我想分享一些钱包被盗/被攻破的常见场景，希望能帮助用户更清楚地理解风险真正来自哪里： 1️⃣ DEX Bot 产品中的中心化私钥风险 许多 DEX Bot 产品要求用户将私钥上传至服务器，并以明文或可解密形式存储。 👉 这意味着内部技术人员可能接触到用户私钥；一旦系统被攻破，其风险模型实际上与中心化交易所无异。 因此，这类产品如果要被视为安全，必须达到交易所级别的安全标准。更重要的是，这些产品本质上并非真正的自托管。在许多司法辖区，服务提供方可能被认定需要履行 KYC、AML 等合规义务；若未能满足相关要求，运营方可能面临监管风险，甚至刑事风险。 2️⃣ 自托管钱包代码中的漏洞或恶意行为 包括软件漏洞、供应链攻击、代码仓库被入侵等情况，都可能导致私钥被窃取。 👉 近期一起高度关注的钱包安全事件，正属于这一类型。 3️⃣ 用户设备被入侵或非预期的数据泄露 用户设备可能感染恶意软件，用于监听键盘输入或剪贴板内容。 在其他情况下，用户将助记词保存为截图，而这些截图又被自动同步到云端照片服务。 👉 我们曾处理过真实的法律案件：大型云相册服务商的员工编写服务器端脚本，扫描用户备份数据，专门识别包含助记词的图片。 4️⃣ 自动化策略对私钥托管的结构性依赖 许多用户依赖自动化交易或执行策略，而这些策略往往要求将私钥交由 Bot 服务商托管。OKX Wallet 正在准备推出 Smart Accounts（智能账户），通过 可信执行环境（TEE） 技术，实现在不托管私钥的前提下执行自动化策略，从而解决这一长期存在的安全权衡问题。 5️⃣ 钱包安全演进的正确方向 安全性与易用性并非对立。 OKX Pay Wallet 的设计理念，是将以下要素结合在一起： 机构级安全与风控体系 用户本地掌控的身份验证方式，例如 Passkey（通行密钥） OKX Pay 目前仍处于概念阶段。在未来一年内，我们计划逐步推出一系列强大的功能，为主流用户提供更强的资产保护能力。 I’d like to share some common scenarios behind wallet compromises, in the hope that this helps users better understand where risks actually come from: 1️⃣ Centralized private-key risk in DEX Bot products Many DEX Bot products require users to upload their private keys to servers, where they are stored in plaintext or in decryptable form. 👉 This means internal technical staff may have access to user private keys, and once a system is compromised, the risk profile effectively becomes comparable to that of a centralized exchange. As a result, such products must meet exchange-level security standards to be considered safe. Importantly, these products are not truly self-custodial by nature. In many jurisdictions, service providers may be deemed subject to KYC, AML, and other compliance obligations. Failure to meet such obligations could expose operators to regulatory or even criminal risks. 2️⃣ Vulnerabilities or malicious behavior in self-custodial wallet code This includes software bugs, supply-chain attacks, or compromised code repositories, which can result in private keys being exfiltrated. 👉 A recent high-profile wallet incident falls into this category. 3️⃣ Compromise of user devices or unintended data exposure User devices may be infected with malware capable of monitoring keystrokes or clipboard activity. In other cases, users store recovery phrases as screenshots, which are then automatically backed up to cloud photo services. 👉 We have handled real legal cases where employees of large photo-storage providers wrote server-side scripts to scan user backups and identify images containing recovery phrases. 4️⃣ Structural reliance on private-key custody for automated strategies Many users rely on automated trading or execution strategies, which often require private keys to be entrusted to bot service providers. OKX Wallet is preparing to introduce Smart Accounts, leveraging Trusted Execution Environment (TEE) technology to enable automated strategy execution without custodial control over private keys, addressing this long-standing security trade-off. 5️⃣ The correct direction for wallet security evolution Security and usability are not mutually exclusive. The design philosophy behind OKX Pay Wallet is to combine: •Institutional-grade security and risk controls •User-controlled local authentication, such as passkeys OKX Pay is currently a concept-stage product, and over the coming year we plan to roll out a range of powerful features to better protect assets for mainstream users.