House Committee Says Webull Messages Point to China Access to U.S. Customer Data
The House Select Committee on China says internal messages from online investing platform Webull suggest a company employee located in China had access to information about a U.S. customer account, contradicting the firm's repeated assurances that such access is restricted to U.S.-based personnel. The messages, which CNBC exclusively obtained from the committee, date to 2021 and were exchanged on Microsoft Teams between Brendan Fuller, a manager at Webull's U.S. brokerage, and an employee named Zhenghan Wang, nicknamed "Rock." In one exchange about a U.S. customer account, Fuller said the account was previously approved by "one China team member and one U.S. team," adding, "I think we just approve them all no matter what..." Wang asked who approved the account in question. The committee concluded Wang was likely in China at the time, citing message timestamps indicating daytime working hours there and other evidence. A committee spokesperson told CNBC: "All the evidence in these text messages points to Zhenghan Wang, a Webull employee, being located in China with access to U.S. customer data at the time he worked for the company."
At the time of the report, Webull told CNBC in a statement that "U.S. customer data is stored in the U.S. and access to sensitive customer data is controlled by the U.S." A Webull spokesperson added that U.S. customer data is stored only in the U.S. on AWS servers in Virginia and Oregon, with access to sensitive data restricted to U.S.-based employees; U.S. broker-dealer operations are directed exclusively by U.S.-based personnel, and no individuals based outside the U.S. have ever exercised operational or decision-making authority over Webull's U.S. broker-dealer business. The committee responded that its finding concerns "who can reach the data and the systems that process it," not where data is stored. The report also found that Webull affiliate Webull Technologies Limited previously used Tencent Cloud, a China-based provider, to host certain user data; Webull has not said what data Tencent hosted or when that ended.
The committee's Oct. 7 report, "Free Trades, Hidden Ties: Exposing Webull's China Links," argued that Webull's corporate structure means the firm's "software development, data pipelines, and core engineering operations" are dependent on infrastructure directly subject to Beijing's laws, which can compel firms to cooperate with the government, including mandating data transfers. The committee said the company initially told it it "does not have any offices or employees based in the PRC" and that "all Firm employees are located in the United States," but the firm remains operationally concentrated in China, with mainland subsidiary Hunan Weibu growing to 863 employees, or 62% of the company's global workforce. The committee said Webull holds $24.6 billion in customer assets and warned that security concerns intensified after October 2025, when Webull started holding customer cash on its own balance sheet, a development it described as a "structural exposure of billions of dollars in American capital." Rep. John Moolenaar, R-Mich., who chairs the committee, said Webull's "China-based operations put American investors and their data at risk."
The committee said Webull's practices exposed American investors' data to surveillance risks in China. Webull stock slid more than 19% after the Oct. 7 report, falling 19.1% on the day to close at $5.89. Robbins LLP and Kaplan Fox & Kilsheimer LLP have filed a securities fraud class action on behalf of investors who purchased Webull Class A ordinary shares between April 26, 2025 and October 6, 2026, alleging Webull falsely marketed itself as a U.S.-based company and claimed customer data was isolated from non-U.S. access; Robbins reminded investors of a lead plaintiff deadline of December 7, 2026.
The latest finding builds on the committee's Oct. 7 report, while Webull has called that report inaccurate. Investigations, litigation, and company statements are expected to proceed in parallel, with attention on any further hearings, regulatory steps, and whether Webull discloses what data Tencent Cloud hosted and when. The committee's press release, "The Facts on Webull's Ties to China," remains available on its website.