C$19.6 million penalty against Peken Global for AML violations.Confirmed. - #37[confirmed][no action needed]in the timeline
“ZachXBT alleges KuCoin enabled laundering of over $13 million in recent thefts, including $9.5 million from a fake Ledger Live app routed through 150+ KuCoin deposit addresses and $3.5 million from the Bitcoin Depot theft.”
reviewerOn 2026-04-14, ZachXBT alleged KuCoin enabled laundering of over $13 million from a fake Ledger Live app ($9.5M via 150+ addresses) and the Bitcoin Depot theft ($3.5M).Confirmed, consistent with sections[5].
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.