How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review.
KuCoin
KuCoin holds an Austrian FMA MiCAR licence passportable across 29 EEA countries but pleaded guilty in the U.S. in March 2024, paying $297m and accepting a ban since made permanent; its proof-of-reserves position is contested between our sources, and it lost roughly $280m in its September 2020 hack, with users made whole.
BySafety DeskSenior Exchange Safety Editor
Our KuCoin review
KuCoin carries a European licence that lets it passport across most of the continent, and a permanent ban from the United States. A C+ is what a rubric returns when the same company is welcome in one jurisdiction and shut out of another.
What checks out
The Austrian FMA has granted a MiCAR CASP licence that is passportable across 29 EEA countries — a live authorisation on a public register, not a claim on a marketing page. The 2020 hack, for all its size, was handled well: about $280–281m was taken in September 2020, 84% was recovered through on-chain tracing, token reissuance and cooperation from other exchanges, and the insurance fund covered the remaining 16%, so users were made whole.
Where the evidence stops
Our two sources disagree about proof of reserves. One records Hacken-audited reports running 32 consecutive months to October 2025 with coverage above 100%; the other found no programme at all. We could not settle it against a primary KuCoin disclosure, so we score it as unconfirmed rather than pick the flattering version. The cold/hot storage split is undisclosed, and the insurance fund that paid out in 2020 has no published standing balance today. The U.S. record is the heaviest item: operating entity Peken Global Ltd. pleaded guilty in March 2024 to unlicensed money transmission, paid $297m and accepted a two-year U.S. ban that a March 2026 CFTC consent order has since made permanent. Related entities settled with the New York Attorney General for $22m in December 2023 and were permanently banned by the Ontario Securities Commission in June 2022.
How to read the grade
KuCoin's protections have been tested and worked once. What is missing is current, checkable evidence that they are still there — and a licence in Europe does not undo a permanent exclusion elsewhere.
Grade breakdown
Every KripZen grade comes from the same five weighted checks. Here is how KuCoin scores on each.
- Proof of reservesWeight 30%
Our two sources conflict: one records Hacken-audited proof of reserves running 32 consecutive months to October 2025 with coverage above 100%, the other found no proof-of-reserves programme at all. Neither could be confirmed against a primary KuCoin disclosure.
What this means → partial or unverified - CustodyWeight 25%
Cold/hot storage split is not disclosed; we could not confirm it from a primary source.
What this means → partial or unverified - RegulationWeight 20%
Austrian FMA MiCAR CASP licence passportable across 29 EEA countries; operating entity Peken Global Ltd. pleaded guilty in March 2024 to unlicensed money transmission, paying $297m and accepting a two-year U.S. ban since made permanent by a March 2026 CFTC consent order. Related entities settled with the New York Attorney General for $22m in December 2023 and were permanently banned by the Ontario Securities Commission in June 2022.
What this means → partial or unverified - InsuranceWeight 15%
An insurance fund covered the 16% of 2020 hack losses that was not recovered, but its standing balance is not disclosed.
partial or unverified - Incident historyWeight 10%
About $280–281m stolen in September 2020; 84% was recovered through on-chain tracing, token reissuance and exchange cooperation, and the remainder covered by the insurance fund, leaving users whole.
partial or unverified