Is Bitcoin legal in Malaysia? Yes — but you can't pay for anything with it, and the mining part can get you jailed

In May 2026, Energy Commission and TNB officers walked into two houses in Kuantan during an operation called Ops Steal. Inside: bitcoin mining rigs, wired straight into the mains, bypassing the meter. Estimated theft — around RM34,000 a month per site. Over six months, that's north of RM200,000 of electricity that everyone else on the grid quietly paid for.

That's one raid. Between 2022 and May 2026, Malaysian authorities ran 3,049 of them, seized 75,578 mining machines and arrested 629 people. On a few occasions police have flattened the confiscated rigs with a steamroller in a car park, on camera, which tells you roughly how the government feels about it.

Here's the confusing part: none of that is because crypto is illegal in Malaysia. It isn't. You can legally buy Bitcoin this afternoon. The raids are about stolen electricity, which is a completely different offence that happens to be committed by people mining crypto.

That gap — between "crypto is legal" and "this specific crypto activity will get you charged" — is where most Malaysians get lost. Let's fix that.

1. Two regulators, two different answers — this is why everyone's confused

Ask "is crypto legal in Malaysia" and you get contradictory answers because two agencies are answering two different questions.

Bank Negara Malaysia governs money. BNM has said consistently that cryptocurrency is not legal tender and not a recognised payment instrument. That's why nobody at the mamak has to accept Bitcoin for your roti canai, and why no Malaysian business can be forced to price anything in crypto.

The Securities Commission governs investments. Under the Capital Markets and Services (Prescription of Securities) (Digital Currency and Digital Token) Order 2019, most digital assets are treated as securities — putting them in the same regulatory family as shares. That means exchanges need licences, token offerings need approval, and market-conduct rules apply.

So the correct answer isn't "legal" or "illegal". It's: crypto is a regulated investment product, not money. Once you hold that frame, the rest of the rules stop looking random.

The practical upshot for you: you have the protections of a regulated investment market when you stay inside it, and none at all when you step outside.

2. Which exchanges are actually licensed

This is the single most useful thing on this page, because it's where money is lost.

As of the most recent SC listings, the registered Digital Asset Exchanges (RMO-DAX) operating in Malaysia are Hata Digital, Luno Malaysia, MX Global, SINEGY DAX, Kinetic DAX (formerly Tokenize) and Torum International. The SC has approved a defined list of tradeable tokens — around 23 — including BTC, ETH, XRP, SOL and ADA, with several confirmed Shariah-compliant by the SC's Shariah Advisory Council.

That list changes. Check sc.com.my before you deposit anything, not a blog post — including this one.

Two things people get wrong here:

Using an unlicensed overseas platform isn't itself a criminal offence for you as a retail user. Plenty of Malaysians hold accounts on global exchanges. What you lose is protection: if withdrawals freeze, if the platform vanishes, if the "profits" on your dashboard turn out to be numbers on a screen, there is no Malaysian regulator with jurisdiction to help you. You are, functionally, on your own.

Clone scams are the current plague. The SC has flagged fake entities impersonating real licensed firms — in March 2026 it named potential clones of Hata Digital and Mercury Securities specifically. The scam works because you did check the name. You just landed on the wrong website. Type the URL yourself; never follow a link from WhatsApp or Telegram.

The SC keeps a public Investor Alert List of unlicensed operators, updated close to monthly. Being on it isn't proof of fraud — it means no Malaysian licence, so any dispute is yours alone to solve.

3. The scam numbers are worse than you think

Malaysians lost RM1.47 billion to investment scams in 2025, across 9,603 police cases — up from RM848.62 million and 6,337 cases the year before. Losses nearly doubled in a year. Most victims are between 31 and 50, which should retire the idea that this only happens to confused pakciks.

Bogus crypto platforms sit among the five dominant fraud methods police identify, alongside clone companies, Ponzi structures, quick-return promises and love scams.

The pattern is consistent enough to memorise:

1. Someone new contacts you — dating app, Facebook, a "wrong number" WhatsApp that turns friendly.
2. Weeks of ordinary conversation. No money mentioned.
3. Eventually, an investment. Usually crypto, always on an app they recommend.
4. Your dashboard shows gains. You're encouraged to start small.
5. You withdraw a little successfully. This is the hook, not proof.
6. You put in more — often everything.
7. Withdrawals freeze. To release funds you must pay "tax", "fees", a "top-up". Each payment triggers another.

Then the second scam arrives: someone offering to recover your losses for an upfront fee, often impersonating the NSRC or NFCC with fabricated appointment letters. PDRM has warned about this repeatedly, most recently in April 2026.

The rule that protects you: no legitimate agency charges an upfront fee to recover scammed money. Not NSRC, not NFCC, not PDRM, not the SC, not BNM. None of them will cold-call or WhatsApp you offering paid recovery.

If you've been scammed, call the National Scam Response Centre on 997 as fast as possible — the first hours matter most for freezing transfers — and lodge a police report.

4. Tax: the "no capital gains tax" thing has a trapdoor

Malaysia has no capital gains tax on individuals, so people assume crypto profits are free money. Sometimes true. Sometimes an expensive misunderstanding.

LHDN applies the badges of trade — a long-standing test for whether you're behaving like an investor or running a business. Frequency of transactions, profit motive, holding period, how you financed it, and so on.

Roughly:

• Bought BTC in 2019, forgot your password, sold in 2026 → looks like investment. Generally not taxable.
• Flipping altcoins weekly, treating it as income → looks like a trade. Taxable as business income, at rates up to 30%.

There's no bright line and LHDN decides based on your actual pattern, not what you call yourself.

Mining and staking rewards are a different animal — those are generally treated as income when received, not capital.

What people don't realise: LHDN can see the local exchanges. It has data-sharing arrangements with licensed Malaysian platforms, and in June 2024 ran Ops Token specifically to identify undeclared digital asset activity. If you're trading on Luno or MX Global, your activity isn't invisible.

Keep records — dates, amounts, RM value at the time of each transaction. Not because we enjoy admin, but because without records LHDN can't tell your capital gains from your trading income, and the default assumption won't favour you.

5. Mining: legal in principle, prosecuted in practice

Mining crypto is not illegal in Malaysia. Stealing the electricity to do it very much is.

And it's stolen at scale. TNB has attributed roughly RM4.57 billion in losses over five years to illegal power use at crypto mining premises, with the Deputy Energy Minister putting the annual figure around RM700 million. Some 14,000 illegal mining sites were uncovered across five years.

The charging provision is section 37(3) of the Electricity Supply Act 1990:

• Domestic offenders: fine of RM1,000 to RM50,000, up to a year's jail, or both.
• Non-domestic offenders: fine of RM20,000 to RM1 million, up to five years' jail, or both.

Note the gap between those tiers. Run rigs out of a shoplot and you're in the RM1 million bracket.

The part every landlord needs to read. The Deputy Minister's advice after Ops Steal was blunt: transfer the TNB account into your tenant's name, so that electricity offences attach to the actual user. If the account is still in your name and your tenant wires a mining farm into the mains, the trail starts at you. TNB has also built an internal database of landlords and tenants linked to suspected theft.

There's a safety dimension too, not just a legal one. These are unlicensed cable connections that don't meet Energy Commission standards — a real fire and electrocution risk in a residential building. If you're renting out property, an unexplained surge in equipment, constant fan noise, or a tenant who won't let you inspect is worth taking seriously.

6. Can you actually pay for things with crypto here?

Not in any protected sense.

Because crypto isn't legal tender, no merchant is obliged to accept it and no one can be compelled to settle a debt in it. Some businesses do accept crypto voluntarily, but that's a private arrangement — and if the transaction goes wrong, you're outside the consumer protections that apply to ringgit payments.

Anything ringgit-pegged is still in development. BNM runs a Digital Asset Innovation Hub sandbox for tokenisation and stablecoin experiments, but a regulated ringgit stablecoin isn't live for public use.

Practical translation: treat crypto in Malaysia as an asset you hold, not a currency you spend.

What to actually do

• Before depositing anywhere: check the SC's registered DAX list and the Investor Alert List at sc.com.my. Type the address yourself.
• Never invest through an app introduced by someone you met online, no matter how long you've been talking.
• Treat a small successful withdrawal as bait, not proof.
• Keep transaction records with RM values at the time — for at least seven years.
• If you trade actively, assume LHDN may treat it as business income and plan for it.
• Landlords: put the TNB account in your tenant's name.
• Scammed? NSRC 997, immediately, then a police report. Speed matters.
• Never pay anyone who promises to recover your lost money.