Rating report
KuCoin
Grade C+, 3.0 out of 5
KuCoin holds an Austrian FMA MiCAR licence passportable across 29 EEA countries but pleaded guilty in the U.S. in March 2024, paying $297m and accepting a ban since made permanent; its proof-of-reserves position is contested between our sources, and it lost roughly $280m in its September 2020 hack, with users made whole.
By Safety Desk. Facts checked against official sources on .
Findings, check by check
Every KripZen grade comes from the same five weighted checks. Here is how KuCoin scores on each.
Proof of reserves 30%
Our two sources conflict: one records Hacken-audited proof of reserves running 32 consecutive months to October 2025 with coverage above 100%, the other found no proof-of-reserves programme at all. Neither could be confirmed against a primary KuCoin disclosure.
What “Proof of reserves” meansPartial or unaudited
Custody 25%
Cold/hot storage split is not disclosed; we could not confirm it from a primary source.
What “Custody” meansPartial or unaudited
Regulation 20%
Austrian FMA MiCAR CASP licence passportable across 29 EEA countries; operating entity Peken Global Ltd. pleaded guilty in March 2024 to unlicensed money transmission, paying $297m and accepting a two-year U.S. ban since made permanent by a March 2026 CFTC consent order. Related entities settled with the New York Attorney General for $22m in December 2023 and were permanently banned by the Ontario Securities Commission in June 2022.
What “Regulation” meansPartial or unaudited
Insurance 15%
An insurance fund covered the 16% of 2020 hack losses that was not recovered, but its standing balance is not disclosed.
Partial or unaudited
Incident history 10%
About $280–281m stolen in September 2020; 84% was recovered through on-chain tracing, token reissuance and exchange cooperation, and the remainder covered by the insurance fund, leaving users whole.
Partial or unaudited
The weights are the same for every exchange. Read the full methodology
Fees, products and reach
- Spot fees (base tier)
- 0.1% maker, 0.1% takerFee levels are based on pairs with 0.1% maker/0.1% taker (not all pairs); Level 0 rate not shown in static page
- Proof of reserves
- PublishedLatest report seen: 2026-09-30
- Products
- Spot, Futures, P2P, Card purchases
- Founded
- 2017
- Not offered under its own terms in
- United States, Puerto Rico, Guam, Northern Mariana Islands, American Samoa, Singapore, China, Hong Kong, Malaysia, Kazakhstan, Uzbekistan, France, Netherlands
Base-tier fees from the exchange’s own fee page. Your real cost depends on order type, volume tier and spread; try your numbers in the Exchange Fee Calculator
Our KuCoin review
KuCoin carries a European licence that lets it passport across most of the continent, and a permanent ban from the United States. A C+ is what a rubric returns when the same company is welcome in one jurisdiction and shut out of another.
What checks out
The Austrian FMA has granted a MiCAR CASP licence that is passportable across 29 EEA countries — a live authorisation on a public register, not a claim on a marketing page. The 2020 hack, for all its size, was handled well: about $280–281m was taken in September 2020, 84% was recovered through on-chain tracing, token reissuance and cooperation from other exchanges, and the insurance fund covered the remaining 16%, so users were made whole.
Where the evidence stops
Our two sources disagree about proof of reserves. One records Hacken-audited reports running 32 consecutive months to October 2025 with coverage above 100%; the other found no programme at all. We could not settle it against a primary KuCoin disclosure, so we score it as unconfirmed rather than pick the flattering version. The cold/hot storage split is undisclosed, and the insurance fund that paid out in 2020 has no published standing balance today. The U.S. record is the heaviest item: operating entity Peken Global Ltd. pleaded guilty in March 2024 to unlicensed money transmission, paid $297m and accepted a two-year U.S. ban that a March 2026 CFTC consent order has since made permanent. Related entities settled with the New York Attorney General for $22m in December 2023 and were permanently banned by the Ontario Securities Commission in June 2022.
How to read the grade
KuCoin's protections have been tested and worked once. What is missing is current, checkable evidence that they are still there — and a licence in Europe does not undo a permanent exclusion elsewhere.
Incidents on record
2020
KuCoin
Hack, September 2020. ~$281M drained from hot wallets (publicly reported estimate)
On 25 September 2020 attackers drained roughly $281 million from KuCoin's hot wallets. About 84% was recovered over the following weeks through on-chain tracing, token issuers freezing and reissuing supply, and blacklisting by other exchanges. KuCoin's insurance fund covered the remainder, and users were made whole.
The lesson: That recovery depended on other people's goodwill — issuers willing to freeze tokens and venues willing to blacklist addresses. Treat it as a favour the industry granted, not a protection you can count on.
Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.
Sources
Every fact on this page comes from one of these official pages, checked on October 20, 2026.
Where to go next
Other exchanges we've graded
How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review. Cryptocurrency investments carry risk, including loss of principal. Nothing on KripZen is financial advice — always do your own research before buying, trading or moving funds.