Skip to content
Breach 2020
Founded
2017
Headquarters
Seychelles
Taker fee
0.1%
24h spot volume
$1.9B
  • Solvency evidence4.0
  • Security record8.5
  • Trading fees8.6
  • Liquidity6.9
Proof of reservesBreach 2020

On the record against KuCoin

3
  • Commodity Futures Trading CommissionDecided30 March 2026

    A federal court entered a CFTC consent order permanently barring KuCoin’s operator from letting US participants trade on its system unless it first registers as a foreign board of trade, with a $500,000 civil penalty.

    The CFTC had sued Peken Global and three related companies — Mek Global Ltd, PhoenixFin Pte Ltd and Flashdot Ltd — in March 2024, alleging an unregistered digital asset derivatives exchange, a failure to register as a futures commission merchant, and know-your-customer procedures the agency called a sham. The money here is small; the bar is not, and it is permanent unless the registration happens.

    CoinDesk — reported, not the source document · United States · The authority made this finding.

  • US Attorney’s Office for the Southern District of New YorkDecided27 January 2025

    Peken Global Ltd, the operator of KuCoin, pleaded guilty to operating an unlicensed money transmitting business, agreed to more than $297m in fine and forfeiture, and undertook to leave the United States for at least two years.

    The penalty is a $112.9m criminal fine and $184.5m of forfeiture. The company admitted failing to run the anti-money-laundering and know-your-customer programmes US law requires, and prosecutors said the exchange was used to move billions of dollars of suspicious transactions including proceeds of darknet markets, ransomware and fraud. Two of its founders, Chun Gan and Ke Tang, gave up any role in running it. Sources disagree about where Peken Global is incorporated — the Seychelles in some accounts, the Turks and Caicos in others — and we have not been able to settle it, so this page does not say.

    CoinDesk — reported, not the source document · United States · The authority made this finding.

  • Financial Services Agency of JapanDecided28 November 2024

    Japan issued a warning to KuCoin for conducting crypto-asset exchange business with Japanese residents over the internet without registration, and published its name on the list of unregistered operators.

    The FSA’s published list of persons conducting virtual currency exchange business without registration names the operator at the Seychelles, with Johnny Lyu as its representative, for having "conducted crypto-asset exchange business with residents of Japan as counterparties through the internet" in breach of article 63-2 of the Payment Services Act. Keep it in proportion: Japan registers no offshore exchange that will not accept its rules, so this is about market access rather than about customer money, and four of the eight exchanges ranked here are on the same list. It is still a regulator naming a company in public and leaving it there.

    Financial Services Agency of Japan — the authority’s own document · Japan · The authority made this finding.

None of this moves the score on this page. The weights are published on the methodology page and they read licences, costs, payments, platforms and disclosures — there is no component for what an authority has done, and adding a penalty nobody could see would be worse than the gap. It is written here instead, above everything good about this broker, which is where we think it belongs.

Score breakdown

Method
  • Solvency evidence25%
    4.0

    proof of reserves

  • Security record20%
    8.5

    Last breach 2020 · users made whole

  • Trading fees14%
    8.6

    0.1% taker · 0.1% maker

  • Liquidity10%
    6.9

    $1.9B reported 24h spot volume

  • Regulatory and legal record15%
    0.0

    3 on record: restriction, prosecution, warning

  • Transparency8%
    6.7

    2 of 3 disclosures published

  • Evidence behind this record8%
    7.0

    Read against an outside document, not at the company’s own pages

Fees and liquidity

Taker fee
0.1%
Maker fee
0.1%
Reported 24h spot volume
$1.9B
Type
Centralised
Founded
2017
Headquarters
SC

Solvency and security

Proof of reserves
Published
Third-party audit
No
Publicly listed
No
Last customer-funds breach
2020
Users made whole
Yes
Insurance fund
Yes

An exchange is a counterparty, not a wallet.

KuCoin’s own site — their claims, not ourskucoin.com

What we checked on KuCoin

17 Sept 2026

A guilty plea, $297m, a two-year exit from the United States, a permanent CFTC bar and a Japanese warning — the worst regulatory record on this page by a distance, alongside a 2020 breach it did recover from fully.

Three authorities, one direction

Peken Global Ltd, which operates KuCoin, pleaded guilty in January 2025 to operating an unlicensed money transmitting business: a $112.9m criminal fine and $184.5m of forfeiture, and an undertaking to leave the United States for at least two years 3. The company admitted failing to run the anti-money-laundering and know-your-customer programmes US law requires, and prosecutors said the exchange moved billions of dollars of suspicious transactions including proceeds of darknet markets, ransomware and fraud. Two founders, Chun Gan and Ke Tang, gave up any role in running it.

In March 2026 a federal court entered a CFTC consent order permanently barring the operator from letting US participants trade on its system unless it first registers as a foreign board of trade, with a $500,000 penalty 4. The money is small and the bar is not. The CFTC had sued in March 2024 over an unregistered derivatives exchange and what it called sham know-your-customer procedures.

And Japan’s FSA named KuCoin, of the Seychelles, on its list of firms doing crypto-asset exchange business with Japanese residents without registration, warned 28 November 2024 1.

The breach it did handle well

None of the above is about customer money. On 26 September 2020 attackers took roughly $281m of assets out of KuCoin’s hot wallets, one of the largest exchange thefts of that year 2.

What happened next is the reason this record is not worse. By 11 November the exchange reported that about 84% had been recovered — through on-chain tracing, cooperation with other exchanges and the projects whose tokens were taken, contract upgrades and law enforcement — and that the remaining 16%, around $45m, was covered by its own insurance fund 2. No user carried a permanent loss.

That is worth saying clearly on a page that is otherwise a list of enforcement. This site scores a breach recovered from differently from a breach that was not, and KuCoin’s security record benefits from it. Where the company has done badly is with regulators, repeatedly, in three jurisdictions; where it has done well is in returning money somebody else stole. A reader is entitled to both halves, and the two are not in tension — reimbursing a hack is a thing a well-capitalised company can do while still running the compliance programme a court says it did not run.

The figures, and where each one came from

Entity that pleaded guilty3
Peken Global Ltd
Penalty3
$112.9m fine plus $184.5m forfeiture
US exit3
At least two years
Founders removed from management3
Chun Gan and Ke Tang
CFTC consent order4
30 March 2026, $500,000 and a permanent bar unless registered
Japan FSA warning1
28 November 2024
2020 breach2
About $281m taken on 26 September 2020
Recovered or covered2
84% recovered, the rest from its insurance fund

Still open

  • Sources disagree about where Peken Global is incorporated — the Seychelles in some accounts, the Turks and Caicos in others. Japan’s list says the Seychelles. We have not found a company register that settles it.
  • The DOJ page is unreadable from here, so the plea rests on reporting; the Japanese warning and the FSA list are read directly.

Sources

4
  1. 1
    Names of persons conducting virtual currency exchange business without registration

    Financial Services Agency of JapanRegulator noticeread 17 Sept 2026

  2. 2
    KuCoin on track to reopen all operations after recovering 84% of the $280 million hack

    FXStreetTrade presspublished 11 Nov 2020read 17 Sept 2026

  3. 3
    KuCoin hit with nearly $300m fine after pleading guilty to US DOJ charges

    CoinDeskTrade presspublished 28 Jan 2025read 17 Sept 2026

  4. 4
    KuCoin permanently barred from the US after CFTC order following $297m DOJ case

    CoinDeskTrade presspublished 31 Mar 2026read 17 Sept 2026

Every link goes to the document, not to a summary of it, and where it does not we say so on the entry. They carry nofollow like every other outbound link here, and none of them is an affiliate link — a source you are paid to cite is not a source. Where we have any connection to a publisher, it is printed above rather than left for you to find out.

What customers say

0 published

Nobody has written about this one yet. Reviews here are read, not counted: this ranking’s model was published without a reviews component.

Write about KuCoin

Something an editor could check, privately ›

It appears straight away, marked unverified. Reviews are not part of this ranking’s score at all yet: that model was published without a reviews component. No account, no email, no address.

Other exchanges

Full ranking

KuCoin — common questions

Is KuCoin safe?

KuCoin was breached in 2020 and users were made whole. On solvency evidence it publishes a proof of reserves.

What does KuCoin charge?

0.1% taker and 0.1% maker at the lowest tier. Fee tiers fall with volume, so most readers pay the figures quoted here.

Does KuCoin publish a proof of reserves?

Yes. Remember what that is: a snapshot the exchange chooses to publish, unaudited, saying nothing about liabilities. It is real evidence, but weaker than an audit.