Is KuCoin safe to connect?
Exchange ยท Multi-asset centralized exchange (spot, futures, margin). Checked 2026-10-25; every line links its source.
Worst case: KuCoin holds your coins and can freeze all deposits, withdrawals and transfers during AML or Travel Rule reviews with no stated time limit, and regulators have already shut it out of the US and restricted its EU arm.
Safe setup in 3 steps
- Give bots General plus the one trading permission they need; never enable Withdrawal or FlexTransfers on a key you paste into a third-party tool
- If a key must have Withdrawal, KuCoin forces an IP restriction: bind it to your own server's static IP only
- Check that your country is allowed (KuCoin is barred for US users) and keep long-term holdings in your own wallet
What it can do with your money
| Who holds the keys | The exchange holds your funds Custodial exchange. KuCoin EU's custody agreement says only KuCoin EU holds the means of access to your crypto (you do not have self-custody) and that client assets sit in segregated on-chain wallets. source |
|---|---|
| Can funds be sent out to any address? | Yes. Crypto withdrawals are available, subject to KYC level and compliance controls; KuCoin's own XMR guide says Level 2 KYC is required for privacy-coin withdrawals. source |
| Can it hold or freeze your funds? | KuCoin EU General Terms (last updated 2026-01-28): KuCoin EU may apply temporary measures including account suspension, transaction freezing or service restrictions, e.g. during ongoing AML/CFT investigations including EU Travel Rule checks (s.14.3.1); a freeze disables all deposits, withdrawals and transfers of crypto (s.14.3.3(B)); you must promptly provide any information or documents requested (s.9.1.3); KuCoin EU can end an account with two months' notice (s.14.1.2) and after termination you have one month to move assets out, after which a 0.1%/month custody fee may apply (s.15.2, 15.5). No maximum duration for a freeze is stated. Terms for the global (non-EU) entity could not be retrieved. source |
| What a leaked API key can do | Permissions are chosen per key: General (read-only), Spot/Margin/Futures trading, Earn, Withdrawal, FlexTransfers and others. The Withdrawal permission can only be used with IP Restriction enabled, and FlexTransfers also requires an IP filter; KuCoin warns these permissions move money without email or Google 2FA verification. Since 2018 new keys default to read-only. Key expiry rules are not stated in the docs page. source |
| Monero and Zcash | XMR: trade+deposit+withdraw: XMR spot pairs (USDT, BTC, ETH, USDC) and XMR perpetuals; KuCoin public API showed XMR deposits and withdrawals enabled on 2026-10-25. Third-party: XMR deposits/withdrawals were paused from 2026-09-24 and re-enabled by 2026-10-20 source source ZEC: trade+deposit+withdraw: KuCoin public API showed ZEC (native ZEC chain) deposits and withdrawals enabled on 2026-10-25 source Regions: Not stated for XMR by KuCoin. KuCoin says Level 2 KYC is required for privacy-coin withdrawals. Whether KuCoin EU offers XMR/ZEC was not confirmed. source |
Official links
- Website:
kucoin.com - Telegram:
@Kucoin_Exchange - X:
@kucoincom
Where we confirmed these
Deadlines
- 2027-07-10: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (KuCoin EU Exchange GmbH, Austria; MiCA licence reported 2025-11-28: https://cointelegraph.com/news/kucoin-mica-license-austria-malta-left-out). source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-09-24 | XMR deposits and withdrawals paused on KuCoin; shown as enabled again by 2026-10-20 (third-party report) | resumed | source | |
| 2026-03-30 | US court approved CFTC consent order: KuCoin operator Peken Global permanently barred from serving US users unless registered as a foreign board of trade; $500,000 penalty | $500,000 | US users cannot use KuCoin | source |
| 2026-03-05 | Dubai's crypto regulator (VARA) issued a cease-and-desist against KuCoin entities, including KuCoin Exchange EU GmbH, for serving Dubai residents without approval | regulatory warning; no reported effect on balances | source | |
| 2026-02-19 | Austria's FMA banned KuCoin EU from new business (no new customers or new contracts) over AML/CTF and sanctions-compliance staffing gaps, about three months after granting its MiCA licence; date approximate (decision reported 2026-02-23 as made 'Thursday') | onboarding halted; effect on existing balances not reported | source | |
| 2025-01-27 | KuCoin (Peken Global) pleaded guilty in the US to operating an unlicensed money transmitting business, agreed to pay ~$297M and to exit the US market for at least two years; date approximate (January 2025) | ~$297M | US exit | source |