KuCoin

Yes. In September 2020, KuCoin suffered one of the largest crypto exchange hacks in history, with approximately $281 million in assets stolen after private keys to hot wallets were compromised. The attack was attributed to North Korea's Lazarus Group. KuCoin ultimately recovered around 84% of stolen funds through partner exchanges, project teams, and law enforcement cooperation. The remaining ~16% was covered by KuCoin's insurance fund. The exchange has since significantly upgraded its security infrastructure.

No. KuCoin explicitly does not serve US users. In January 2025, KuCoin pleaded guilty to operating an unlicensed money transmitting business in the US and agreed to pay approximately $300 million in fines and forfeitures to the Department of Justice. In December 2023, KuCoin separately settled with the New York Attorney General for $22 million and agreed to stop serving New York residents. US residents attempting to register will be declined.

Yes. KuCoin publishes periodic Proof of Reserves reports using a Merkle tree methodology, allowing users to independently verify that their assets are backed 1:1 by real on-chain holdings. As of February 2026, KuCoin's reserve ratios exceeded 100% for all major assets: BTC at 104%, ETH at 118%, USDT at 103%, and USDC at 118%. Third-party independent institutions also audit these reserves. Users can self-verify at kucoin.com/proof-of-reserves.

KuCoin offers multi-factor authentication (Google Authenticator and SMS 2FA), an anti-phishing code system, withdrawal whitelisting, 24-hour withdrawal holds after password resets, and a dedicated bug bounty program. The platform has achieved SOC 2 Type II and ISO 27001:2022 certifications. DDoS protection, Web Application Firewalls, and DNS security are also in place. Despite these measures, KuCoin's 2020 hack remains a key risk factor in its history.

KuCoin has limited formal regulation. It operates from the Seychelles and launched a Thai SEC-supervised exchange in April 2025. It holds no VASP license in the EU, UK, or UAE. The exchange has faced serious regulatory consequences: a $300M US DoJ settlement in January 2025, a $22M New York settlement in 2023, and an Austrian FMA business prohibition in February 2026 for AML and financial sanctions violations.