KuCoin

As of November 2026: The plea, penalties and deferred prosecution terms are as stated in the Justice Department's January 27, 2025 release. The two-year US market exit and the founders' two-year deferred prosecution both run into early 2027, and the outcome of neither was found in the sources reviewed. The FINTRAC penalty is under appeal to the Federal Court, and no result was found. The charging document, plea agreement and New York consent order were not opened. Allegations in the March 2024 indictment, including the US$5 billion and US$4 billion figures, were not proven at trial.

Also known as: KuCoin guilty plea · Peken Global · United States v. Flashdot Limited.

What happened?

KuCoin was founded in September 2017 by Chun Gan and Ke Tang and grew into one of the largest cryptocurrency exchanges in the world. The Justice Department says it reached more than 30 million customers. Users could trade coins such as Bitcoin and Ethereum and, from July 2019, futures contracts. Three companies, in the Cayman Islands, the Seychelles and Singapore, did business together as KuCoin.

What sets this case apart from the other exchange cases on this site is that the lack of identity checks was not only a gap. According to the March 2024 indictment, it was part of the pitch. The Justice Department said that until at least July 2023 KuCoin did not ask customers for any identifying information, and that staff posted publicly that know-your-customer checks were not mandatory, including in reply to users who had said they were in the United States. Prosecutors alleged that many customers chose the platform specifically because it offered anonymity.

Between September 2017 and March 2024, KuCoin served about 1.5 million registered US users and earned at least US$184.5 million in fees from them. Because it served US customers, prosecutors said it was a money services business that had to register with FinCEN and file suspicious activity reports. It did neither.

Which techniques did it use?

KuCoin was not a laundering scheme run by criminals. Like OKX and Binance, it was infrastructure: a place where value could enter and leave crypto without an identified person attached. The record describes several features that investigators look for in an unlicensed or weakly controlled exchange.

• No identity checks as a selling point. An April 2022 social media post cited in the indictment told US users that KYC was not supported for them and not mandatory, and that usual transactions could be done with an unverified account.
• Concealing the US customer base. The indictment alleged that KuCoin tracked customer locations but stopped US customers from identifying themselves as American when opening accounts, and that in 2022 it told an investor it had no US customers.
• A late fix with a gap. KuCoin adopted a mandatory KYC process in mid-2023, after it was told of a federal criminal investigation, according to the indictment. The 2025 release says the checks did not reach existing customers who only wanted to withdraw funds or close positions.
• Fraud and malware proceeds passing through. The Justice Department said the platform was used to move suspicious funds, including proceeds from darknet markets, malware, ransomware and fraud.

How was it found?

The criminal case was investigated by the El Dorado Task Force of Homeland Security Investigations in New York, with help from HSI Pretoria, South Africa. It was prosecuted by the Illicit Finance and Money Laundering Unit of the US Attorney’s Office in Manhattan.

Other regulators found the same weakness from different angles. New York’s attorney general sued in March 2023, saying KuCoin had not registered as a broker-dealer, had falsely called itself an exchange and had not complied with a subpoena. The CFTC filed its own civil case on the day of the indictment. Canada’s financial intelligence unit, FINTRAC, used blockchain analytics to identify 2,952 occasions between June 2021 and May 2024 when KuCoin should have reported a large virtual currency transaction of C$10,000 or more. It also found 33 suspicious transactions that should have been reported, with indicators such as darknet marketplaces, mixers and persons linked to criminal activity.

What was the outcome?

• United States, criminal. On January 27, 2025, Peken Global Limited pleaded guilty to one count of operating an unlicensed money transmitting business. It agreed to forfeit US$184.5 million and pay a fine of about US$112.9 million.
• A market exit and sidelined founders. KuCoin agreed to leave the US market for at least two years. Peken agreed that Gan and Tang, indicted in March 2024 with the companies, would have no role in KuCoin’s management or operations. The Justice Department agreed to defer their prosecution for two years (a deferred prosecution agreement), and each agreed to forfeit about US$2.7 million.
• United States, civil. The March 2024 CFTC complaint ended on March 30, 2026 with a consent order against Peken Global: a US$500,000 civil penalty, no disgorgement, and a permanent bar on giving US participants access without registering. The CFTC credited Peken Global’s cooperation. Claims against three other KuCoin entities were dismissed with prejudice.
• New York. On December 12, 2023, the attorney general announced a consent order worth more than US$22 million: US$16,766,642 in refunds for New York investors and more than US$5.3 million to the state. KuCoin had to stop serving New York customers. The release gives two different investor counts (over 150,000 in the summary, 177,800 in the detail).
• Canada. FINTRAC imposed a C$19,552,000 penalty on July 28, 2025 and announced it on September 25, 2025, for three violations: failing to register as a foreign money services business, failing to report large virtual currency transactions, and failing to report suspicious transactions. Peken Global has appealed to the Federal Court.

What were the warning signs?

• A company that advertises that ID is optional. For a regulated money business, public statements that verification is not required are a direct signal that the controls are missing.
• Customer location data that is collected but not acted on. KuCoin tracked locations yet, per the indictment, steered US users away from declaring themselves.
• Different stories to different audiences. Telling an investor there are no US customers while marketing to them is a red flag in any due diligence.
• Controls added only after an investigation starts. The KYC rollout followed notice of a federal investigation, and it left a gap for existing accounts.
• Counterparties with known risk indicators. FINTRAC pointed to darknet markets, mixers and criminal-linked persons among the unreported suspicious activity.
• Entity names that shift. The same platform was sued in different places under different company names, which makes it harder for a customer or regulator to know who is responsible.

What changed afterwards?

KuCoin is a case study in how many authorities can reach one offshore platform. The US criminal case produced the largest sum, but a state regulator, a commodities regulator and a foreign financial intelligence unit each acted on a different part of the same weakness.

It also shows the limits of penalties. The plea was against one company in a group, with two founders handled by deferred prosecution rather than trial. The market exit, the deferred prosecution and the Canadian appeal were all still running into 2027 when this page was last reviewed. For the parallel plea of another large exchange, see OKX, and for how authorities trace this kind of activity, see the detection overview and the Canada section.

First published November 7, 2026 · Last updated November 7, 2026 · Legal statuses current as of November 2026