A swift examination of OKX users’ security settings has revealed vulnerabilities that could lead to financial losses in the event of a potential attack. This research was conducted by a group of Web3 security enthusiasts.
看到近期发生的几起 OKX 用户安全事件，作为普通用户，我们对攻击发生的原因充满好奇，于是尝试花了半个小时对 OKX 的用户安全设置做了一遍快速分析，结果让人非常意外。
注：本次分析的实施时间为新加坡时间2024年6月10日下午5点。
— Dilation Effect 膨胀效应 (@dilationeffect) June 10, 2024
The analysts conducted their review on June 10, 2024, spending half an hour on the task. During this time, they discovered that the system allows users to bypass Google Authenticator and switch to less secure verification methods (SMS, whitelisting addresses, etc.).
User actions such as disabling phone verification, Google Authenticator, and changing passwords do not trigger a 24-hour withdrawal freeze. The restriction only activates when logging in from a new device, according to the report.
When withdrawing assets from whitelisted addresses, dynamic checks based on the amount are not employed. Researchers cite other exchanges that set limits requiring re-verification for large withdrawals.
“These issues were identified through a quick analysis. It is evident that OKX’s security settings lack basic design. Perhaps, to enhance user experience, [the exchange] has made numerous compromises in security,” the report’s authors speculated.
Previously, journalist Colin Wu reported on an OKX client who lost over $2 million through AI manipulation.
Earlier in June, CISO of SlowMist, known as 23pds, presented a ranking of reasons why individual and institutional investors lose their digital assets.
The thread followed a detailed analysis of an incident where a trader lost $1 million in cryptocurrency on Binance due to a malicious Chrome browser extension, although the user blamed the exchange.
Binance co-founder Yi He denied the platform’s responsibility for the incident. She noted that the hacker manipulated the trader’s device through a plugin, and the exchange team could not influence the situation.