Your phone lost service, and your KuCoin account was emptied. A scammer SIM-swapped your number, intercepted SMS 2FA, and withdrew your crypto. KuCoin is Seychelles-headquartered but settled with the US DOJ in 2024 for AML violations — creating a cooperation obligation with US law enforcement. We leverage the DOJ settlement for faster response in KuCoin SIM swap cases, especially for US clients.
A SIM swap attack (also called SIM hijacking or port-out fraud) is when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your phone number, they intercept SMS-based 2FA codes and gain access to your KuCoin account — bypassing SMS verification, changing the password, and withdrawing your crypto. The attack often happens at night, and victims discover it when they wake up to a dead phone and an empty KuCoin account.
Why KuCoin is targeted for SIM swap attacks: KuCoin is a major altcoin exchange — users hold diverse token portfolios. KuCoin offers SMS 2FA (though Google Authenticator is recommended). KuCoin's vast altcoin listings create a unique SIM swap risk: the scammer can trade your funds into obscure micro-cap tokens before withdrawing, making tracing harder. However, the DOJ settlement (2024) means KuCoin must cooperate with US law enforcement — we leverage this.
The attack sequence: First, the scammer gathers your personal information through data breaches, social media, or phishing. Then they contact your mobile carrier (or bribe an insider) to port your number to their SIM. Once they have your number, they intercept the KuCoin SMS 2FA code, log into your account, change the password and 2FA settings, and withdraw your crypto to addresses they control. The entire attack takes 2-6 hours — usually while you sleep.
Regulatory structure: KuCoin's primary entity is in Seychelles, with a US subsidiary (post-DOJ settlement). Response times: 7-21 business days (Seychelles), 3-10 days (US subsidiary, if applicable). The DOJ settlement means KuCoin must cooperate with FBI and Secret Service requests — we leverage this for US clients.
Freeze capability: KuCoin can freeze the scammer's receiving account. Requires a police report or court order. Post-DOJ settlement, KuCoin is more cooperative with US law enforcement. For non-US jurisdictions, KuCoin Seychelles may be slow. Response: 7-21 business days (Seychelles), 3-10 days (US).
KYC disclosure: KuCoin discloses account holder information to law enforcement or through a court order. Post-DOJ settlement, KuCoin's KYC is more stringent: government ID, selfie verification, and proof of address. For accounts opened before 2024, KYC may be weaker.
The DOJ settlement leverage: In 2024, KuCoin settled with the US DOJ for $5M for AML violations. As part of the settlement, KuCoin agreed to enhance its compliance program and cooperate with US law enforcement. We leverage this settlement in our legal requests — if you are a US citizen or resident, we file through the FBI, which KuCoin must cooperate with under the settlement.
A client (US resident) woke up to find their phone had no service overnight. When they restored service, they found their KuCoin account had been accessed — the scammer had SIM-swapped their AT&T number, intercepted KuCoin SMS 2FA, and logged in. The scammer found €38,000 in the account, traded €20,000 into 3 obscure altcoins (which lost 40% of value overnight), and withdrew the remaining €18,000 plus the devalued altcoins to 2 external wallets.
Our response: We traced the withdrawal transactions on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also filed a police report and coordinated with the mobile carrier's fraud department.
Outcome: 32% recovery (€12,000 of €38,000). We leveraged the DOJ settlement and filed through the FBI — KuCoin responded in 6 business days (vs 14-21 days for Seychelles alone). €8,000 was frozen on another KuCoin account (the scammer's own). €4,000 in altcoins were frozen on KuCoin (still on the exchange, though devalued). The €20,000 traded into altcoins had lost €8,000 in value — the €12,000 remaining was withdrawn to a personal wallet (untraced). The mobile carrier (AT&T) was found liable. Lower recovery due to altcoin trading losses and Seychelles response time.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does a SIM swap differ from phishing? In a SIM swap, the attacker takes over your phone number — you don't click any link. In phishing, the attacker tricks you into entering credentials on a fake site. See phishing on KuCoin →
Warning: After a SIM swap, fake "recovery services" may contact you. Read our recovery scam warning.
Three differences: (1) KuCoin Seychelles is slow (7-21 days vs Binance's 3-7 days). (2) KuCoin lists thousands of altcoins — the scammer can trade into obscure tokens that lose value. (3) KuCoin settled with the DOJ (2024) — we leverage this for US clients. Recovery rates are 30-50%, lower than Binance, but the DOJ settlement helps for US clients.
In 2024, KuCoin settled with the US DOJ for $5M for AML violations. As part of the settlement, KuCoin agreed to cooperate with US law enforcement. If you are a US citizen or resident, we file through the FBI, which KuCoin must cooperate with under the settlement. This typically reduces response time from 14-21 days (Seychelles) to 3-10 days (US subsidiary). For non-US clients, we file through Seychelles — slower.
If the altcoins are still on KuCoin, yes — they can be frozen. However, obscure altcoins often lose value rapidly. If the scammer withdrew the altcoins to an external wallet, we trace the withdrawal on-chain. The altcoin may have no value outside KuCoin, but if it's a real token, we can trace it. The risk is that the altcoin lost value before we could freeze — reducing the recoverable amount.
KuCoin lists thousands of tokens, including obscure micro-cap coins. The scammer may trade your funds (BTC, ETH, USDT) into micro-cap altcoins before withdrawing. This has two effects: (1) it obscures the on-chain trail (harder to trace), and (2) the altcoins may lose value rapidly. We check KuCoin's internal trading records to see what the scammer traded and trace the actual remaining balance.
7-21 business days for KuCoin Seychelles, 3-10 days for the US subsidiary (if you are a US client). The DOJ settlement has improved KuCoin's cooperation with US law enforcement. For non-US jurisdictions, KuCoin Seychelles is slow. For KuCoin SIM swap cases, early filing is critical — especially if the scammer is trading into obscure altcoins.
Switch from SMS 2FA to Google Authenticator. Contact your mobile carrier and request a port-out PIN. Use a separate email for your KuCoin account. Avoid keeping large altcoin portfolios on KuCoin — move excess funds to a hardware wallet. These measures make SIM swap attacks much harder.
Describe what happened. Include your mobile carrier, when you lost service, KuCoin withdrawal transaction hashes, and total amount lost. We respond within 6 hours.