A fake KuCoin login page captured your credentials. The attacker accessed your account and withdrew your crypto. KuCoin settled with the US DOJ in 2023 ($5M fine), implemented mandatory KYC, and restricted the self-service unfreeze feature that scammers previously exploited. Post-DOJ compliance improvements mean KuCoin is more cooperative with legal requests than before — but still slower than Binance or Coinbase.
KuCoin phishing attacks follow the same pattern as other exchanges: fake emails mimicking KuCoin security alerts, fake login pages at kucoin-secure-login.com or kucoin-verify-account.net, and session hijacking to capture 2FA codes. The attacker logs into the real KuCoin simultaneously and initiates withdrawals.
The pre-2023 KYC problem: Before August 2023, KuCoin did not require KYC for all accounts. This meant scammers could create anonymous KuCoin accounts to receive phishing proceeds. Since August 2023, KuCoin requires mandatory KYC — all new accounts are tied to verified identities. However, pre-August 2023 accounts that completed KYC during the 2023 compliance push may have lower-quality verification documents. We work with whatever KYC is available.
The self-service unfreeze history: KuCoin previously had a self-service unfreeze feature that allowed users (and scammers) to unfreeze their own accounts without compliance review. Scammers exploited this to bypass freezes placed by law enforcement. Post-DOJ settlement (December 2023), this feature has been restricted — freezes placed by the compliance team now require compliance approval to lift. This is a significant improvement for phishing victims.
The 3-tier risk classification: KuCoin classifies accounts as Low, Medium, or High risk. High-risk accounts face withdrawal limits, trading restrictions, and enhanced monitoring. If the attacker's account is classified High risk (which is likely if it received flagged phishing proceeds), it may already have restrictions — buying us time. The risk classification criteria are not public, but flagged transactions typically trigger an upgrade to High risk.
Post-DOJ compliance improvements: After settling with the US DOJ in December 2023 ($5M fine for AML violations), KuCoin improved its compliance program: mandatory KYC for all accounts, restricted self-service unfreeze, 3-tier risk classification, and expanded cooperation with law enforcement. These changes make KuCoin more responsive to legal requests than before the settlement.
Compliance structure: KuCoin's compliance team processes legal requests through email. No compliance portal, no published timelines. Response times: 7-14 business days for freeze requests. Slower than Binance (3-7 days) and Coinbase (1-5 days), but improved since the DOJ settlement.
Freeze capability: KuCoin can freeze accounts receiving stolen funds. Requires a police report or court order. Post-DOJ settlement, KuCoin is more cooperative with law enforcement — particularly with US law enforcement, given the DOJ oversight. The self-service unfreeze feature (which scammers previously exploited) is now restricted.
KYC disclosure: KuCoin KYC includes government ID and selfie (mandatory since August 2023). Pre-August 2023 accounts may have partial or no KYC — we work with what's available. Disclosure follows Seychelles legal procedures or MLAT for international requests. Post-DOJ, KuCoin has been more forthcoming with KYC disclosures to law enforcement.
A client received a phishing email that looked like a KuCoin security alert: "KuCoin: Unusual Login Activity Detected. Verify your account to prevent suspension." The email linked to kucoin-secure-verify.net. The client entered their email, password, and 2FA code on the fake page. The attacker logged into the real KuCoin and withdrew €55,000 in USDT to an external wallet, which then sent funds to a KuCoin deposit address (the attacker's personal account).
Post-DOJ cooperation: We filed a legal request with KuCoin's compliance team. Post-DOJ settlement, KuCoin cooperated — the attacker's account was frozen within 10 business days (faster than pre-DOJ cases, which often took 14-21 days). The account held €38,000 in USDT. The attacker's KYC (submitted during the 2023 compliance push) revealed a resident of Turkey.
Outcome: 69% recovery (€38,000 of €55,000). The €17,000 gap was due to the attacker withdrawing to a second wallet before the freeze. The self-service unfreeze feature (which would have allowed the attacker to bypass the freeze pre-DOJ) was restricted — the freeze held. Criminal proceedings initiated through Turkish authorities.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
Was your own KuCoin account also frozen? Our KuCoin account unlock practice can resolve this while we trace the stolen funds.
Warning: After a phishing attack, fake "recovery services" will contact you. Read our recovery scam warning before engaging anyone.
Yes. Post-DOJ settlement (December 2023, $5M fine), KuCoin improved compliance: mandatory KYC for all accounts, restricted the self-service unfreeze feature (which scammers previously exploited to bypass freezes), and expanded law enforcement cooperation. In our experience, freeze response times improved from 14-21 days (pre-DOJ) to 7-14 days (post-DOJ). The self-service unfreeze restriction is particularly important — freezes now hold.
Previously yes — KuCoin had a self-service unfreeze feature that allowed users (and scammers) to bypass freezes without compliance review. Scammers exploited this to unfreeze accounts that law enforcement had frozen. Post-DOJ settlement (December 2023), this feature has been restricted. Freezes placed by the compliance team now require compliance approval to lift — scammers can no longer self-unfreeze.
7-14 business days post-DOJ settlement (improved from 14-21 days pre-DOJ). KuCoin does not publish compliance timelines. Slower than Binance (3-7 days) and Coinbase (1-5 days), but improved since the DOJ settlement. For KuCoin cases, speed of tracing and filing is critical — the earlier we file, the less time the attacker has to withdraw.
KuCoin pushed all existing accounts through KYC verification during 2023. Even pre-August 2023 accounts now have KYC on file. If the attacker completed the verification, their identity is available through legal process. If they refused KYC, their account would have been restricted — meaning funds may still be frozen on the platform. Either way, the funds are either frozen or the identity is obtainable.
KuCoin classifies accounts as Low, Medium, or High risk. High-risk accounts face withdrawal limits, trading restrictions, and enhanced monitoring. If the attacker's account received flagged phishing proceeds, it may have been upgraded to High risk — which means withdrawal limits were already in place. This buys us time. The classification criteria are not public, but flagged transactions typically trigger an upgrade.
KuCoin is slower (7-14 days vs Binance's 3-7 days), less transparent (no published timelines), and historically less cooperative. However, post-DOJ settlement, KuCoin has improved significantly: mandatory KYC, restricted self-service unfreeze, and better law enforcement cooperation. The self-service unfreeze restriction is the most important change — freezes now hold, which they didn't before. KuCoin cases have lower recovery rates (55-75%) than Binance (70-90%) but are improving.
Describe what happened. Include the phishing URL, withdrawal addresses, transaction hashes, and amount stolen. We respond within 6 hours.