Star Xu Says OKX Faces APT Attacks Monthly After $6.3B Binance Hack

Star Xu Responds on X to a Binance User

OKX founder Star Xu said on Sunday that his platform detects and counters advanced persistent threat (APT) attacks every month. He was reassuring a trader who moved funds off Binance after a hack worth roughly $6.3 billion. An Aptos (APT) attack, in plain terms, is an intrusion in which an adversary sits inside a target's systems quietly and keeps working, rather than striking once and leaving. For a custodial platform the target is rarely the chain itself; it is the staff, the keys, the vendors and the workflows around them. The trader, who laid out his position in a post on X, wrote that he only entered the market in 2023 and 2024, yet had already lived through breaches at Bybit, Gate, Bitget and Binance. Binance cut deepest, because 80% of his assets sat there, and eight hours before the theft he had been consolidating balances from other venues into it. On Sunday he applied the eggs-in-one-basket rule and split part of the stack over to OKX, while worrying aloud that OKX, the only major venue untouched by a breach in two years, would draw the next strike. He tagged OKX executives, asked them to re-audit their hot wallets, permission controls, supply chain and internal processes, and told other traders that spreading holdings, plus keeping a slice in self-custody, is what actual risk management looks like. That advice, offered in public, turned one customer's loss into a template other holders could copy. Xu's answer, posted on the evening of November 1, was short: thank you for the trust, OKX will not fail it.

In his public reply on X, Xu went beyond pleasantries and described how OKX runs its defense. He called security and the protection of customer assets the company's “first lifeline”, and credited 13 years of accumulated security systems, technical capability and operational experience with keeping OKX steady under complex threats. The most concrete disclosure came next: more than a year ago, OKX started running automated penetration testing built on large language models, which he said improves the depth, breadth and efficiency of security testing. Penetration testing means running controlled attacks against your own systems to find the openings before an adversary does; automating it with models lets those attacks run far more often than scheduled rounds allow. He paired the disclosure with a warning: security, he wrote, never has an endpoint, and past results are no reason for complacency. In light of the recent incidents at peers, he added, OKX will carry out a full round of self-inspection and keep refining its defenses, because protecting customer assets is the line the company never compromises. A monthly cadence of detected Aptos (APT) attempts is itself a data point: it describes a constant, low-grade siege rather than isolated events, and it frames the $6.3 billion Binance loss as one visible spike on a longer curve. The reassurance also lands on a crypto exchange sector that has absorbed repeated blows over the same three years the trader catalogued. Every name on that list was hacked, by the user's own account, which is why a founder quoting a monthly attack count reads as routine reporting rather than alarm. The source of the fear was receding, though: from the afternoon of November 1, Binance progressively restored bitcoin withdrawals along with USDT and USDC, and said it had already replenished about 95% of the affected amounts. Binance directs users to a dedicated incident page for the remaining withdrawal schedule and compensation details.

The APT Playbook Across Exchanges

The practical read is behavioral as much as technical. One trader's 80% concentration was a private choice until a public failure repriced it. That fits the cadence Xu described: Aptos (APT) pressure arriving monthly means defense is continuous, and automation like LLM-driven penetration testing is how a platform keeps pace without scaling headcount. What might have stayed as FUD on a timeline became fund movements within a day. Nor is the perimeter problem exclusive to custodial platforms: a recent campaign hijacked the domain registrar Name.com and let attackers drain $138,000 from 12 DeFi sites. Within the exchange class, the sources scope the risk to hot wallets, permissions, supply chains and internal process, the exact surfaces the trader asked OKX to re-audit.