ZachXBT Accuses KuCoin of Enabling $13M in Laundering

High attention and emotional sentiment detected.

The KuCoin poll asked users a simple question: 10x your portfolio in 30 days, or steadily 5x over 12 months? ZachXBT chose neither. Instead, he asked why KuCoin let a threat actor move $9.5 million through 150+ deposit addresses in one week.

Fake Ledger App Drains $9.5 Million

According to ZachXBT’s community alert, a fake Ledger Live app appeared on the Apple App Store. It drained more than $9.5 million from over 50 victims between April 7 and 13.

The app mimicked the legitimate Ledger wallet interface. It carried convincing branding and a 3.2-star rating. Victims lost funds across five chains: Bitcoin, Tron, Ethereum, Solana, and Ripple.

The stolen assets then moved through 150+ KuCoin deposit addresses. Those addresses were linked to AudiA6, a centralized mixing service. AudiA6 has appeared in multiple prior ZachXBT investigations.

AudiA6 functions as a laundering endpoint. It accepts illicit deposits and returns cleaned tokens through layered addresses. ZachXBT’s prior reports connect it to ransomware and scam proceeds.

Bitcoin Depot Funds Also Hit KuCoin

ZachXBT also referenced a separate theft. Roughly $3.5 million in stolen bitcoin from the Bitcoin Depot case reportedly moved through 25+ KuCoin deposit addresses. That movement occurred in the days before the Ledger wave.

Community replies added more examples. One wallet allegedly deposited nearly 100 BTC from scam proceeds. Across both incidents, more than $13 million flowed through KuCoin in a compressed timeframe.

Src: ZachXBT

KuCoin Responds With Standard Support Reply

KuCoin’s official account replied later on April 14. It posted a generic customer support message asking ZachXBT to share his UID and ticket number.

ZachXBT mocked the response. He posted a screenshot criticizing the exchange’s KYC process and tagged investigator @inversebrah. As of April 15, KuCoin has not addressed the specific KuCoin laundering claims publicly.

KuCoin’s Regulatory History Adds Context

KuCoin has faced repeated compliance scrutiny. In 2023, the U.S. Department of Justice charged the exchange with willful AML failures. KuCoin entered a guilty plea and paid multimillion-dollar penalties.

In January 2025, the exchange paid over $300,000 in additional AML fines. It obtained a limited MiCA permit in Europe in November 2025. But Austrian regulators excluded KuCoin from new user onboarding by February 2026.

After the DOJ charges, the exchange restructured its compliance team. It also delisted from certain jurisdictions. Despite those changes, critics argue that KuCoin’s deposit systems still allow rapid fund movement with minimal friction.

How the KuCoin Laundering Flow Works

The mechanics follow a familiar pattern. Scammers deploy fake wallet apps that trick users into entering seed phrases. Once funds are drained, thieves route them to low-friction CEX deposit addresses.

Instant exchange features allow quick asset conversion without full identity checks on every leg. The AudiA6 mixer then splits and redistributes volume across hundreds of addresses. This breaks the on-chain trail.

Deposits arrive in small batches across dozens of addresses. They often fall below automated monitoring thresholds. In this case, $13 million moved fast enough to suggest either control gaps or system overload, according to ZachXBT.

What Comes Next for KuCoin

KuCoin has invited ZachXBT to submit UIDs and ticket numbers. That could trigger an internal review. But in practice, such reviews rarely produce public restitution without regulatory pressure.

Community sentiment already favors renewed boycott calls. ZachXBT’s original alert referenced the Austrian restrictions, so European regulators may take interest. If analytics firms or law enforcement confirm the flows, the case could shape global AML policy for virtual asset service providers.

ZachXBT’s track record supports his claims. His past investigations have led to arrests, protocol refunds, and policy changes at exchanges. This volume of on-chain evidence, tied to one platform in one week, is hard for regulators to dismiss.

For users, the takeaway is clear. Self-custody with legitimate tools remains the best defense against counterparty risk. When stolen funds move at this scale through major exchanges, platform trust alone is not enough.

This is not financial advice. Always do your own research before making investment decisions.