ZachXBT Alleges KuCoin Threatened Legal Action Over $250K Theft

Blockchain investigator ZachXBT has alleged that cryptocurrency exchange KuCoin threatened legal action after he published findings related to a reported $250,000 cryptocurrency theft attributed to Atomic Stealer malware that allegedly occurred on Aug. 18, 2025.

In a post shared on Telegram, ZachXBT listed one theft address alongside five alleged KuCoin deposit addresses. He claimed the accounts involved had “purchased mule KYC,” referring to accounts verified using another person’s identity. The allegations have not been confirmed through court filings or an official statement from KuCoin.

The allegations were made in a post on ZachXBT’s public Telegram channel, Investigations by ZachXBT, where he published one theft address and five alleged KuCoin deposit addresses that he claimed received the stolen funds. The claims have not been confirmed by court filings or an official KuCoin statement.

• Reported theft address: 0x6368D06895b7becdcAC0806F438EfA653fE0a68D
• Alleged KuCoin deposit address: 0x6043b2d79670a417fc523213155812846e893dc7
• Alleged KuCoin deposit address: 0xa0fdb49aa589538d5622b92e9122727873558a13
• Alleged KuCoin deposit address: 0x4a4b5c7db9aa8355a5e5abbfc1926cd6b2d9f610
• Alleged KuCoin deposit address: 0xe7bb69f6c0ae0c1418bd86ec9697af9914d6875e
• Alleged KuCoin deposit address: 0x35d65ec360347f7dc41a929cc7ce9f2485a4f833

The dispute gained additional attention after X user DNBWIZARD shared the exchange and wrote:

A screenshot accompanying the Telegram post appears to show a message signed by the KuCoin Customer Care and Support Team. According to the screenshot, KuCoin stated that it respects the right of individuals to raise concerns through legal and regulatory channels but warned that false or unlawful statements could result in legal claims.

Latest Dispute Revives Earlier Compliance Concerns Around KuCoin

The latest allegations follow another public dispute in March 2026, when a Canadian user alleged KuCoin froze more than CAD 2.8 million in crypto for nearly eight months. KuCoin disputed the claim.

The allegations have renewed focus on KuCoin’s regulatory history and compliance record. In January 2025, the U.S. Department of Justice announced that KuCoin pleaded guilty to operating an unlicensed money transmitting business and agreed to pay $300 million in penalties. The DOJ said the exchange failed to implement effective anti-money laundering (AML) and know-your-customer (KYC) programs and allowed suspicious transactions to pass through its platform.

The resolution followed charges filed by the DOJ in March 2024 against KuCoin and two of its founders. Prosecutors alleged the exchange failed to maintain adequate AML controls, claiming KuCoin received more than $5 billion and transmitted more than $4 billion in suspicious and criminal funds between 2017 and 2024.

The latest allegations also follow another high-profile stolen funds investigation earlier this year involving a fake Ledger Live application. That investigation reported at least $9.5 million stolen from more than 50 victims, with the stolen assets allegedly routed through more than 150 KuCoin deposit addresses before moving into a centralized mixing service.

According to that report, ZachXBT traced transactions into KuCoin deposit addresses linked to an individual identified as AudiA6. The report noted that recovering the funds would likely require cooperation between law enforcement agencies and cryptocurrency exchanges.

European Expansion Followed by Regulatory Restrictions

KuCoin continued expanding its regulatory footprint after securing a Markets in Crypto-Assets (MiCA) license in Austria through its European subsidiary in late 2025. The authorization allowed the exchange to provide regulated crypto services across the European Economic Area under the European Union’s passporting framework.

However, Austria’s financial regulator later barred KuCoin’s European subsidiary from onboarding new customers and conducting new business, citing compliance staffing issues. The restriction came after the exchange had positioned its European operations as a regulated platform under the MiCA framework.