The cryptocurrency exchange OKEx does not rely on a single-signature cold Bitcoin wallet. Company representatives said the allegations were unfounded, which had previously appeared on one of China’s news portals, according to DeCrypt.
On October 16, OKEx announced a withdrawal halt. Initially it was reported that the private-key holder was not responding. Subsequently Chinese media reported that it could be Star Xu. A company spokesperson disputed the information, noting that the founder of OKEx is not a key holder. More at link.
Against this backdrop, the news of the use of a single signature, noticed and disseminated by Sino Global Capital chief Matthew Graham, attracted heightened interest. However, later the original source removed this information. The post on Twitter, and Graham’s, were deleted with apologies for the FUD.
I’m deleting this tweet because it may be photoshopped, I’m sorry about the FUD https://t.co/Szs4luBUgM
— Matthew Graham (@mattysino) October 29, 2020
Representatives of the exchange told the publication that they are not authorised to disclose “any information that could pose a threat to clients’ funds.” Regarding the single-signature cold Bitcoin wallet, they recommended studying the report on 51% attacks on Ethereum Classic in August. It details the scheme for withdrawing funds using a “semi-offline” multi-signature for hot wallets.
The report states that 95% of funds are stored in cold wallets. In the security section, it mentions the use of Advanced Encryption Standard (AES) when generating private keys. They “are controlled by two employees – one at the OKEx Beijing office and another in one of the cities on the West Coast of the United States”.
The withdrawal is performed as follows:
- An employee retrieves the corresponding number of unused encrypted private keys from a bank vault near the office;
- They scan the keys’ QR codes on two separate offline computers;
- The holder of the AES master password decrypts the private key on a fully air-gapped computer;
- The QR code is scanned on another air-gapped computer;
- The transaction is signed on yet another computer offline;
- The transaction signature is transferred to the online computer via a USB drive.
As of writing, it remains unclear when withdrawals will resume.
As reported earlier, blockchain developer Zulu Republic, in collaboration with liquidity provider Alameda Research and the Whalepool trader community proposed institutional withdrawal service for OKEx.
Subscribe to ForkLog news on Facebook!