OKX Responds to MultiMillion Dollar Security Breach With Immediate Action
Cryptocurrency exchange OKX is currently investigating a major security breach in collaboration with security partner SlowMist. Unauthorized individuals managed to steal two users’ accounts through either an SMS attack or phishing on June 9.
Discovered initially by the founder of SlowMist, the breach involved the creation of a new API key with the ability to withdraw and trade funds. The amount stolen is estimated to be in the millions.
Surprisingly, the methods and characteristics of the account theft experienced by two different victims in the early hours of the day were similar. Apart from the commonalities mentioned by @AsAnEgg, there was also the shared feature of receiving a risky SMS notification purportedly from “Hong Kong” and the creation of a new API key with withdrawal and trading permissions. Currently, any suspicions of collusion seem to have been ruled out.
Despite this, SlowMist and other analysts have clarified that OKX’s two-factor authentication (2FA) was not the main vulnerability exploited in the breach. An investigation by the Web3 security group, Dilation Effect, revealed that the hackers leveraged a less secure verification process to whitelist withdrawal addresses through an SMS option.
In response to the recent security breaches, the founder of OKX has addressed the crypto community, assuring that all incidents have been resolved. He emphasized that the breaches were unrelated to Google Authenticator or SMS verification, but still recommended the use of Google Authenticator for enhanced security.
The security system on the platform, operational for over a decade, remains dependable, with OKX compensating customers for losses resulting from security lapses. Fake judicial documents were a significant factor in the breach, prompting OKX to implement a verification mechanism and enhance AI face recognition security.
New measures are being introduced to manage the expiration of authentication addresses and prevent similar incidents. Following these changes, there have been no further reports of users losing accounts or information leaks.
OKX is dedicated to enhancing its security infrastructure by advancing face recognition technology, AI, and implementing improved verification systems. Users have been assured of the safety of their funds, with OKX committed to preventing such incidents in the future to maintain customer trust in the volatile cryptocurrency market.