OKX Suspends DEX Aggregator Amid North Korean Cyber Threat

Cryptocurrency exchange OKX has temporarily suspended its decentralized exchange (DEX) aggregator in response to alleged misuse by North Korea’s notorious hacking group, Lazarus. The company announced on March 17 that the decision was made after consultations with regulators to prevent further exploitation of its DeFi services.

“Recently, we detected a coordinated effort by the Lazarus Group to misuse our DeFi services,” OKX stated, adding that the pause would allow them to implement security upgrades. The company did not provide a specific timeline for when the aggregator would resume operations but confirmed that its crypto wallet services would remain functional. However, new wallet creation has been paused in select markets.

OKX Takes Proactive Measures

The suspension follows reports that European Union financial regulators were investigating OKX Web3, the exchange’s DEX aggregator and wallet service, for its alleged involvement in laundering stolen funds from the $1.5 billion Bybit hack.

On March 11, Bloomberg published an article alleging that nearly $100 million from the Bybit breach had been funneled through OKX’s Web3 proxy, making a portion of the stolen funds untraceable. Bybit CEO Ben Zhou pointed to OKX’s aggregator as a key conduit for laundering the illicit assets.

In response, OKX denounced the Bloomberg report, calling it “misleading.” The exchange asserted that it had taken immediate action when Bybit was hacked, including freezing suspicious funds on its centralized exchange (CEX) and enhancing real-time hack detection measures.

Strengthening Security Measures Against Financial Crime

In a March 17 statement, OKX CEO Star Xu outlined new security upgrades, including a “hacker address detection system” integrated into the DEX aggregator. This system aims to track the latest hacker addresses and block them in real-time on OKX’s centralized exchange.

“We have already implemented numerous controls for OKX Web3 to combat misuse, including prohibited markets’ IP blocking and real-time black address detection,” Xu stated.

The exchange further clarified that OKX Web3’s DEX aggregator is not a custodian of customer assets, emphasizing that its role is to connect users to liquidity pools across multiple protocols. However, OKX alleged that some entities had deliberately misrepresented its platform amid growing scrutiny over crypto’s role in cybercrime.