Blockchain investigator ZachXBT has accused KuCoin of failing to prevent illicit crypto flows through its platform, claiming stolen funds worth over $13 million moved through exchange deposit addresses in recent weeks.
In a post on X on May 22, he said the exchange has not responded adequately to requests from German law enforcement and continues to process suspicious transactions linked to multiple theft cases.
Hi Kucoin does not assist victims or law enforcement I have reported about these issues in the past.
The team is complicit and allows illicit activity to flow as long as it generates fees.
Unfortunately there’s not much I can do to get them to respond to German LE besides… https://t.co/WEdbujUnKg pic.twitter.com/2qywnMqR4Q
— ZachXBT (@zachxbt) May 22, 2026
Stolen funds traced through exchange wallets
Investigations referenced by ZachXBT detail how a fake Ledger Live application listed on Apple’s Mac App Store was used in April to drain about $9.5 million from more than 50 victims.
The stolen funds, spread across Bitcoin, Ether, Tron, Solana, and XRP, were quickly moved through more than 150 KuCoin deposit addresses. From there, assets were reportedly routed into a centralized mixing service known as AudiA6.
A separate incident involving roughly $3.5 million stolen from Bitcoin Depot was also traced through over 25 KuCoin-linked addresses, bringing the combined total of suspicious flows to more than $13 million within weeks. Meanwhile, Bitcoin Depot recently filed for voluntary Chapter 11 bankruptcy protection in the United States.
Phishing attack method and exchange response
The incident involved a phishing operation targeting multi-chain crypto wallets through a fake Mac App Store application. Victims were tricked into entering their 24-word recovery phrases, allowing attackers to instantly drain funds using automated scripts. Three major victims accounted for more than $7.25 million of the total estimated $9.5 million in stolen funds.
Following the activity, KuCoin representatives reportedly placed temporary compliance holds on the flagged accounts. However, internal procedures meant the assets could be released automatically unless there was a formal request from international law enforcement agencies to maintain the freeze.
ZachXBT also pointed out that the laundering activity occurred shortly after KuCoin lost its European MiCA-related registration, which restricted its ability to onboard new users in parts of Europe and added further scrutiny to its compliance position.
Regulatory pressure on KuCoin intensifies
KuCoin is also facing growing regulatory pressure across multiple regions as investigations and enforcement actions expand.
In Europe, Austria’s financial regulator has previously barred KuCoin from onboarding new users within the European Union, tightening access for local traders. Meanwhile, Japan’s Financial Services Agency has listed the platform as an unregistered operator, raising additional concerns over compliance standards.
In the United States, the Department of Justice charged KuCoin in 2024 with operating an unlicensed money transmitting business, leading to a settlement agreement in January 2025 worth nearly $300 million. Separately, the Commodity Futures Trading Commission imposed a $500,000 civil penalty on the company’s parent entity for compliance breaches related to derivatives activity.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools
