OKX has attributed the recent exploit of some users’ accounts to identity theft, revealing that bad actors had obtained the users’ information using forged documents to steal funds.&nbsp; 
<blockquote> 
 Also Read: <a href="https://www.cryptopolitan.com/okx-user-loses-2-million-crypto-in-ai-hack/">OKX user loses $2 million in crypto in AI deepfake hack</a> 
</blockquote> 
Last weekend, several OKX users shared on X that their accounts had been compromised and their assets drained. Several speculations were made about what caused the incident with SlowMist, <a href="https://x.com/evilcos/status/1799677006097027397?t=4I49eCr_j9ZgW3ga16j0qQ&amp;s=19" rel="nofollow" target="_blank">noting</a> that the hacker created new API keys for the users to withdraw the funds. The blockchain security firm also noted that the SMS risk notification came from Hong Kong. 
<h2 id="okx-compensates-impacted-users">OKX compensates impacted users</h2> 
In a social media post today, OKX <a href="https://x.com/okxchinese/status/1800794494016930119?t=l6usQzgGTjCHPl9TsXm3OA&amp;s=19" rel="nofollow" target="_blank">confirmed</a> the incidents, noting that only a few victims were affected. The exchange added that the hackers accessed users’ information by presenting forged judicial documents. Thus, it appears the exchange erroneously disclosed sensitive user information to scammers, thinking it was complying with regulators or law enforcement. It added: 
<blockquote>
 ” It has been verified that someone forged judicial documents and obtained the information of a very few customers. The matter is under investigation by the judicial authorities, and we cannot disclose more specific details. We have optimized the judicial cooperation process, introduced a verification mechanism, and strengthened the security level of AI face recognition.”
</blockquote> 
The exchange also debunked claims that the exploit was caused by a vulnerability in its security system that allowed the hackers to turn off SMS verification or Google Authenticator. A blockchain security group, Dilation Effect, had <a href="https://x.com/dilationeffect/status/1800116537128608133" rel="nofollow" target="_blank">suggested</a> this was the reason based on their analysis. It claimed: 
<blockquote>
 “Users bind Google Authenticator (GA) because GA has a higher security level. However, when OKX verifies sensitive user operations, such as adding whitelist addresses, withdrawing coins, and changing various verification item settings, it can directly switch to a low-security verification method, such as SMS.”
</blockquote> 
Meanwhile, the exchange added that it has compensated affected users. This aligns with its policy of compensating customers for losses due to internal faults. However, it added that its account security system remains safe, and it is optimizing its judicial cooperation process to prevent a reoccurrence. 
<h2 id="scammers-are-getting-more-sophisticated">Scammers are getting more sophisticated</h2> 
This incident highlights the extent to which bad actors are willing to go. Notably, the exploit comes amid a rise in sim-swap and phishing attacks. Recently, top crypto platforms <a href="https://www.cryptopolitan.com/tether-ceo-coingecko-warns-scams/">reported</a> that an email vendor was compromised in an exploit. As such, the emails of several users may be exposed to phishing scams. 
Also Read: <a href="https://www.cryptopolitan.com/scam-victim-reclaims-in-stolen-crypto-hack/">Scam Victim Reclaims $70M in Stolen Cryptocurrency</a> 
Some users have also reported losing their assets after accidentally downloading malware to their computers. On-chain sleuth ZachXBT recently <a href="https://x.com/zachxbt/status/1800906884666528071?s=46" rel="nofollow" target="_blank">reported</a> how a follower lost $245,000 through a social engineering scam. 
<figure id="attachment_539769" aria-describedby="caption-attachment-539769" style="width: 100%" class="wp-caption aligncenter">
 <img loading="lazy" decoding="async" class="size-full wp-image-539769" src="https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-12-193607.jpg" alt="Transaction trail" width="1372" height="669" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-12-193607.jpg 1372w, https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-12-193607-300x146.jpg 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-12-193607-1200x585.jpg 1200w, https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-12-193607-768x374.jpg 768w" sizes="(max-width: 1372px) 100vw, 1372px">
 <figcaption id="caption-attachment-539769" class="wp-caption-text">
 Transaction Trail. (Source: ZachXBT)
 </figcaption>
</figure> 
The victim was contacted by a scammer on X pretending to be a16z partner, Peter Lauten, to start a podcast partnership. The scammer directed them to download an app called Vortax for video calls, but the app turned out to be malware, draining their wallet.

OKX refunds users whose assets were stolen on its platform

Table of Contents

Cryptopolitan_News

Other articles published on Jun 12, 2024

HSBC China Introduces e-CNY Services for Corporate Clients, Leading the Charge for Foreign Banks

Proleo.io and MOTI.BIO Team Up to Revolutionize Blockchain-Based Projects

MetaMask Launches Ethereum Staking Service, There’s a Catch

Whales Drive Ethereum Price Surge

SEC and Terraform Agree on Settlement

Shiba Inu (SHIB) Holders Receive Critical Telegram Warning, Here's Why

Join our free newsletter for daily crypto updates!