Massive Withdrawals Hit OKX Amid Security Flaws and SIM-Swap Attacks

• OKX has recently witnessed heavy outflows, with $204 million exiting the platform in the last 24 hours and a staggering $630 million over the past week, outpacing withdrawals seen at other leading crypto exchanges.
• The increased withdrawals seem to stem from a succession of security issues that have likely shaken user confidence.
• A critical flaw in OKX’s two-factor authentication (2FA) security system has been highlighted, along with similar security lapses that further erode trust.

OKX is facing massive outflows due to security flaws, withdrawing $204 million in just a day and $630 million this week, alarming users and jeopardizing the exchange’s credibility.

Security Vulnerabilities in OKX’s Systems

On June 9, two users of OKX fell victim to a suspected SIM-swapping attack, leading to substantial financial losses. The attack exploited a weakness in the exchange’s 2FA security, allowing unauthorized access to the victims’ accounts.

Yu Xian, the founder of blockchain security company SlowMist, reported that the victims received SMS risk notifications from Hong Kong just prior to the creation of a new API key for their account, which exposed the vulnerability.

Security firm Dilation Effect also verified this weakness, noting that OKX, despite encouraging users to bind their accounts to Google Authenticator for enhanced security, permits a switch to less secure verification methods during critical operations, bypassing the more secure GA verification.

Additionally, when users perform sensitive tasks like disabling phone-based GA verification or changing their login password, the usual 24-hour withdrawal ban is not activated unless the password change is executed from a new device.

Dilation Effect further observed that withdrawals to whitelisted addresses on OKX do not require dynamic verification based on withdrawal amounts, allowing unlimited transactions within the set limit without additional checks. This contrasts with other exchanges that impose withdrawal limits and require re-verification upon exceeding those limits.

It appears that the platform’s security settings lack foundational integrity and have been compromised to presumably enhance user experience, placing user funds at risk.

OKX’s Response and Measures

In response to the security breaches, including incidents where malicious actors used artificial intelligence to create fake videos for hacking attempts, OKX has started an investigation and reached out to the affected users. The exchange also encouraged its clients to enable full two-factor authentication to fortify their account security. However, these measures have not entirely mitigated the security concerns, leading to users withdrawing their assets en masse in search of more secure alternatives.

Conclusion

To summarize, OKX’s reputation has been substantially affected by serious security vulnerabilities. The exchange’s inability to address these issues promptly has led to large-scale withdrawals and heightened suspicion among users. For OKX to restore confidence and prevent further outflows, it must prioritize overhauling its security infrastructure and demonstrate a commitment to safeguarding user assets.