Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The reported text saying “Your trading pin is expiring” and directing recipients to kucoin-pin.com should be treated as phishing. Do not open the link, reply, or enter a password or verification code. The message was reported in 2022; it is not proof of a newly launched 2026 campaign, and the available evidence does not independently confirm a formal investigation into that exact SMS.
The SMS users reported
A KuCoin subreddit thread in July–August 2022 reproduced this message:
“[KuCoin] Alert! Your trading pin is expiring. Please visit kucoin-pin.com to update your trading pin.”
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
The report identifies kucoin-pin.com as the destination. That domain is included here only so readers can recognize the scam; do not visit it. A Pinterest page preserved the “being looked into” wording, but the available sources do not establish who operated the domain, how many people were affected, or whether KuCoin opened a formal investigation.
#1 Best Overall
KuCoin’s broader warnings remain relevant. On April 9, 2024, it warned that scammers use SMS, email and private messages to distribute phishing links: KuCoin’s phishing warning.
Why the message is suspicious
- It creates urgency. An alleged expiring security credential pressures you to act before checking independently.
- The link is not KuCoin’s official domain. KuCoin’s official website is kucoin.com. A domain containing “KuCoin” is not automatically owned by the exchange.
- It bypasses the normal account flow. An unsolicited text asks you to change a credential through a supplied link instead of the official app or a manually opened website.
- Sender information is weak evidence. A familiar sender name, phone number or existing SMS thread can be spoofed, misrouted or abused.
- HTTPS would not make it genuine. Phishing sites can also use encrypted HTTPS connections, and shortened links can hide redirects.
“Trading PIN” versus KuCoin’s trading password
KuCoin’s current Help Center uses the term trading password for the credential used to verify transactions. The scam’s “trading pin” wording may be informal or chosen to sound credible. KuCoin does have a transaction-verification credential, but that does not make an unsolicited SMS directing you to a third-party-looking domain legitimate. Current terminology is available in the KuCoin Help Center.
Does KuCoin require an SMS link to renew it?
The available evidence does not establish that this reported message was an official KuCoin notice. KuCoin instead tells users to access the official website directly, check suspicious contacts and domains through its Official Verification Center, and avoid disclosing passwords or two-factor authentication details. If an account action is genuinely required, open the official app, type kucoin.com yourself or use a trusted bookmark, then check the account there. Do not assume that every KuCoin SMS is fake, but never rely on an unexpected SMS link for a sensitive change.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
What a phishing page may try to collect
A look-alike page may request a username, login password, trading password, SMS code, email code or two-factor authentication code. Attackers can combine those details to access an account, attempt withdrawals or change security settings. A page may also collect personal information, request permissions or offer a malicious download. KuCoin describes this type of impersonation in its security notice, and the FTC warns that unexpected texts can lead to sites seeking personal or financial information: FTC guidance on unexpected texts. Merely viewing a page does not guarantee theft; the risk depends on what you entered, downloaded or authorized.
What to do based on what happened
If you did not click
- Do not click, reply or call a number in the message.
- Open KuCoin only through the official app, a trusted bookmark or a manually typed kucoin.com.
- Review security settings, recent logins and account activity.
- Use your phone’s report-junk function and delete the text.
- In the United States, forward it to 7726 (SPAM) and report it to the FTC.
The FTC’s reporting and no-response advice is at consumer.ftc.gov.
If you clicked but entered nothing
- Close the page and do not install files or grant permissions it offered.
- Update the device and browser.
- Run the device’s security scan, especially if a download or permission prompt appeared.
- From the official KuCoin app or website, review sessions and security activity.
- If you are uncertain, change the KuCoin login and trading passwords and contact official support.
The FTC explains post-click precautions in its phishing-link guidance. KuCoin’s instructions for visitors to phishing sites are at KuCoin’s prevention guide.
If you entered a password or trading password
- Stop using the suspicious site.
- On a clean, trusted device, change the KuCoin login password and trading password.
- Change the password for the email account linked to KuCoin.
- Revoke unfamiliar sessions, devices, API keys and withdrawal addresses where the official interface allows it.
- Replace compromised authentication methods and contact KuCoin through its Help Center.
- Review withdrawals, deposits, trades and account changes, and preserve the text, URL, screenshots and timestamps.
If you entered an SMS, email or two-factor code
Treat this as urgent. Such a code may authorize a login, password reset, withdrawal-address change or another account action. Change credentials from a trusted device, contact KuCoin immediately and request an account freeze if unauthorized activity is possible.
If funds have already moved
- Contact KuCoin immediately and provide transaction IDs and destination addresses.
- Notify the receiving exchange, if identifiable.
- Report the loss to the FTC and local law enforcement.
- Preserve all evidence, including wallet addresses and timestamps.
Cryptocurrency transfers may be irreversible; recovery depends on the asset, destination, timing and cooperation of the relevant platforms and authorities. Be wary of anyone promising recovery for an upfront fee or additional cryptocurrency.
How to verify a KuCoin communication safely
- Open the Official Verification Center manually, never through the suspicious text.
- Check the domain, email address or social-media contact against KuCoin’s records.
- Compare the destination with kucoin.com.
- Check your configured anti-phishing code in supported KuCoin communications.
- If anything remains unclear, submit a request through the official Help Center.
KuCoin says its anti-phishing code can appear in emails or SMS. A missing or incorrect code is a warning sign, but the feature is not a universal guarantee: it must have been configured beforehand, may vary by channel or product version, and should not replace independent access to KuCoin.
Rank #4
What is and is not established
The evidence establishes a 2022 user report of the expiring-PIN SMS and KuCoin’s continuing warnings about SMS phishing. It does not independently confirm a formal KuCoin investigation into that exact campaign, the sender’s identity, the number of victims, the amount stolen or that the campaign is active in 2026. It also does not show that KuCoin sent the message or that everyone who clicked was compromised.
How to report the message
- Use your phone’s report-spam or report-junk feature.
- U.S. mobile users can forward the text to 7726 (SPAM).
- File a report with the FTC at its unexpected-text guidance page.
- Contact KuCoin through its official Help Center, not through details in the SMS.
- If money was lost, report it to local law enforcement and retain transaction evidence.
Frequently Asked Questions
Is kucoin-pin.com an official KuCoin website?
No evidence supplied for this report identifies it as an official KuCoin domain. Treat it as a phishing destination and use kucoin.com or the official app instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
What if the text appeared in my real KuCoin SMS thread?
That still does not authenticate it. Sender IDs and message threads can be spoofed or abused; verify the domain independently.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Can KuCoin reverse a crypto withdrawal?
There is no guarantee. Cryptocurrency transfers may be irreversible, so contact KuCoin and the receiving platform immediately and provide transaction details.
How do I contact KuCoin safely?
Open kucoin.com or the official app yourself and use the Help Center. Do not use a phone number, link or reply address supplied by the suspicious text.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
