{"investigation":{"slug":"okx-nft-aggregator","entity_name":"OKX NFT Aggregator","trust_score":30,"severity_base":null,"score_modifier":-12,"confidence":0.78,"status":"published","content_type":"investigation","summary":"OKX NFT Aggregator is the NFT marketplace and aggregation layer of OKX, one of the world's largest crypto exchanges, supporting over 21 blockchains and 32 aggregated markets. The product has been implicated in a smart contract storage-collision exploit (June 2024), operates within an exchange that pleaded guilty to U.S. AML violations and agreed to a $504 million DOJ settlement (February 2025), and saw its parent DEX aggregator suspended in March 2025 after North Korea's Lazarus Group used the broader OKX Web3 infrastructure to launder approximately $100 million from the Bybit hack. ZachXBT has flagged the entity in the context of these broader OKX platform concerns.","sections":[{"content":"On approximately June 20, 2024, OKX NFT Aggregator was affected by a smart contract upgrade vulnerability categorized as a callee/callee storage collision. According to a peer-reviewed security research paper published at arXiv (2508.02145), OKX NFT Aggregator was one of three protocols — alongside EFVault and PikeFinance — that collectively lost approximately $6.9 million due to this class of vulnerability. The specific mechanism involves a storage slot that stored one type of data in an earlier contract version being repurposed in a subsequent upgrade to store a different data type, while the slot content was never updated. This caused valuation logic within the contract to operate on stale or incorrect values, enabling attackers to extract funds at inflated valuations. The OKX NFT Aggregator's individual loss from this incident is cited in the arXiv paper but not broken out in isolation from the combined $6.9 million figure across the three affected protocols. No official OKX post-mortem or compensation announcement for this specific NFT Aggregator incident has been located in publicly available sources. This incident is distinct from the December 2023 OKX DEX exploit.","heading":"Protocol Logic Incident: Smart Contract Storage Collision (June 2024)","sources":[{"url":"https://arxiv.org/html/2508.02145v1","name":"arxiv.org","type":"other","credibility":3}],"severity":"medium"},{"content":"On December 13, 2023, the OKX DEX — the decentralized exchange aggregator closely associated with the OKX NFT Aggregator infrastructure — was exploited for approximately $2.7 million. The root cause was the alleged compromise of the private keys of the Proxy Admin Owner, which allowed an attacker to upgrade the DEX Proxy contract to a malicious implementation. This new implementation directly invoked the claimTokens function of the DEX's TokenApprove contract, enabling unauthorized transfer of tokens from user wallets that had previously granted approval to the platform. Three attacker addresses were identified by Arkham Intelligence and Neptune Mutual: 0xFacf375Af906f55453537ca31fFA99053A010239, 0x1F14E38666cDd8e8975f9acC09e24E9a28fbC42d, and 0x0519eFACB73A1f10b8198871E58D68864e78B8A5. OKX confirmed the exploit targeted a deprecated smart contract, pledged to reimburse all affected users, and revoked associated contract permissions. The same attacker was linked by on-chain analytics to prior exploits including LunaFi, Uno Re, and RVLT. This incident highlighted the systemic risk of upgradeable proxy contracts where admin key compromise enables arbitrary fund extraction from users who have granted token approvals.","heading":"Parent Platform Exploit: OKX DEX Private Key Compromise (December 2023)","sources":[{"url":"https://www.theblock.co/post/267405/okx-dex-suffers-apparent-2-7-million-exploit-following-suspected-private-key-leak","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/okx-dex-2-7-m-exploit-proxy-admin-contract-upgrade","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","name":"medium.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/okx-dex-hacked-2-7-million-after-private-key-leak/","name":"cryptobriefing.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In February 2025, North Korea's Lazarus Group executed a $1.5 billion hack against Bybit. Bybit CEO Ben Zhou disclosed that approximately $100 million of the stolen assets were subsequently routed through OKX's Web3 DEX aggregator infrastructure, which shares backend routing and liquidity logic with the OKX NFT Aggregator. On March 17, 2025, OKX voluntarily suspended its DEX aggregator services after consulting with regulators, citing the need to implement stronger anti-abuse controls and correct alleged incomplete labeling by blockchain explorers. European regulators, convening through ESMA with representatives from all 27 EU member states on March 6, 2025, discussed whether OKX remained compliant with its MiCA license. Malta's financial regulator — where OKX holds its EU crypto-asset service provider authorization — initiated a review of whether to revoke OKX's license under MiCA Article 64, which permits license withdrawal for entities that fail to prevent money laundering. OKX disputed characterizations of the events, attributed the discrepancy to blockchain explorer labeling errors, and stated it had frozen associated funds entering its centralized exchange. OKX subsequently implemented a real-time hacker-address detection and blocking system integrated into its DEX aggregator.","heading":"Lazarus Group Money Laundering via OKX Web3 Infrastructure (February-March 2025)","sources":[{"url":"https://cryptoslate.com/okx-suspends-web3-aggregator-amid-probe-into-100m-bybit-hack-laundering-links/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/346538/okx-suspends-dex-aggregator-following-lazarus-misuse-and-heightened-eu-scrutiny","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/okx-suspends-dex-aggregator-after-lazarus-hackers-try-to-launder-funds/","name":"bleepingcomputer.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/okx-suspends-dex-aggregator-further-misuse-lazarus","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/okx-halts-dex-aggregator-services-amid-lazarus-group-misuse-and-eu-investigations","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 24, 2025, Aux Cayes Fintech Co. Ltd — the Seychelles-registered entity operating OKX — pleaded guilty in the Southern District of New York to one count of operating an unlicensed money transmitting business, in violation of the Bank Secrecy Act. The company agreed to pay penalties totaling over $504 million, comprising a $420.3 million forfeiture of alleged ill-gotten gains and an $84.4 million criminal fine. The DOJ found that from 2018 through early 2024, OKX knowingly served U.S. retail and institutional customers, facilitating over $1 trillion in transactions without a license and processing more than $5 billion in alleged suspicious transactions and criminal proceeds. Specific compliance failures included allowing anonymous trading that bypassed KYC requirements, and OKX employees allegedly advising U.S. customers to input false country and identification information to circumvent controls. As part of the plea agreement, OKX must retain an external compliance consultant through at least February 2027 and continue cooperating with the U.S. Attorney's Office for SDNY. A separate CFTC subpoena issued on February 24, 2024 remains ongoing, referencing alleged fraud and illegal activities in digital asset transactions. The DOJ settlement does not specifically name the NFT Aggregator product, but the systemic AML failures it documents apply to the exchange's broader product ecosystem.","heading":"DOJ Guilty Plea and $504 Million AML Settlement (February 2025)","sources":[{"url":"https://www.justice.gov/usao-sdny/pr/okx-pleads-guilty-violating-us-anti-money-laundering-laws-and-agrees-pay-penalties","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2025/02/24/okx-close-to-large-settlement-agreement-with-u-s-regulators-source","name":"coindesk.com","type":"other","credibility":3},{"url":"https://coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","name":"coinpedia.org","type":"other","credibility":3},{"url":"https://www.sanctions.io/blog/okxs-500-million-penalty-key-takeaways-for-aml-pros","name":"sanctions.io","type":"other","credibility":3},{"url":"https://crypto.news/okx-non-compliance-settlement-doj-2025/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"OKX NFT Aggregator is embedded within the OKX Web3 wallet and marketplace ecosystem. As of 2024, the platform supported 21 blockchains, aggregated listings from approximately 32 external markets including OpenSea, MagicEden, LooksRare, and Blur, and indexed over 1.7 million NFT collections spanning 670 million individual tokens. The platform charges zero service fees on NFT purchases and listings, a model that attracted significant volume — on September 16, 2023, the OKX NFT Marketplace recorded a single-day trading volume of $11.54 million, a 114.5% increase from the prior day. In December 2023, OKX became the first multi-chain platform to support viewing and transfer of Bitcoin Ordinals. The aggregator architecture routes user transactions through shared smart contracts that also underpin OKX's DEX aggregator, meaning security incidents in either product can propagate risk across both. Token approval scopes granted by users for DEX operations may extend to NFT contract interactions depending on the specific approval architecture. The platform's bug bounty program is listed on HackenProof. An iOS Remote Code Execution vulnerability in the OKX wallet app — which interfaces with the NFT Aggregator — was disclosed by CertiK on December 19, 2023; OKX patched the issue with version 6.45.0 and confirmed no customer assets were affected.","heading":"Platform Overview and Aggregation Architecture","sources":[{"url":"https://www.okx.com/en-eu/help/okx-nft-marketplace-your-gateway-to-a-multi-chain-nft-universe","name":"okx.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2023/09/19/2745261/0/en/Flash-News-OKX-NFT-Marketplace-Witnesses-a-114-Rise-in-Daily-Trading-Volume.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/12/19/okx-wallet-users-warned-to-update-app-to-avoid-code-vulnerability","name":"coindesk.com","type":"other","credibility":3},{"url":"https://hackenproof.com/programs/okx","name":"hackenproof.com","type":"other","credibility":3}],"severity":"medium"},{"content":"OKX as a parent platform holds a Trustpilot rating of approximately 2.2 out of 5 based on over 1,600 user reviews, with recurring complaints about frozen accounts, blocked withdrawals, and inadequate customer support responses. No specific volume of complaints directed exclusively at the NFT Aggregator product has been identified in publicly available sources. The DOJ guilty plea established that OKX employees actively assisted U.S. users in bypassing KYC requirements, which represents a documented institutional pattern of compliance circumvention that extends to all product lines. The CFTC subpoena remains open as of early 2025. EU regulators' ongoing review of OKX's MiCA license introduces potential access disruption risk for European users of the NFT Aggregator. The platform's zero-fee model, while attractive to users, also reduces friction for wash trading activity; no specific enforcement action against OKX NFT Aggregator for wash trading has been identified in publicly available records.","heading":"User Complaints and Customer Service Risk Indicators","sources":[{"url":"https://tradelize.com/crypto-exchange-reviews/okx-review/","name":"tradelize.com","type":"other","credibility":3},{"url":"https://www.coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","name":"coinpedia.org","type":"other","credibility":3},{"url":"https://coinfomania.com/eus-okx-regulatory-investigation-eu-considers-stripping-okx-of-mica-license-following-1-5-billion-heist-fallout/","name":"coinfomania.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, an anonymous blockchain investigator whose work has been cited by law enforcement and major crypto news outlets, has flagged OKX in the context of its broader platform risk profile. While no single published ZachXBT thread is exclusively dedicated to the OKX NFT Aggregator product, the flagging is consistent with ZachXBT's documented pattern of surfacing platforms used to route or launder illicit funds. OKX separately funded ZachXBT's investigation into alleged insider manipulation of the RAVE token in 2025, in which OKX founder Star pledged $25,000 in support — an action that situates OKX as both a flagged entity and a funder of on-chain investigations. The on-chain risk context for the NFT Aggregator includes: (1) the June 2024 storage collision exploit affecting user funds, (2) the December 2023 DEX proxy exploit where user token approvals were drained, (3) Lazarus Group use of connected aggregator infrastructure to launder $100 million, and (4) the parent exchange's $5 billion in alleged suspicious transaction processing documented in the DOJ plea. Users who granted token approvals to OKX NFT Aggregator contracts during the December 2023 incident window may have been exposed to unauthorized transfers.","heading":"ZachXBT Flagging and On-Chain Risk Context","sources":[{"url":"https://crypto.news/exchanges-face-heat-as-okx-funds-zachxbt-probe-into-95-rave-crash/","name":"crypto.news","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","name":"medium.com","type":"other","credibility":3},{"url":"https://arxiv.org/html/2508.02145v1","name":"arxiv.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-09-16","event":"OKX NFT Marketplace records single-day trading volume of $11.54 million, a 114.5% increase, reflecting rapid growth of the aggregator product.","source":""},{"date":"2023-12-12","event":"OKX DEX Proxy Admin Owner upgrades the proxy contract to a malicious implementation, opening the claimTokens exploit vector.","source":""},{"date":"2023-12-13","event":"OKX DEX exploited for approximately $2.7 million via compromised Proxy Admin private keys; OKX confirms the incident and pledges user compensation.","source":""},{"date":"2023-12-19","event":"CertiK discloses a critical Remote Code Execution vulnerability in OKX iOS wallet app (version prior to 6.45.0); OKX patches immediately.","source":""},{"date":"2024-02-24","event":"CFTC issues a subpoena to OKX referencing alleged fraud and illegal activities in digital asset transactions.","source":""},{"date":"2024-06-20","event":"OKX NFT Aggregator suffers a smart contract storage-collision exploit during a contract upgrade; part of a combined ~$6.9 million loss across OKX NFT Aggregator, EFVault, and PikeFinance.","source":""},{"date":"2025-02-21","event":"Lazarus Group executes the $1.5 billion Bybit hack; approximately $100 million is subsequently routed through OKX Web3 DEX aggregator infrastructure.","source":""},{"date":"2025-02-24","event":"Aux Cayes Fintech Co. Ltd (OKX operator) pleads guilty in SDNY to operating an unlicensed money transmitting business, agreeing to pay $504 million in penalties and forfeitures.","source":""},{"date":"2025-03-06","event":"ESMA convenes meeting with representatives of all 27 EU member states to discuss OKX's role in Bybit hack laundering and MiCA compliance status.","source":""},{"date":"2025-03-17","event":"OKX voluntarily suspends its DEX aggregator service, citing Lazarus Group misuse and the need for security upgrades including real-time hacker-address blocking.","source":""}],"sources_used":[{"url":"https://arxiv.org/html/2508.02145v1","name":"arxiv.org","type":"other","archive_url":"https://web.archive.org/web/20260829232618/https://arxiv.org/html/2508.02145v1","credibility":3,"archive_timestamp":"2026-08-29T23:26:18+00:00"},{"url":"https://www.theblock.co/post/267405/okx-dex-suffers-apparent-2-7-million-exploit-following-suspected-private-key-leak","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/okx-dex-2-7-m-exploit-proxy-admin-contract-upgrade","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260725043704/https://cointelegraph.com/news/okx-dex-2-7-m-exploit-proxy-admin-contract-upgrade","credibility":3,"archive_timestamp":"2026-07-25T04:37:04+00:00"},{"url":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptobriefing.com/okx-dex-hacked-2-7-million-after-private-key-leak/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20251207161303/https://cryptobriefing.com/okx-dex-hacked-2-7-million-after-private-key-leak/","credibility":3,"archive_timestamp":"2025-12-07T16:13:03+00:00"},{"url":"https://cryptoslate.com/okx-suspends-web3-aggregator-amid-probe-into-100m-bybit-hack-laundering-links/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260315233331/https://cryptoslate.com/okx-suspends-web3-aggregator-amid-probe-into-100m-bybit-hack-laundering-links/","credibility":3,"archive_timestamp":"2026-03-15T23:33:31+00:00"},{"url":"https://www.theblock.co/post/346538/okx-suspends-dex-aggregator-following-lazarus-misuse-and-heightened-eu-scrutiny","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.bleepingcomputer.com/news/security/okx-suspends-dex-aggregator-after-lazarus-hackers-try-to-launder-funds/","name":"bleepingcomputer.com","type":"other","archive_url":"http://web.archive.org/web/20251219095723/https://www.bleepingcomputer.com/news/security/okx-suspends-dex-aggregator-after-lazarus-hackers-try-to-launder-funds/","credibility":3,"archive_timestamp":"2025-12-19T09:57:23+00:00"},{"url":"https://cointelegraph.com/news/okx-suspends-dex-aggregator-further-misuse-lazarus","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829234256/https://cointelegraph.com/news/okx-suspends-dex-aggregator-further-misuse-lazarus","credibility":3,"archive_timestamp":"2026-08-29T23:42:56+00:00"},{"url":"https://coinmarketcap.com/academy/article/okx-halts-dex-aggregator-services-amid-lazarus-group-misuse-and-eu-investigations","name":"coinmarketcap.com","type":"other","archive_url":"https://web.archive.org/web/20260829125516/https://coinmarketcap.com/academy/article/okx-halts-dex-aggregator-services-amid-lazarus-group-misuse-and-eu-investigations","credibility":3,"archive_timestamp":"2026-08-29T12:55:16+00:00"},{"url":"https://www.justice.gov/usao-sdny/pr/okx-pleads-guilty-violating-us-anti-money-laundering-laws-and-agrees-pay-penalties","name":"justice.gov","type":"other","archive_url":"http://web.archive.org/web/20260525015352/https://www.justice.gov/usao-sdny/pr/okx-pleads-guilty-violating-us-anti-money-laundering-laws-and-agrees-pay-penalties","credibility":3,"archive_timestamp":"2026-05-25T01:53:52+00:00"},{"url":"https://www.coindesk.com/business/2025/02/24/okx-close-to-large-settlement-agreement-with-u-s-regulators-source","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20250831122331/https://www.coindesk.com/business/2025/02/24/okx-close-to-large-settlement-agreement-with-u-s-regulators-source","credibility":3,"archive_timestamp":"2025-08-31T12:23:31+00:00"},{"url":"https://coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","name":"coinpedia.org","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.sanctions.io/blog/okxs-500-million-penalty-key-takeaways-for-aml-pros","name":"sanctions.io","type":"other","archive_url":"http://web.archive.org/web/20260521010322/https://www.sanctions.io/blog/okxs-500-million-penalty-key-takeaways-for-aml-pros","credibility":3,"archive_timestamp":"2026-05-21T01:03:22+00:00"},{"url":"https://crypto.news/okx-non-compliance-settlement-doj-2025/","name":"crypto.news","type":"other","archive_url":"https://web.archive.org/web/20260829131447/https://crypto.news/okx-non-compliance-settlement-doj-2025/","credibility":3,"archive_timestamp":"2026-08-29T13:14:47+00:00"},{"url":"https://www.okx.com/en-eu/help/okx-nft-marketplace-your-gateway-to-a-multi-chain-nft-universe","name":"okx.com","type":"other","archive_url":"https://web.archive.org/web/20260829152550/https://www.okx.com/en-eu/help/okx-nft-marketplace-your-gateway-to-a-multi-chain-nft-universe","credibility":3,"archive_timestamp":"2026-08-29T15:25:50+00:00"},{"url":"https://www.globenewswire.com/news-release/2023/09/19/2745261/0/en/Flash-News-OKX-NFT-Marketplace-Witnesses-a-114-Rise-in-Daily-Trading-Volume.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260829152050/https://www.globenewswire.com/news-release/2023/09/19/2745261/0/en/Flash-News-OKX-NFT-Marketplace-Witnesses-a-114-Rise-in-Daily-Trading-Volume.html","credibility":3,"archive_timestamp":"2026-08-29T15:20:50+00:00"},{"url":"https://www.coindesk.com/business/2023/12/19/okx-wallet-users-warned-to-update-app-to-avoid-code-vulnerability","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://hackenproof.com/programs/okx","name":"hackenproof.com","type":"other","archive_url":"http://web.archive.org/web/20251208052843/https://hackenproof.com/programs/okx","credibility":3,"archive_timestamp":"2025-12-08T05:28:43+00:00"},{"url":"https://tradelize.com/crypto-exchange-reviews/okx-review/","name":"tradelize.com","type":"other","archive_url":"http://web.archive.org/web/20260306150318/https://tradelize.com/crypto-exchange-reviews/okx-review/","credibility":3,"archive_timestamp":"2026-03-06T15:03:18+00:00"},{"url":"https://www.coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","name":"coinpedia.org","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinfomania.com/eus-okx-regulatory-investigation-eu-considers-stripping-okx-of-mica-license-following-1-5-billion-heist-fallout/","name":"coinfomania.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://crypto.news/exchanges-face-heat-as-okx-funds-zachxbt-probe-into-95-rave-crash/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260725135834/https://crypto.news/exchanges-face-heat-as-okx-funds-zachxbt-probe-into-95-rave-crash/","credibility":3,"archive_timestamp":"2026-07-25T13:58:34+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:31.532315+00:00","updated_at":"2026-08-30T01:16:26.558936+00:00"}}