Star Xu, founder of OKX, commented on the 2024 incident where users' SIM cards were replaced, leading to the control of exchange accounts. He stated that the platform made significant upgrades to its account security system after the incident, and no similar attacks through SIM card replacement have occurred since.

From June 2024, at least two OKX user accounts were compromised in SIM swap attacks. The founder of security company SlowMist revealed that risk notifications via SMS originated from Hong Kong, and attackers created new API keys with withdrawal and trading permissions. Analysis indicated that the platform allowed sensitive operations such as adding withdrawal whitelist, changing passwords, and disabling two-factor authentication to switch from higher security verification to SMS, which is less secure. Some operations did not trigger the common 24-hour withdrawal freeze for new device logins, allowing large withdrawals to whitelisted addresses. At the same time, other users reported that after their phone numbers were replaced online, their emails and logins were reset, with attackers transferring approximately $1.46 million through C2C channels.

English reports at the time indicated that the stolen amount was in the millions of dollars, but the specific total was not uniformly disclosed. The platform contacted affected users and initiated an investigation, with reports that two victims received compensation while also mandating the use of Google Authenticator. Star Xu stated that the platform had initially covered about half of the users' losses, and the police subsequently assisted in recovering most of the funds, asserting that they would cooperate with global law enforcement and Interpol to investigate, hold accountable, and recover assets.

After the incident was exposed, on-chain monitoring showed a massive outflow of funds from OKX: statistics indicated approximately $204 million flowed out in a single day, with a cumulative outflow of about $633 million to $837 million over a week, while competitors experienced net inflows. Security experts also pointed out that clues regarding forged judicial documents used to obtain customer information entered judicial proceedings. The platform emphasized that the responsibility for different cases varies, and it takes responsibility for losses caused by its own actions.

In market mechanics, the assets sold were spot and stablecoins from the hijacked accounts, while the buyers were the attackers controlling the withdrawal addresses and C2C counterparties; the driving factor was the combination of SIM card replacement by telecom operators and SMS fallback verification from the exchange, rather than market fluctuations. Funds flowed from users' spot accounts to off-exchange channels that could be immediately liquidated. The beneficiaries were the attackers who completed the SIM takeover and withdrew funds before the freeze window, while the pressured parties were users relying on SMS verification and the exchange, which had to use advances and recovery efforts to maintain custodial credibility.

Source: Public Information