KuCoin Threatens Theft Victim After $250K Stolen Through Exchange Accounts

Published by James Harris on June 30, 2026June 30, 2026

ZachXBT has published evidence that KuCoin’s customer care team sent a legal warning to a user who lost $250,000 in an Atomic Stealer theft, after the stolen funds were allegedly routed through five KuCoin deposit addresses using purchased mule KYC. The exchange’s apparent response to a scam victim was not to assist, but to threaten action over “false or unlawful statements.”

The timing matters. In May 2026, ZachXBT publicly called KuCoin “complicit” in illicit fund flows, alleging the exchange tolerates dirty money as long as it generates fees. Before that, he flagged over $9.5 million from a fake Ledger app laundered through more than 150 KuCoin deposit addresses in a single week, plus another $3.5 million from the Bitcoin Depot incident across at least 25 accounts. This follows a pattern that regulators already acted on: in January 2025, KuCoin pleaded guilty to Bank Secrecy Act violations and agreed to pay more than $297 million in penalties after prosecutors alleged the exchange had processed over $5 billion in suspicious funds while concealing that roughly 17% of its users were American. A separate CFTC consent order in March 2026 added a $500,000 civil penalty and a permanent ban on U.S. users unless KuCoin registers as a foreign board of trade.

The legal threat sent to a theft victim is a useful data point about institutional culture, not just compliance failure.

KuCoin’s European foothold is also shakier than its MiCA license in Austria suggests. Austria’s FMA banned KuCoin EU from onboarding new customers in February 2026 after it lost its key AML and sanctions compliance officers, and while that ban was lifted once the roles were refilled, the exchange still cannot begin full operations due to unmet governance and senior management requirements. Separately, a Seychelles court awarded a Swiss investor $2 million in a delisting dispute, ruling that KuCoin could not treat unwithdrawn tokens as abandoned. KuCoin has not paid. For other exchanges navigating MiCA compliance, KuCoin’s situation illustrates exactly what regulators mean when they say a license is a floor, not a ceiling.

KuCoin has agreed to exit the U.S. market for at least two years as part of its January 2025 plea agreement, which means its European licensing push is not optional for survival. Every additional public incident involving alleged victim intimidation or unresolved court judgments makes that regulatory relationship harder to manage, particularly with the FMA already having demonstrated it will act quickly when compliance infrastructure looks thin.