Unsealing the Indictment: Conspiracy Charges Against KuCoin and Founders
The Indictment Unsealed: A Conspiracy to Evade U. S. Law
On March 26, 2024, the United States Department of Justice unsealed a federal indictment that sent shockwaves through the global financial sector. The charges targeted KuCoin, one of the largest cryptocurrency exchanges in the world, and two of its founders, Chun Gan and Ke Tang. Prosecutors from the Southern District of New York accused the exchange and its leadership of operating a criminal conspiracy. The indictment alleges that KuCoin functioned as an unlicensed money transmitting business and willfully violated the Bank Secrecy Act. These charges represent a significant escalation in the American government’s effort to enforce financial compliance within the digital asset market. The indictment outlines a deliberate strategy by KuCoin to circumvent the anti-money laundering required by United States law. Prosecutors claim the exchange processed over $9 billion in suspicious and criminal funds. This figure includes proceeds from ransomware attacks, darknet markets, and fraud schemes. The Department of Justice asserts that KuCoin did not fail to stop these transactions. The government the exchange actively solicited them by marketing itself as a haven for anonymity. The platform allegedly served over 30 million customers without requiring basic identity verification for years.
The Defendants: Architects of the Shadow Network
Chun Gan, also known as “Michael,” and Ke Tang, known as “Eric,” are the primary individual defendants in this case. Both are citizens of China and remain at large. They founded KuCoin in 2017. The indictment portrays them not as passive executives as the architects of a system designed to evade detection. Prosecutors allege that Gan and Tang knew their platform had a massive number of users in the United States. They also knew that serving these users required registration with the Financial Crimes Enforcement Network and the Commodity Futures Trading Commission. The government claims the founders chose to ignore these obligations to accelerate growth. The indictment cites internal communications where Gan and Tang discussed the need to avoid “regulatory trouble” while simultaneously refusing to implement the controls that would prevent it. They allegedly directed employees to falsely state that KuCoin had no United States customers. This lie allowed them to operate in the shadows. The Department of Justice charges them with conspiracy to violate the Bank Secrecy Act and conspiracy to operate an unlicensed money transmitting business. Each count carries a maximum sentence of five years in prison.
The “No KYC” Policy: A Feature, Not a Bug
A central pillar of the government’s case is KuCoin’s “no KYC” policy. Know Your Customer are the standard for financial institutions globally. They require businesses to verify the identity of their clients to prevent money laundering and terrorist financing. The indictment alleges that KuCoin viewed these as an obstacle to profit. For the vast majority of its existence, KuCoin did not require customers to provide any identifying information. Users could register with nothing more than an email address. This absence of verification was not an oversight. It was a selling point. The indictment details how KuCoin marketed its anonymity to attract high-volume traders and illicit actors. The platform allowed users to trade billions of dollars in cryptocurrency without ever revealing who they were. This policy remained in place until July 2023. The company only changed its rules after it became aware of a federal criminal investigation. Even then, the new requirements only applied to new customers. Existing users, including millions based in the United States, were allowed to continue trading without verification.
The Volume of Illicit Funds
The of the alleged money laundering is immense. The indictment states that KuCoin received over $5 billion in suspicious and criminal proceeds. It also sent over $4 billion in illicit funds. These transactions involved of the most notorious criminal networks in the digital space. The Department of Justice specifically links KuCoin to Tornado Cash, a cryptocurrency mixer sanctioned by the Office of Foreign Assets Control. The indictment alleges that KuCoin received over $3. 2 million from Tornado Cash addresses. The platform also facilitated payments for darknet markets and ransomware gangs. By failing to implement transaction monitoring, KuCoin became a preferred hub for criminals looking to launder their stolen assets. The government that this was the inevitable result of the founders’ decisions. When a financial institution removes all safeguards, it invites criminal activity. KuCoin allegedly processed these transactions while publicly claiming to comply with international standards. The between their public statements and their internal operations is a key focus of the prosecution.
The United States Nexus and Deception
Jurisdiction is a serious element of this case. KuCoin is incorporated in the Cayman Islands, the Seychelles, and Singapore. The defense might that United States laws do not apply. Yet the indictment provides extensive evidence that KuCoin actively served customers in the United States. Prosecutors allege that roughly 17 percent of KuCoin’s user base was located in the United States. This substantial percentage brought the exchange squarely under American regulations. The indictment accuses KuCoin of actively concealing this fact. The company allegedly blocked United States IP addresses from its website did not block them from accessing the trading platform via the API or mobile app. This selective blocking created a facade of compliance. The document cites a specific instance where a user logged in from “United States Bridgehampton.” The system flagged the login, yet the user was allowed to continue trading. When users asked about KYC requirements, support staff allegedly told them that “users from the USA are not supported for KYC service” assured them they were “not obliged to do KYC.” This advice instructed United States customers on how to use the platform illegally.
The Corporate Shell Game
The indictment charges three corporate entities: Flashdot Limited, Peken Global Limited, and Phoenixfin Private Limited. These entities shared do business as KuCoin. The use of multiple offshore jurisdictions is common in the cryptocurrency sector. Prosecutors this structure was intended to complicate regulatory oversight. By moving operations between the Cayman Islands, Seychelles, and Singapore, the founders sought to avoid the reach of any single regulator. This corporate shell game failed to protect them from the Department of Justice. The Bank Secrecy Act applies to any money transmitting business that operates in whole or in substantial part within the United States. The physical location of the servers or the incorporation papers matters less than the location of the customers. The government’s evidence shows that KuCoin was deeply integrated into the American financial market. The exchange sought American liquidity and American traders. Consequently, it was subject to American law.
Specific Evidence of Willfulness
The prosecution’s case rests on proving “willfulness.” This means showing that the defendants knew they were breaking the law and did it anyway. The indictment is filled with evidence supporting this claim. It cites emails from investors who explicitly asked the founders about their absence of KYC and their exposure to the United States market. In response, Gan and Tang allegedly dismissed these concerns. They prioritized market share over legal compliance. One particularly damaging piece of evidence involves the founders’ own activity. The indictment alleges that Gan and Tang logged into their own KuCoin accounts while visiting the United States. They received the same location alerts that their customers did. This proves they were personally aware that the platform functioned within United States borders. They knew the system could detect American IP addresses, yet they chose not to use that capability to block American users. This personal knowledge makes it difficult for them to claim ignorance of the platform’s operations.
The Charge of Unlicensed Money Transmitting
The charge of operating an unlicensed money transmitting business falls under 18 U. S. C. § 1960. This statute is a strict liability offense in contexts. It makes it a federal crime to operate a money transmitting business without registering with the Financial Crimes Enforcement Network. KuCoin never registered. The indictment states that the exchange was a money transmitting business because it accepted currency and funds from one person and transmitted them to another. This charge is significant because it does not require proof of money laundering. The mere act of operating without a license is the crime. The government that KuCoin was required to register as early as 2017. By failing to do so for seven years, the company committed a continuous felony. This charge strikes at the heart of the “move fast and break things” culture that pervades the crypto industry. The Department of Justice is establishing that ignorance of registration requirements is not a valid defense.
Violations of the Bank Secrecy Act
The conspiracy to violate the Bank Secrecy Act is the more serious charge. Title 31 U. S. C. § 5318 requires financial institutions to maintain an anti-money laundering program. This includes filing Suspicious Activity Reports for transactions over $5, 000 that involve chance criminal activity. KuCoin allegedly never filed a single Suspicious Activity Report. Not one. In a platform processing billions of dollars daily, the absence of a single suspicious report is statistically impossible without deliberate suppression. The indictment that the failure to file these reports was a strategic choice. Filing reports would have alerted regulators to the presence of United States customers and illicit funds. To protect their business model, KuCoin allegedly chose silence. This silence allowed criminals to move funds with impunity. The government views this as aiding and abetting the underlying criminal activity. By refusing to act as a gatekeeper, KuCoin became an accomplice.
The Role of Homeland Security Investigations
The investigation was led by Homeland Security Investigations, specifically the El Dorado Task Force in New York. This unit specializes in financial crimes and money laundering. Their involvement signals that the United States government views unregulated crypto exchanges as a national security threat. Special Agent in Charge Darren McCormack described KuCoin as an “alleged multibillion-dollar criminal conspiracy.” The involvement of Homeland Security Investigations also highlights the international nature of the probe. The agency worked to trace funds across borders and de-anonymize transactions. They utilized blockchain analysis to link KuCoin addresses to known criminal wallets. This technical forensic work forms the backbone of the financial evidence. It moves the case from theoretical violations to concrete proof of dirty money flowing through the exchange.
Damian Williams and the SDNY Strategy
United States Attorney Damian Williams has taken a hard line against cryptocurrency crime. His statement accompanying the indictment was blunt. He said, “Crypto exchanges like KuCoin cannot have it both ways.” This phrase encapsulates the government’s position. Companies cannot solicit American customers to boost their valuation while refusing to follow American laws. Williams emphasized that the indictment is a warning to other exchanges. The Southern District of New York has become the primary battleground for crypto enforcement. The KuCoin case follows similar actions against BitMEX and Binance. It establishes a pattern of prosecution that the leadership of these companies personally. The message is clear: corporate settlements are no longer enough. Executives face individual criminal liability for the compliance failures of their firms.
The Immediate Aftermath
Upon the unsealing of the indictment, the market reacted instantly. Users withdrew hundreds of millions of dollars from KuCoin in a matter of hours. The exchange’s native token dropped significantly in value. While KuCoin issued statements assuring users that their assets were safe, the legal pressure was undeniable. The Commodity Futures Trading Commission filed a parallel civil lawsuit on the same day. This coordinated action doubled the legal jeopardy for the company. The indictment leaves KuCoin in a precarious position. With its founders on the run and the United States government seeking forfeiture of assets, the future of the exchange is uncertain. The charges carry the chance for massive fines and prison time. More importantly, they shatter the illusion that offshore exchanges are beyond the reach of United States law. The unsealing of this indictment marks the end of the era of impunity for “no KYC” platforms. The Department of Justice has drawn a line in the sand, and KuCoin is on the wrong side of it.
The Architects: Chun Gan and Ke Tang's Role in the AML Failures
Strategic Anonymity: Implementing a 'No-KYC' Protocol to Attract Illicit Flows
The Architecture of Evasion: Email-Only Registration
The central engine of KuCoin’s criminal utility was not a complex financial instrument, a simple user interface decision: the “email-only” account. For six years, from its founding in 2017 until July 2023, the exchange operated a deliberate “no-KYC” (Know Your Customer) protocol. While compliant financial institutions required government-issued identification, facial verification, and proof of address, KuCoin required only an email address to move billions of dollars. This was not a passive oversight; it was a strategic feature designed to capture the market share of illicit actors who had been de-platformed by regulated exchanges.
The Department of Justice indictment reveals that this friction-free entry point allowed KuCoin to amass over 30 million customers. A serious portion of this user base consisted of individuals and entities specifically seeking to evade the U. S. banking system. By removing the barrier of identity verification, KuCoin advertised itself as a safe harbor for money laundering. The platform’s internal data showed that it served approximately 1. 5 million U. S.-based customers, yet it did not require these users to identify themselves, nor did it restrict their trading based on their location. The “no-KYC” policy was the primary driver of the exchange’s liquidity, prioritizing volume over legality.
The $9 Billion Wash pattern
The consequences of this strategic anonymity were quantifiable and severe. Federal prosecutors estimate that KuCoin facilitated the transmission of over $9 billion in suspicious and criminal funds. This figure includes approximately $5. 39 billion received by the exchange and $4. 09 billion sent out. These funds were not gray-market speculation; they were the proceeds of direct criminal activity, including ransomware attacks, fraud schemes, and darknet market sales.
The exchange became a preferred off-ramp for cybercriminals. Because KuCoin did not collect identifying information, it could not, and did not, file Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN). This silence created a black hole in the global financial intelligence grid, allowing criminals to convert cryptocurrency into different assets or fiat currency without alerting law enforcement. The DOJ filings indicate that KuCoin’s leadership, including founders Chun Gan and Ke Tang, were fully aware of these obligations yet chose to ignore them to maintain the platform’s rapid growth trajectory.
The Tornado Cash Connection
A specific vector for this illicit flow was the sanctioned cryptocurrency mixer Tornado Cash. Mixers are designed to obscure the origin of funds by pooling tokens from multiple users and redistributing them, a process frequently used to wash stolen assets. The indictment details that KuCoin received approximately $3. 2 million in funds directly linked to Tornado Cash addresses.
This connection is significant because Tornado Cash had been by the Office of Foreign Assets Control (OFAC) as a sanctioned entity due to its role in laundering funds for state-sponsored cybercrime groups, including North Korea’s Lazarus Group. By failing to implement basic wallet screening or KYC checks, KuCoin allowed these sanctioned funds to enter the wider crypto economy. The exchange’s systems did not flag these transactions because the compliance architecture necessary to detect them did not exist.
Darknet Markets and Hydra
Beyond mixers, KuCoin served as a financial hub for darknet markets. The platform processed transactions related to Hydra, which was the world’s largest and longest-running darknet market before its by German and U. S. authorities in 2022. Hydra specialized in the sale of narcotics, stolen financial data, and money laundering services.
The indictment notes that KuCoin was used to launder proceeds from these markets, functioning as a digital laundromat for drug cartels and cyber-gangs. The “no-KYC” policy meant that high-volume traders moving millions of dollars in darknet proceeds looked no different in KuCoin’s database than a retail investor with a Gmail account. This absence of differentiation was intentional. By refusing to look at who was trading, KuCoin could claim plausible deniability, a defense that failed when prosecutors seized their internal communications and server data.
Sanctions Evasion and the Iranian Nexus
The failure to require identification also opened the door to widespread sanctions evasion. KuCoin’s internal data revealed substantial traffic from Iran, a jurisdiction subject to detailed U. S. sanctions. even with knowing that Iranian users were utilizing the platform, KuCoin did not implement IP blocking or geofencing tools to stop them. Instead, the exchange allowed these users to trade freely, processing transactions that violated the International Emergency Economic Powers Act (IEEPA).
Investigations have shown that KuCoin provided infrastructure that allowed Iranian exchanges to “white-label” their services, giving sanctioned entities access to global liquidity pools. This setup created a bypass for the U. S. sanctions regime, allowing funds to flow in and out of Iran without scrutiny. The DOJ charges highlight that this was not accidental leakage a widespread failure to prevent the platform from being used by adversaries of the United States.
The Sham Compliance of July 2023
In July 2023, facing imminent legal threats and aware of the federal investigation, KuCoin announced a shift in policy. The company claimed it would require mandatory KYC for its users. Yet, the implementation of this policy revealed the company’s continued commitment to evasion. The new requirements applied only to new customers.
Existing users, including the millions of unverified accounts already responsible for the billions in illicit volume, were “grandfathered” in. They could not deposit new funds, they could continue to trade and withdraw existing assets without revealing their identities. This half-measure allowed the illicit flows to continue while the company postured compliance in public statements. It was only after the indictment was unsealed in March 2024 that the full extent of this sham compliance was exposed. The “no-KYC” era of KuCoin was not a period of growing pains; it was a calculated business model built on the strategic preservation of anonymity for criminal profit.
The Shadow User Base: Deliberate Concealment of U.S. Customers
The Mechanics of Plausible Deniability
KuCoin’s primary method for concealing this user base was a calculated weaponization of its “No-KYC” (Know Your Customer). For years, the exchange allowed users to open accounts using nothing more than an email address. This low-friction entry point was not an oversight; it was a strategic design choice that allowed U. S. traders to onboard without ever having to lie to a compliance officer because no compliance officer ever asked the question. When the exchange did offer an optional identity verification process, it employed a “cosmetic” exclusion strategy. The drop-down menu for country selection simply omitted the United States. This created a paradoxical environment where U. S. users were technically barred from *verifying* their identity were fully to *trade* anonymously. By refusing to collect the data that would confirm a user’s location, KuCoin maintained a veneer of ignorance that they later attempted to use as a legal shield. The indictment reveals that this ignorance was feigned. KuCoin’s internal systems actively gathered and tracked customer location data, including IP addresses and login timestamps. The exchange possessed the granular data necessary to identify and block U. S. traffic chose not to operationalize it for compliance. instead, they used this data to optimize platform performance and marketing reach while simultaneously claiming to regulators and investors that their U. S. exposure was nonexistent.
Cosmetic Compliance and the IP Charade
To maintain the illusion of a geofenced platform, KuCoin implemented IP address blocking measures that prosecutors described as “cosmetic compliance.” These blocks were notoriously porous, frequently failing to block U. S. IP addresses entirely or being easily circumvented by basic VPN services, a workaround that was an open secret in crypto trading communities. Internal communications in regulatory filings suggest that the leadership was well aware of the ineffectiveness of these blocks. The DOJ alleged that KuCoin’s founders, Chun Gan and Ke Tang, viewed the U. S. market not as a prohibited zone as a serious liquidity pool that had to be harvested quietly. When a U. S. user complained on social media about verification problem, KuCoin support staff publicly responded that KYC was not mandatory, coaching the user on how to remain on the platform in the shadows. This duplicity extended to the highest levels of corporate strategy. In 2022, KuCoin executives allegedly lied directly to at least one investor, stating unequivocally that the exchange had no U. S. customers. At that exact moment, internal metrics showed that U. S. users accounted for a substantial percentage of the platform’s trading volume, figures that ranged between 20% and 50% depending on the specific metric and time period.
Active Solicitation Behind Closed Doors
While officially banning U. S. residents, KuCoin aggressively marketed its services to them. The exchange maintained a physical presence at major U. S. industry conferences, such as Consensus 2022 and Mainnet 2022, where they courted institutional capital and retail influence alike. These appearances were not passive; they were active solicitation efforts designed to funnel U. S. liquidity into the exchange’s order books. The marketing strategy relied heavily on influencer campaigns that did not discriminate by geography. By promoting the “no-KYC” feature as a primary selling point, KuCoin dog-whistled to privacy-focused U. S. traders and those seeking to evade domestic regulatory oversight. The “shadow” user base was thus not a passive accumulation of users who slipped through the cracks, the result of a targeted acquisition strategy designed to circumvent the Bank Secrecy Act.
The of the Phantom Volume
The financial impact of this concealment was. The “phantom” U. S. user base contributed to billions of dollars in daily trading volume and trillions in annual volume. This liquidity was essential for KuCoin to market itself as a top-five global exchange. Without the depth provided by these illicitly onboarded U. S. traders, KuCoin’s order books would have been significantly thinner, likely relegating it to a lower tier of the competitive exchange. This volume also served a darker purpose. By allowing millions of unverified users to trade billions of dollars in assets, KuCoin created a massive blind spot in the global financial system. The DOJ indictment highlighted that this absence of visibility made the platform a haven for illicit financial flows, as the “shadow” user base included not just day traders, money launderers who specifically chose KuCoin for its lax controls. The deliberate concealment of U. S. customers was, therefore, the foundational sin that enabled the wider spectrum of criminal activity on the platform.
Marketing Non-Compliance: Promoting Unverified Accounts to U.S. Residents
The “No-KYC”: Weaponizing Anonymity as a Marketing Tool
The Department of Justice indictment against KuCoin exposes a marketing strategy that was not negligent, actively predatory regarding United States regulations. While publicly maintaining a facade of compliance, KuCoin’s internal growth engine treated the “absence of Know Your Customer (KYC) checks” as a primary product feature. For years, the exchange distinguished itself from compliant competitors like Coinbase or Kraken not by superior technology or liquidity, by offering a sanctuary for unverified trading. This “No-KYC” policy was not a passive loophole; it was the central pillar of their user acquisition strategy, designed to attract the precise demographic that U. S. laws intend to exclude: tax evaders, money launderers, and retail traders seeking to bypass use restrictions.
Prosecutors allege that KuCoin’s leadership understood that enforcing strict identity verification would decimate their trading volume. Consequently, the marketing narrative shifted to emphasize speed and privacy. By allowing users to trade instantly upon registration with only an email address, KuCoin removed the friction associated with legal compliance. This ” ” onboarding was aggressively marketed to U. S. residents who were otherwise blocked from accessing high-use derivatives on regulated platforms. The indictment reveals that KuCoin’s user base grew to over 30 million customers, a figure achieved largely because the exchange became the de facto destination for capital that refused to identify itself.
The “Unverified Account” was a distinct product tier. Unlike compliant exchanges where unverified status means a frozen account, on KuCoin, “unverified” meant fully functional for the vast majority of retail traders. The withdrawal limits for these accounts, frequently set at 1 BTC or higher per day, were sufficiently high to accommodate nearly all retail activity. This calculated threshold allowed KuCoin to claim they had controls in place while simultaneously ensuring those controls never actually the flow of U. S. dollars into their ecosystem. The marketing message was implicit yet clear: trade here, and not ask who you are.
Direct Solicitation: The “April 2022” Admission
The most damning evidence of KuCoin’s active solicitation of U. S. customers comes from their own public communications. The DOJ indictment highlights a specific interaction on Twitter ( X) from April 2022, where KuCoin’s official support account responded to a U. S. user inquiring about access. The response was explicit: “KYC is not supported to USA users, yet, it is not mandatory on KuCoin to do KYC. Usual transactions can be done using an unverified account.” This statement was not a rogue error; it was company policy broadcast to the world. It instructed U. S. residents on exactly how to circumvent the restrictions that supposedly existed.
This public admission destroys the defense that U. S. users were “accidentally” accessing the platform via VPNs without the exchange’s knowledge. KuCoin’s support staff actively guided American users into the unverified tier, reassuring them that their absence of documentation was no barrier to entry. This level of customer service for prohibited users indicates a widespread directive to capture U. S. market share by any means necessary. The exchange told the market that U. S. regulations were a minor inconvenience that could be sidestepped by simply declining to upload a passport.
Social media platforms became a primary vector for this non-compliance marketing. Beyond direct support replies, the indictment and CFTC complaint point to broader influencer campaigns. KuCoin engaged with crypto influencers and key opinion leaders who frequently touted the exchange’s lax verification requirements. These influencers served as proxies, spreading the “No-KYC” gospel to U. S. audiences without KuCoin needing to run traditional geofenced advertisements that might attract regulator attention. The strategy relied on word-of-mouth amplification of their regulatory failures.
Physical Presence: Marketing Crimes on U. S. Soil
even with operating an unlicensed money transmitting business, KuCoin did not shy away from physical marketing within the United States. The CFTC complaint details how KuCoin representatives attended major industry industry conferences, specifically citing “Consensus 2022” and “Mainnet 2022.” These events, held in major U. S. cities, are hubs for institutional and retail networking. By sending staff to these events, KuCoin actively solicited business from U. S. investors and trading firms while simultaneously failing to register with the Commodity Futures Trading Commission (CFTC) or the Financial Crimes Enforcement Network (FinCEN).
The audacity of physically courting U. S. customers while refusing to register with U. S. regulators demonstrates the “brazen” nature of the conspiracy alleged by U. S. Attorney Damian Williams. It suggests that KuCoin’s leadership believed they were untouchable, operating under the false assumption that being headquartered offshore (in Seychelles, Cayman Islands, and Singapore) provided immunity for crimes committed on American soil. Their physical presence at these conferences served to legitimize the exchange in the eyes of U. S. traders, creating a false sense of security that the platform was a valid, compliant entity.
During these events, and in broader industry communications, KuCoin marketed itself as a “global” exchange. Yet, the data reveals that the United States was a massive portion of this “global” audience. The CFTC alleges that between 20% and 50% of KuCoin’s traffic or customer base originated from the U. S. during the relevant period. Marketing to a “global” audience when half of that audience is American constitutes direct solicitation of the U. S. market. The exchange’s presence at U. S. trade shows was not incidental; it was a targeted effort to maintain their grip on the lucrative American user base.
The “Sham” Blocking: Cosmetic Compliance as a Marketing Tactic
To maintain the illusion of banning U. S. users, KuCoin implemented what prosecutors describe as “cosmetic” IP blocking. Users visiting the site from a U. S. IP address might see a pop-up message stating that services were unavailable in their region. Yet, this warning was toothless. It did not prevent users from clicking through, logging in, or executing trades. It was a “sham” control designed to provide plausible deniability rather than actual restriction.
This ineffective blocking served a dual purpose. For regulators, it was a prop to point at during inquiries. For users, it was a wink-and-nod confirmation that the “ban” was not serious. By making the barrier so easily surmountable, requiring nothing more than closing a pop-up window, KuCoin marketed its willingness to look the other way. A truly compliant exchange blocks the login attempt or freezes the account upon detecting a U. S. IP. KuCoin allowed the activity to continue, processing billions of dollars in transactions from IP addresses they explicitly claimed to prohibit.
The indictment further reveals that even the founders, Chun Gan and Ke Tang, tested this system themselves. They logged into their KuCoin accounts while physically present in the United States. They received the same automated emails that regular users received, notifying them of a login from a U. S. IP address. even with these alerts, no action was taken to close the accounts or block the trades. This internal testing confirms that the leadership knew the marketing of “restrictions” was a lie. They experienced the loophole firsthand and allowed it to remain the standard operating procedure for millions of customers.
The “Drop-Down” Deception
Perhaps the most cynical aspect of KuCoin’s marketing strategy was the manipulation of its own verification forms. The DOJ alleges that KuCoin offered an optional identity verification process that unlocked higher withdrawal limits. To prevent U. S. users from “accidentally” identifying themselves, which would force KuCoin to acknowledge their presence, the exchange simply removed the “United States” from the country selection drop-down menu.
This was not a measure to block U. S. users; it was a measure to keep them anonymous. By making it impossible for a user to select “USA” during verification, KuCoin guided these customers back into the unverified, anonymous tier. The user interface itself was designed to funnel Americans into the shadows. If a user tried to verify and couldn’t find their country, the implicit instruction was to stop trying and trade anonymously. This design choice turned the compliance process into a filter that ensured only non-U. S. users were verified, while U. S. users remained in the profitable, unverified pool.
This “Drop-Down Deception” allowed KuCoin to generate misleading data. They could claim to regulators that they had “zero” verified U. S. users, a technically true statement only because they rigged the system to prevent verification. This data was then used to market the exchange’s compliance to investors, lying about the geographic distribution of their revenue. The marketing of the exchange to investors relied on the concealment of the U. S. base, while the marketing to users relied on the accessibility of the platform to that same base.
Economic Impact of Non-Compliance Marketing
The economic advantage gained by this illegal marketing was immense. By skipping the costs of compliance and the friction of KYC, KuCoin could offer faster onboarding and lower blocks than its legal competitors. This siphoned liquidity away from regulated U. S. exchanges, distorting the market. U. S. exchanges that followed the rules lost customers to KuCoin’s “Wild West” environment. The “No-KYC” marketing strategy was, in effect, a strategy of unfair competition based on criminal negligence.
The of this operation was vast. The indictment notes that KuCoin received over $5 billion and sent over $4 billion in suspicious and criminal funds. A serious portion of this volume was driven by the U. S. users they courted. The marketing did not just attract retail traders; it attracted darknet markets, ransomware gangs, and sanctions evaders who needed a high-volume exchange that asked no questions. By marketing anonymity, KuCoin became a preferred vendor for the criminal underworld, all while projecting the image of a legitimate “top 5” global exchange.
When KuCoin updated its terms in late 2023 to ostensibly require KYC, the move was reactionary and incomplete, triggered only by the looming criminal investigation. For years prior, the marketing damage was done. They had built an empire on the pledge of non-compliance, selling the U. S. market access to a financial system with the safety switches removed.
Corporate Shells: The Operational Web of Peken Global, Flashdot, and PhoenixFin
The Triad of Evasion: the Corporate Shell Game
Federal prosecutors unsealed an indictment that exposed a sophisticated corporate shell game designed to shield KuCoin from regulatory oversight. The Department of Justice identified three specific entities as the primary vehicles for this conspiracy: Flashdot Limited, Peken Global Limited, and PhoenixFin Private Limited. These companies did not function as independent businesses with distinct operations. They served as interchangeable legal wrappers for a single criminal enterprise. The founders used these entities to create a labyrinth of jurisdiction that confused regulators and obscured the true nature of their operations. This structure allowed KuCoin to solicit United States customers while claiming it had no nexus to the country.
The investigation revealed that none of these entities maintained a physical presence in their places of incorporation. Flashdot Limited registered in the Cayman Islands. Peken Global Limited registered in the Republic of Seychelles. PhoenixFin Private Limited registered in Singapore. The indictment states that KuCoin’s actual operations occurred in China and Singapore. The founders selected offshore jurisdictions solely to exploit their perceived absence of regulatory enforcement. This deliberate separation of legal registration from physical operation formed the core of their defense against compliance. They argued that U. S. laws did not apply to them because they were “offshore” entities. The Department of Justice rejected this argument and charged all three companies as co-conspirators.
PhoenixFin Private Limited: The Singaporean Origin
PhoenixFin Private Limited represents the initial phase of KuCoin’s corporate evolution. Incorporated in Singapore, this entity operated the exchange from its founding in September 2017 until December 2018. It also held the registration for the “kucoin. com” domain. Singapore offers a reputation for financial innovation. The founders likely chose it to project an image of legitimacy to early investors. Records show that Chun Gan served as the Chief Executive Officer of PhoenixFin Private Limited. Ke Tang served as its President. This direct control links the founders inextricably to the entity’s illegal activities during the platform’s infancy.
The role of PhoenixFin Private Limited extended beyond mere registration. It acted as the primary counterparty for user agreements and the recipient of trading fees during the 2017 crypto boom. The Department of Justice alleges that during this period, the entity processed millions of dollars in unlicensed money transmissions. It failed to register with the Financial Crimes Enforcement Network even with serving a substantial number of U. S. users. The founders eventually shifted operations away from this entity. They likely sought to distance the exchange from Singapore’s tightening regulatory environment. This move marked the beginning of a more aggressive strategy to hide the platform’s ownership.
Flashdot Limited: The Cayman Holding Shell
The conspiracy required a of separation between the owners and the operational risks. Flashdot Limited fulfilled this function. Incorporated in the Cayman Islands, this entity was originally named “Phoenixfin Limited” before undergoing a rebranding. The name change itself suggests an attempt to break the chain of continuity in the eyes of investigators. Flashdot served as the holding company for the enterprise. It owned the intellectual property and the subsidiary entities that faced the public. This structure is common in legitimate finance served a nefarious purpose here. It insulated the founders’ equity from the direct liabilities incurred by the operating companies.
Flashdot Limited had no employees in the Cayman Islands. It had no office space. It conducted no board meetings there. Its existence was purely a paper reality. The Department of Justice indictment highlights that Chun Gan and Ke Tang remained the directors of Flashdot. They held approximately 75 percent of its shares. This ownership stake proves that even with the complex corporate, the founders retained absolute control. Flashdot was the central node in the web. It consolidated the profits generated by the illegal activities of its subsidiaries. Prosecutors charged Flashdot directly. They asserted that a holding company cannot escape liability when its primary purpose is to a criminal conspiracy.
Peken Global Limited: The Seychelles Operator
Peken Global Limited emerged as the primary operating entity for KuCoin starting in September 2019. Incorporated in the Republic of Seychelles, Peken Global took over the customer-facing responsibilities from PhoenixFin. The choice of Seychelles was calculated. The jurisdiction is notorious for its privacy laws and historically lax enforcement of international financial regulations. By moving the operational epicenter to Peken Global, the founders hoped to place the exchange beyond the reach of U. S. subpoenas. They believed that a Seychelles entity would be immune to the Bank Secrecy Act.
This entity became the signatory for the Terms of Use agreed to by millions of customers. It was Peken Global that collected user data. It was Peken Global that failed to implement the required anti-money laundering programs. The indictment alleges that Peken Global processed billions of dollars in suspicious transactions. These included proceeds from ransomware attacks and darknet markets. The entity acted as the floodgate for illicit capital. It deliberately ignored the “red flags” that would have triggered reporting requirements in a compliant financial institution. Peken Global’s officers, including Gan and Tang, knowingly directed this policy of willful blindness.
The Operational Disconnect
The most damning aspect of this corporate structure was the complete disconnect between registration and reality. The Department of Justice investigation utilized IP address logs and employee travel records to prove that the “offshore” status was a sham. KuCoin employees worked from offices in China and Singapore. They attended conferences in New York and Texas. They solicited U. S. institutional investors. The corporate shells in Cayman and Seychelles were mail drops. This finding destroyed the defense that KuCoin was outside U. S. jurisdiction. The physical presence of its agents and the digital presence of its users in the United States established the necessary legal nexus.
This operational disconnect also facilitated the evasion of tax and reporting obligations. By booking revenue through Peken Global and Flashdot, the enterprise avoided scrutiny from tax authorities in the jurisdictions where they actually worked. The funds flowed through a network of bank accounts associated with these shells. This made it difficult for any single regulator to see the full picture. The Department of Justice had to piece together the puzzle by subpoenaing records from intermediary banks and analyzing blockchain data. The trail of money proved that Peken Global and Flashdot were not passive entities. They were active participants in the laundering of criminal proceeds.
Regulatory Evasion as a Business Model
The use of Peken Global, Flashdot, and PhoenixFin was not an accidental administrative oversight. It was a core component of KuCoin’s business model. The founders understood that compliance with the Bank Secrecy Act would reduce their profit margins. It would require them to turn away customers who refused to provide identification. It would force them to spend millions on compliance software and staff. Instead, they chose to spend money on incorporating shell companies. They calculated that the cost of maintaining this corporate web was lower than the cost of following the law.
This strategy worked for several years. It allowed KuCoin to grow into one of the largest exchanges in the world. They captured a significant share of the U. S. market by offering what compliant exchanges could not: anonymity. The corporate shells provided the cover necessary to market this anonymity. They allowed the founders to claim they were “decentralized” or “global” citizens who were not bound by the laws of any single nation. The indictment this narrative. It asserts that if you do business in the United States, you must follow United States law. The location of your incorporation papers is irrelevant if your customers are in New York.
The Failure of the Shell Game
The indictment of Flashdot, Peken Global, and PhoenixFin signals the end of the “jurisdictional arbitrage” era for crypto exchanges. The Department of Justice demonstrated that it can and pierce the corporate veil. Prosecutors did not just charge the individuals. They charged the entities themselves. This method ensures that the assets held by these companies are subject to forfeiture. It prevents the founders from simply dissolving one shell and starting another. The legal liability attaches to the corporate persons as well as the natural persons.
Peken Global eventually admitted to its role in the scheme. In a settlement with the New York Attorney General, the entity acknowledged it operated as an unregistered securities broker. This admission contradicts the years of public denials issued by KuCoin. It validates the Department of Justice’s theory of the case. The corporate shells did not protect the founders. They served as the evidence of their intent to deceive. The detailed structure they built to hide their crimes became the map that led investigators directly to them.
| Entity Name | Jurisdiction | Role in Conspiracy | Key Personnel |
|---|---|---|---|
| PhoenixFin Private Limited | Singapore | Early operator (2017-2018); Domain owner | Chun Gan (CEO), Ke Tang (President) |
| Flashdot Limited | Cayman Islands | Holding company; IP owner; Formerly Phoenixfin Ltd | Chun Gan (Director), Ke Tang (Director) |
| Peken Global Limited | Seychelles | Primary operator (2019-Present); User terms signatory | Chun Gan (Director), Ke Tang (Shareholder) |
The $9 Billion Pipeline: Facilitating Money Laundering for Criminal Actors
The $9 Billion Figure: A Deliberate Blind Eye
The sheer volume of illicit capital flowing through KuCoin serves as the centerpiece of the government’s case. According to the indictment, the exchange received more than $5 billion and transmitted over $4 billion in proceeds derived from suspicious or directly criminal activities. These funds did not slip through the cracks of a well-intentioned compliance program. They poured through wide-open gates. KuCoin’s leadership, specifically founders Chun Gan and Ke Tang, allegedly engineered this permeability. By enforcing a strict “no-KYC” policy for years, they signaled to the market that KuCoin was a safe haven for funds that could not touch the regulated banking system. The platform allowed users to open accounts with nothing more than an email address, enabling high-volume traders to move millions of dollars without ever revealing their identity. This anonymity was not a bug; it was the product.
The Tornado Cash Nexus
A particularly damning component of the indictment details KuCoin’s relationship with Tornado Cash, the cryptocurrency mixer sanctioned by the U. S. Treasury for laundering billions, including proceeds for the North Korean state-sponsored Lazarus Group. even with the public designation of Tornado Cash as a tool for cybercriminals, KuCoin continued to process transactions linked to the mixer. The DOJ filing cites specific data: between August 2022 and November 2023, approximately 197 KuCoin deposit addresses received roughly $3. 2 million in cryptocurrency directly or indirectly from Tornado Cash. While $3. 2 million appears small against the $9 billion total, it proves a serious legal point: KuCoin had the technical capability to identify these transfers yet chose to process them. The blockchain is transparent; the source of these funds was visible on the public ledger. By accepting them, KuCoin served as a cash-out point for actors attempting to obfuscate the origin of stolen crypto assets.
Sanctions Evasion and Darknet Markets
The indictment further alleges that KuCoin became a preferred financial hub for sanctions evasion and darknet commerce. The platform’s refusal to geofence users or require identification made it a natural partner for entities in sanctioned jurisdictions, including Iran and Russia. Prosecutors outlined how the exchange was used to launder proceeds from: * **Darknet Markets:** Vendors of illegal goods used KuCoin to convert bitcoin and other tokens into stablecoins or fiat currency. * **Ransomware Schemes:** Cybercriminal gangs, who lock victim data and demand payment, utilized KuCoin to clean their ransom payments. * **Fraud and Malware:** Proceeds from widespread investment scams and malware campaigns flowed into KuCoin wallets, where they were mixed with legitimate trading volume to wash away their criminal taint. The DOJ noted that KuCoin’s systems were deliberately blind to the geographical location of its users. Even when IP address data indicated users were logging in from sanctioned nations or the United States, the exchange did not block the activity. This willful ignorance allowed money to flow freely from blacklisted regions into the global financial system.
The Zero-SAR Compliance Failure
Perhaps the most statistically clear failure in the indictment is KuCoin’s record on Suspicious Activity Reports (SARs). In the United States, financial institutions are legally mandated to file SARs with the Financial Crimes Enforcement Network (FinCEN) when they detect transactions that signal chance criminal activity. For years, KuCoin filed **zero** SARs. In an industry where even small exchanges file thousands of reports annually to flag chance money laundering, KuCoin’s total silence was deafening. It suggests that even with processing billions of dollars in transactions, of which triggered internal alerts or involved known high-risk wallets, the company refused to alert authorities. This was not a failure of detection software; it was a failure of corporate. The indictment that filing SARs would have invited scrutiny that KuCoin’s business model could not survive.
Operationalizing Crime
The “pipeline” described by prosecutors was. A criminal actor could steal funds via a DeFi exploit, run them through a mixer like Tornado Cash, deposit them into a verified-by-email KuCoin account, trade them for a different asset (like USDT), and then withdraw them to a clean wallet. At no point in this chain did KuCoin intervene, ask for identification, or report the activity. By 2024, the of this operation had rendered KuCoin a significant node in the global money laundering infrastructure. The $9 billion in illicit flows was not just a side effect of the business; it was a substantial portion of the liquidity that made KuCoin a top-tier exchange. The DOJ’s action forces a reckoning with the reality that for years, one of the world’s largest crypto platforms was operating as a shadow bank for the criminal economy.
Darknet Nexus: Processing Proceeds from Ransomware and Fraud Schemes
Sanctions Evasion: The $3.2 Million Connection to Tornado Cash
The $3. 2 Million Breach: Tornado Cash and the Failure of Containment
The Department of Justice indictment against KuCoin exposes a specific, quantifiable failure in the exchange’s anti-money laundering defenses: the processing of over $3. 2 million in cryptocurrency derived from Tornado Cash. This figure represents more than a simple compliance oversight. It serves as forensic evidence that KuCoin’s operational model prioritized volume over legal adherence. Between August 2022 and November 2023, the exchange allowed funds from the sanctioned mixer to flow into its digital wallets, directly violating U. S. sanctions.
Tornado Cash, a decentralized mixing service, was sanctioned by the Office of Foreign Assets Control (OFAC) in August 2022. The U. S. Treasury Department identified the mixer as a primary tool for the Lazarus Group, a North Korean state-sponsored cybercrime organization, to launder stolen funds. Once OFAC adds an entity to its Specially Nationals (SDN) list, all U. S. persons and businesses, including those operating within the U. S. financial system, must block transactions involving that entity. KuCoin, with its substantial U. S. user base, fell under this requirement. Yet, for 15 months following the designation, the exchange continued to accept deposits linked to the blacklisted service.
197 Deposit Addresses: The Mechanics of Evasion
The indictment details that approximately 197 unique KuCoin deposit addresses received these illicit funds. This high number of receiving addresses suggests a pattern of diffuse, structured deposits rather than a single, error. Users seeking to wash funds frequently split large sums into smaller amounts to avoid detection, a technique known as “smurfing.” The fact that nearly 200 addresses on KuCoin’s platform accepted these transfers indicates that the exchange’s transaction monitoring systems were either non-existent or deliberately tuned to ignore such activity.
In a compliant exchange, blockchain analytics tools flag incoming transactions from known high-risk sources like mixers immediately. When a deposit originates from a wallet associated with Tornado Cash, the system should freeze the funds and trigger a manual review. KuCoin’s systems failed to execute this basic defensive step. The funds moved from the sanctioned mixer, through the blockchain, and into KuCoin’s liquidity pools without resistance. This failure allowed actors to convert tainted cryptocurrency into other assets or fiat currency, completing the money laundering pattern.
The “No-KYC” Catalyst
The persistence of these transactions links directly to KuCoin’s refusal to implement a mandatory Know Your Customer (KYC) program. During the period in question, users could open accounts and deposit funds with nothing more than an email address. This anonymity shielded the individuals controlling the 197 deposit addresses. Without identity verification, KuCoin had no method to determine if the account holders were on sanctions lists themselves or if they were acting as money mules for criminal enterprises.
The timeline is damning. OFAC sanctioned Tornado Cash in August 2022. KuCoin did not implement a mandatory KYC program for new customers until July 2023, nearly a year later. Even then, the program did not apply to existing customers. This gap created a year-long window where the exchange operated as an open door for sanctioned funds. The $3. 2 million figure by the DOJ is likely a conservative estimate, representing only the funds that could be definitively traced and proven in court. The actual volume of washed funds facilitated by this policy vacuum may be higher.
Willful Blindness to Blockchain Data
Blockchain technology provides a permanent, public ledger of all transactions. The link between Tornado Cash and the 197 KuCoin addresses was visible on-chain. Compliance firms and data analytics companies constantly update their databases to include addresses associated with sanctioned entities. KuCoin had access to this data. The industry standard requires exchanges to screen deposits against these databases in real-time.
By failing to use these available tools, KuCoin engaged in what prosecutors describe as willful blindness. The exchange chose not to look, preserving the plausible deniability of its executives while profiting from the trading fees generated by these illicit flows. This decision was not a passive omission an active operational choice to forgo the costs and friction of compliance. The result was a platform that functioned as a safe harbor for funds the U. S. government had explicitly as a threat to national security.
| Date | Event | KuCoin Status |
|---|---|---|
| August 8, 2022 | OFAC sanctions Tornado Cash. | No mandatory KYC. Deposits accepted. |
| August 2022, July 2023 | KuCoin receives Tornado Cash funds. | No mandatory KYC. No blocking. |
| July 2023 | KuCoin implements KYC for new users. | Existing users (including illicit ones) remain unverified. |
| November 2023 | End of indictment period for this charge. | $3. 2 million confirmed laundered. |
The Lazarus Connection and National Security
The of the $3. 2 million figure increases when considering the primary users of Tornado Cash. The Lazarus Group used the mixer to launder hundreds of millions of dollars stolen in high-profile hacks, such as the Ronin exploit. While the indictment does not explicitly state that the entire $3. 2 million processed by KuCoin belonged to North Korean operatives, the risk was absolute. By leaving the door open to Tornado Cash, KuCoin knowingly exposed the U. S. financial system to the proceeds of state-sponsored cybercrime.
This connection moves the offense beyond simple financial crime into the territory of national security risk. The funds laundered through Tornado Cash support the weapons programs and strategic objectives of the North Korean regime. KuCoin’s failure to block these transactions provided material support to these efforts, yet indirect. The DOJ’s focus on this specific $3. 2 million sum highlights the direct line between lax exchange compliance and the geopolitical consequences of unchecked crypto laundering.
Operational Negligence vs. Strategic Intent
Defense arguments might frame these transactions as the result of technical limitations or the difficulty of tracking “indirect” transfers. The evidence contradicts this. The route from a Tornado Cash withdrawal to a KuCoin deposit is frequently short and detectable. “Indirect” frequently means the funds moved through one intermediary wallet before hitting the exchange, a pattern known as “hopping.” Basic AML software detects this behavior easily.
The indictment suggests that KuCoin’s executives, Chun Gan and Ke Tang, understood the source of their volume. The platform’s marketing strategies, which emphasized anonymity and the absence of KYC, attracted exactly the type of user who requires a mixer like Tornado Cash. The $3. 2 million inflow was not an accident; it was the predictable result of a business plan designed to capture the market segment that regulated exchanges had rejected.
In the broader context of the $9 billion money laundering charge, $3. 2 million appears small. Yet, it serves as the “smoking gun” for sanctions evasion. It proves that KuCoin’s systems were permeable to the most toxic assets in the cryptocurrency ecosystem. The exchange did not just fail to stop money laundering in the abstract; it failed to stop specific, named, and sanctioned entities from using its services to access the global financial network.
Regulatory Ghosting: Willful Failure to Register with FinCEN and CFTC
Systemic Blindness: The Refusal to File Suspicious Activity Reports (SARs)
widespread Blindness: The Refusal to File Suspicious Activity Reports (SARs)
The most damning metric in the Department of Justice’s indictment against KuCoin is the number zero. Between its founding in 2017 and 2023, even with processing over $9 billion in suspicious and criminally derived proceeds, KuCoin filed exactly zero Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN). This was not a clerical error or a resource absence; it was a deliberate operational strategy. By refusing to file SARs, KuCoin blinded U. S. law enforcement to a massive river of illicit capital flowing through its servers, prioritizing market share over national security.
The “Zero Reports” Policy
Under the Bank Secrecy Act (BSA), financial institutions operating in the United States must file a SAR for any transaction involving at least $5, 000 that the institution suspects involves funds from illegal activity. For a global exchange with over 30 million customers and billions in daily trading volume, a compliant program would generate thousands of such reports annually. KuCoin’s total absence of filings stands as a statistical impossibility for any legitimate exchange of its size. The indictment reveals that this silence was engineered. To file a SAR, an institution must acknowledge it has a customer to report. KuCoin’s leadership, specifically Chun Gan and Ke Tang, understood that filing a single SAR for a U. S.-based customer would shatter their carefully constructed lie that the exchange did not serve American users. Consequently, the compliance team, to the extent one existed, was functionally prohibited from alerting authorities to even the most egregious financial crimes. The “no-KYC” protocol acted as a firewall, ensuring that no customer identity could be verified, and therefore, no suspicious activity could be officially attributed to a specific individual in a government report.
The Canadian Precedent: Quantifying the Negligence
While the U. S. indictment focuses on the total absence of reports, parallel regulatory actions in Canada provide a concrete window into the of KuCoin’s negligence. The Financial Transactions and Reports Analysis Centre of Canada (FinTRAC) imposed a CAD $19. 5 million penalty on KuCoin for similar failures. FinTRAC auditors identified exactly 2, 952 specific transactions of CAD $10, 000 or more that went unreported. also, they 33 specific instances where KuCoin failed to file a suspicious transaction report even with “clear signs of chance money laundering or terrorist financing.” These figures destroy any defense that KuCoin was “unaware” of the activity. The transactions were visible on their ledger. The patterns were detectable. The failure to report was a choice to ignore the data. If the Canadian operations alone missed nearly 3, 000 reportable events, the global volume of unreported suspicious activity likely numbers in the tens of thousands of transactions.
Ignoring the Red Flags: Tornado Cash and Darknet Markets
The refusal to file SARs meant that KuCoin became a safe haven for funds that other exchanges would have flagged and frozen. The DOJ investigation identified that KuCoin received approximately $3. 2 million directly from Tornado Cash, a cryptocurrency mixer sanctioned by the U. S. Treasury’s Office of Foreign Assets Control (OFAC) for its role in laundering stolen crypto assets, including those stolen by North Korean state-sponsored hackers. A compliant exchange would have immediately flagged these incoming deposits. The blockchain transparency of Tornado Cash transactions makes them trivial to identify with basic screening software. KuCoin’s systems, yet, accepted these funds without a whisper to FinCEN. The indictment further details that KuCoin processed millions in proceeds from darknet markets, ransomware schemes, and fraud rings. These were not sophisticated, obfuscated transfers; they were frequently direct deposits from known criminal wallets. By maintaining a policy of silence, KuCoin acted as a fencing operation for the digital age, converting dirty crypto into clean assets for criminals who knew the exchange would never call the police.
The Customer Support “Loophole”
The culture of non-reporting extended to the customer support teams, who were instructed to actively assist users in evading detection. The indictment cites a “humorous anecdote” that grimly illustrates this widespread failure. When a user complained on social media that they were unable to complete the “optional” KYC process because they were in the United States, a KuCoin representative publicly replied that “users from the USA is not supported for KYC service” and assured them, “Rest assured that you are not obliged to do KYC on KuCoin.” When the customer, sending screenshots of KuCoin’s own posts advertising this absence of KYC to prove a point, the exchange simply deleted the user’s account. The user then registered a new account with a different email address and continued trading immediately. This interaction demonstrates that KuCoin’s “compliance” was not just passive actively hostile to the concept of regulation. The goal was not to identify suspicious actors to silence anyone who pointed out the platform’s obvious violations.
Regulatory Ghosting
The refusal to file SARs was part of a broader strategy of “regulatory ghosting.” KuCoin did not just fail to report transactions; it failed to exist in the eyes of the regulator. By not registering as a money transmitting business with FinCEN or as a futures commission merchant with the CFTC, KuCoin attempted to remove itself from the jurisdiction where SARs are required. This legalistic sleight of hand failed because the test for BSA compliance is based on activity, not registration. If you do business in the U. S., you must file SARs. KuCoin’s internal data showed substantial U. S. traffic, IP addresses, login times, and support tickets all pointed to a massive American user base. The executives saw this data. They knew the law. They chose to process the transactions and bury the reports.
| Metric | Statistic | Context |
|---|---|---|
| SARs Filed (2017-2023) | 0 | Total number of reports sent to FinCEN even with $9B+ in illicit flow. |
| Illicit Volume | $9, 000, 000, 000+ | Total suspicious and criminal proceeds processed. |
| Tornado Cash Exposure | $3, 200, 000 | Direct receipts from a sanctioned mixer, never reported. |
| Canadian Unreported Tx | 2, 952 | Large transactions (>CAD $10k) missed in Canada alone. |
The “zero SARs” statistic is the clearest evidence of criminal intent in the KuCoin case. It proves that the money laundering on the platform was not a bug, a feature. The exchange sold anonymity to criminals, and the price of that product was the widespread suppression of suspicious activity reports.
The Guilty Plea: Peken Global's Admission and $300 Million Penalty
The Mechanics of the Plea
Peken Global’s guilty plea represents a total capitulation to the Department of Justice’s charges. The plea agreement specifically targeted the entity responsible for the exchange’s core operations, bypassing the complex web of shell companies KuCoin used to obfuscate ownership. In federal court, Peken Global admitted that from September 2019 through the indictment in 2024, it willfully failed to implement an anti-money laundering program. The admission confirmed that KuCoin’s leadership knew they served over 1. 5 million U. S. customers yet refused to collect basic identity documents. The “no-KYC” policy, which the exchange marketed as a feature to privacy-focused traders, was legally classified as a method for sanctions evasion and money laundering. Prosecutors established that this failure allowed the exchange to process over $9 billion in suspicious transactions, including proceeds from ransomware gangs, darknet markets, and fraud schemes.
Financial Penalties and Forfeiture
The financial terms of the resolution totaled approximately $300 million, a figure derived from the illicit profits KuCoin generated from U. S. users. The penalty structure was divided into criminal forfeiture and fines, designed to strip the company of the economic advantage it gained through non-compliance.
| Component | Amount | Purpose |
|---|---|---|
| Criminal Forfeiture | $184. 5 Million | Disgorgement of fees earned from U. S. customers between 2017 and 2024. |
| Criminal Fine | $112. 9 Million | Punitive measure for willful violation of the Bank Secrecy Act. |
| Founders’ Forfeiture | $5. 4 Million ($2. 7M each) | Personal disgorgement from founders Chun Gan and Ke Tang. |
| Total Penalty | ~$302. 8 Million | Combined financial impact on the entity and its founders. |
The $184. 5 million forfeiture is particularly damning. It represents the exact amount of revenue KuCoin extracted from the U. S. market, a market it claimed it did not serve. This figure serves as a verified metric of the “shadow user base” discussed in previous sections. By agreeing to this amount, Peken Global legally validated the DOJ’s assessment of its U. S. penetration.
Decapitation of Leadership
While Peken Global pleaded guilty, the architects of the scheme, founders Chun Gan and Ke Tang, avoided immediate incarceration through Deferred Prosecution Agreements (DPAs). yet, the terms of these agreements decapitated the company’s original leadership structure. Both founders were required to resign immediately from all management positions and are permanently barred from directing KuCoin’s operations. This removal addresses the “culture of non-compliance” by prosecutors. Evidence showed that Gan and Tang were personally involved in decisions to bypass AML controls. Their ouster is not symbolic; it forces the exchange to operate under entirely new governance, theoretically severed from the aggressive risk-taking that defined its early years. The DPAs remain in force for two years, during which any violation of the agreement’s terms could trigger prosecution on the original charges.
The U. S. Market Exit
Beyond the monetary fines, the plea agreement imposed a mandatory exit from the United States. KuCoin agreed to shut down all operations for U. S.-based accounts and block future access for a minimum of two years. This provision enforces what the exchange previously claimed to do failed to execute: a complete geofencing of the American market. This forced withdrawal creates a verified vacuum in KuCoin’s liquidity. With 1. 5 million users removed, representing a massive portion of its trading volume, the exchange faces a contraction in its global relevance. The agreement mandates rigorous monitoring to ensure this exit is genuine, preventing the use of VPNs or other workarounds that KuCoin previously ignored.
Admissions of widespread Failure
The Statement of Facts accompanying the plea deal contains specific admissions that validate the “widespread Blindness” angle of this investigation. Peken Global admitted that until July 2023, it did not require customers to provide any identifying information. Even after notified of the federal investigation, the exchange only applied KYC checks to *new* customers, leaving millions of existing accounts unverified. The company also admitted to never filing a Suspicious Activity Report (SAR) during the indictment period. This admission is legally significant. In the world of financial compliance, filing zero SARs while processing billions in volume is statistically impossible for a legitimate business. It serves as irrefutable proof that the compliance program was nonexistent. The resolution of the KuCoin case follows a trajectory similar to actions against other offshore exchanges, yet the specific admission of “willful failure” distinguishes it. Unlike entities that claimed negligence, Peken Global’s plea confirms that the violation of the Bank Secrecy Act was a core component of its business model. The $300 million penalty, while smaller than the multi-billion dollar fines levied against larger competitors, represents a near-total disgorgement of the profit derived from the crime, setting a precedent that illicit gains be clawed back in their entirety.
