OKX Founder Star Xu: No Similar Incidents After SIM Hijacking
Star Xu, founder of OKX, commented on the 2024 incident where users' SIM cards were replaced, leading to the control of exchange accounts. He stated that the platform made significant upgrades to its account security system after the incident, and no similar attacks through SIM card replacement have occurred since.
From June 2024, at least two OKX user accounts were compromised in SIM swap attacks. The founder of security company SlowMist revealed that risk notifications via SMS originated from Hong Kong, and attackers created new API keys with withdrawal and trading permissions. Analysis indicated that the platform allowed sensitive operations such as adding withdrawal whitelist, changing passwords, and disabling two-factor authentication to switch from higher security verification to SMS, which is less secure. Some operations did not trigger the common 24-hour withdrawal freeze for new device logins, allowing large withdrawals to whitelisted addresses. At the same time, other users reported that after their phone numbers were replaced online, their emails and logins were reset, with attackers transferring approximately $1.46 million through C2C channels.
English reports at the time indicated that the stolen amount was in the millions of dollars, but the specific total was not uniformly disclosed. The platform contacted affected users and initiated an investigation, with reports that two victims received compensation while also mandating the use of Google Authenticator. Star Xu stated that the platform had initially covered about half of the users' losses, and the police subsequently assisted in recovering most of the funds, asserting that they would cooperate with global law enforcement and Interpol to investigate, hold accountable, and recover assets.
After the incident was exposed, on-chain monitoring showed a massive outflow of funds from OKX: statistics indicated approximately $204 million flowed out in a single day, with a cumulative outflow of about $633 million to $837 million over a week, while competitors experienced net inflows. Security experts also pointed out that clues regarding forged judicial documents used to obtain customer information entered judicial proceedings. The platform emphasized that the responsibility for different cases varies, and it takes responsibility for losses caused by its own actions.
In market mechanics, the assets sold were spot and stablecoins from the hijacked accounts, while the buyers were the attackers controlling the withdrawal addresses and C2C counterparties; the driving factor was the combination of SIM card replacement by telecom operators and SMS fallback verification from the exchange, rather than market fluctuations. Funds flowed from users' spot accounts to off-exchange channels that could be immediately liquidated. The beneficiaries were the attackers who completed the SIM takeover and withdrew funds before the freeze window, while the pressured parties were users relying on SMS verification and the exchange, which had to use advances and recovery efforts to maintain custodial credibility.
Source: Public Information
ABAB AI Insight
Cryptocurrency exchanges treating SMS as a second factor essentially outsource account security to telecom service providers. Coinbase lost assets of about 6,000 users in 2021 due to SMS verification being bypassed; large thefts before and after FTX's bankruptcy were also prosecuted by U.S. authorities under the SIM swap framework. The new variable in OKX's case is that the "replacement of SIM cards" occurred on the telecom side, and the platform's risk control saw legitimate SMS, allowing API keys and whitelists to be created within existing rules. Star Xu's narrative shifted from "under investigation" to "covering half, recovering most, and zero recurrence after upgrades," rewriting a single-point incident into a security record that can be referenced externally.
The capital path is reputation repair expenditure: first covering losses and then waiting for judicial liability division to avoid user runs turning custodial balances into immediate liabilities. Mandatory use of authenticators increased the switching costs for retained users and downgraded SMS from a default option to a removable one. Partnering with Interpol is framed as a customer acquisition strategy to enhance cross-border asset recovery capabilities—custodial exchanges compete not just on fees but on who can turn on-chain outflows into executable judicial requests after incidents.
Similar comparisons can be drawn with Binance and Kraken, which enforced hardware or application authenticators after SIM and phishing incidents, as well as the U.S. Department of Justice's prosecution of the 0ktapus gang. The industry phase has shifted from "who first launched SMS 2FA" to "who first removes telecom identity from the authentication chain." Platforms still using SMS for resets are in a passive position, while those that have set authenticators as the baseline and closed downgrade paths are competing for custodial premiums.
Structurally, this reflects a combination of regulatory changes and technological replacements: the telecom real-name SIM replacement loophole cannot be fixed by exchange code and can only be replaced with a higher factor than SMS. The mechanism is that the attack cost lies with the telecom service provider, while the losses are recorded on the exchange's balance sheet and user runs; whoever can cut telecom vulnerabilities from the product path can turn the slogan "though far, must be punished" into a repeatable compensation and law enforcement interface.
ABAB News · Cognitive Law
SMS verification is equivalent to handing the vault key to the telecom service provider.
Covering losses is a marketing budget after risk control failure.
Verifications that can be downgraded are equivalent to having no verification.