{"id":9949,"date":"2024-01-19T13:08:00","date_gmt":"2024-01-19T11:08:00","guid":{"rendered":"https:\/\/forklog.com\/en\/security-through-clarity-how-okx-safeguards-customers-bitcoin\/"},"modified":"2024-01-19T13:08:00","modified_gmt":"2024-01-19T11:08:00","slug":"security-through-clarity-how-okx-safeguards-customers-bitcoin","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/security-through-clarity-how-okx-safeguards-customers-bitcoin\/","title":{"rendered":"Security through clarity: how OKX safeguards customers\u2019 bitcoin"},"content":{"rendered":"

Centralised exchanges prefer to conceal how they secure customer funds, following the principle of security through obscurity<\/span>. The less an attacker knows about a platform\u2019s inner workings, the harder it is to exploit potential weaknesses.<\/p>\n

However, the OKX<\/a> team believes clients have a right to know how the platform holds their assets. Transparency is one of bitcoin\u2019s core tenets and a hallmark that sets crypto apart from TradFi<\/span>.<\/p>\n

This article outlines OKX\u2019s hot- and cold\u2011wallet system and the exchange\u2019s Proof\u2011of\u2011Reserves audits.<\/p>\n

Hot wallet<\/h2>\n

Like many crypto exchanges, OKX uses two kinds of wallets: cold (offline) and hot (online). Hot wallets are connected to the internet and therefore vulnerable to hacking, but they allow faster processing of withdrawal requests.<\/p>\n

\n

\u201cOur hot wallets hold only 5% of total assets, but they still demand close attention to security because most hacker attacks target them. When a CEX<\/span> is hacked, funds are usually stolen from hot wallets,\u201d the exchange\u2019s representatives note.<\/em><\/p>\n<\/blockquote>\n

The private keys to OKX\u2019s hot wallets are generated and encrypted on semi\u2011autonomous signing devices held by three employees in different countries.<\/p>\n

The keys have backups stored in bank safe\u2011deposit boxes in three jurisdictions. If a key holder becomes unavailable (including through death or amnesia), the exchange uses a backup within 48 hours. To defend against offline attacks, private keys are kept in device RAM rather than persistent storage.<\/p>\n

After key generation, the holders set up a semi\u2011autonomous 2\u2011of\u20113 multisignature scheme.<\/p>\n

\n

\u201cThe hot wallet monitors all user deposits on\u2011chain. A transaction to an OKX address is routed to storage, its details are recorded in a dedicated database and then into the risk\u2011management system. The latter checks the origin of funds, the amount and the transaction\u2019s blockchain confirmations,\u201d OKX comments.<\/em><\/p>\n<\/blockquote>\n

According to the exchange, the risk\u2011management system also reviews outgoing transactions and watches for anomalous client behaviour:<\/p>\n

\n

\u201cWithdrawal requests that pass checks are moved to storage. The system automatically creates an unsigned transaction, which is then sent for semi\u2011autonomous multisignature via a special network protocol. This approach effectively makes it impossible for a third party or hacker to obtain the private key.\u201d<\/em><\/p>\n<\/blockquote>\n

Unsigned outgoing transactions are checked for anomalies by a separate semi\u2011autonomous risk\u2011management system, which serves as a second layer of defence for the hot wallet.<\/p>\n

A transaction is signed and broadcast to the blockchain only after both systems approve it. If a withdrawal request fails a check, OKX<\/a> delays or cancels the signature.<\/p>\n

Cold wallet<\/h2>\n

Cold wallets are not connected to the internet. That protects them from hacks but slows withdrawals from the exchange.<\/p>\n

\n

\u201cAny online equipment is vulnerable by its nature. Although we devote substantial resources to maintaining the semi\u2011autonomous multisignature system, it cannot be deemed safe because it is connected to the internet, so we store 95% of funds in cold wallets,\u201d OKX notes.<\/em><\/p>\n<\/blockquote>\n

Private keys are created as follows:<\/p>\n