Skip to main content
AVOID.NET
Sign in

OKX DEX

avoid.net/okx-dex→18/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3UYd5a…mg8k

Summary

OKX DEX is the decentralized exchange aggregator operated by OKX (Aux Cayes FinTech Co. Ltd.), one of the world's largest centralized crypto exchanges. In December 2023, the DEX suffered a ~$2.7 million exploit caused by a suspected private key leak and a centralized proxy upgrade mechanism with no multi-signature protection. The broader OKX entity has faced severe regulatory sanctions including a $504 million U.S. DOJ settlement in February 2025 for operating an unlicensed money-transmitting business and facilitating over $5 billion in suspicious transactions, a €1.1 million Malta AML fine, and repeated scrutiny over its DEX aggregator being used by North Korea's Lazarus Group to launder stolen funds from the $1.5 billion Bybit hack in early 2025.

Connected Entities

5 entities · 60 linked investigations
Organizations
□OKB25□DSJEX / BG Wealth Sharing Ponzi0□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign0□ZachXBT82
Exchanges
△OKX DEX
Relationships
  • DSJEX / BG Wealth Sharing Ponzi→mentioned with→ZachXBT(70%)
  • OKX DEX→mentioned with→OKB(70%)
  • OKX DEX→mentioned with→ZachXBT(70%)
  • OKB→mentioned with→OKX DEX(75%)
  • OKB→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
  • OKX DEX→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
  • OKX DEX→mentioned with→DSJEX / BG Wealth Sharing Ponzi(80%)
  • ZachXBT→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
Also appears in
Aperture LM·28Axiom DEX Insider Trading (Broox Bauer)·8MoonHacker·18Dean Daghita / CMDSS (Command Services and Support)·0Gurhan Kiziloz·0SafePal·42AnubisDAO·2SudoRare·2OKB·25Gurhan Kiziloz (BlockDAG Co-Founder)·0+ 50 more

Connected Through

5 shared actors · 502 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about OKX DEX?

Timeline(9 events)

12 December 2023

OKX DEX proxy admin private key allegedly leaked; attacker upgrades DEX Proxy contract to malicious implementation and begins draining user-approved token balances via claimTokens function. Approximately $2.7 million stolen across multiple wallets.

12 December 2023

OKX publicly acknowledges exploit, describes affected contract as an 'abandoned market maker contract,' removes compromised proxy from trusted list, and commits to reimburse all affected users.

23 January 2024

OKB token suffers a flash crash with a sudden, unexplained price drop, raising market manipulation concerns.

2024

Malta MFSA settles with OKCoin Europe for €304,000 fine; OKX agrees to hire independent compliance reviewer.

24 February 2024

OKcoin (OKX's U.S. arm) receives a CFTC subpoena related to suspected fraud and unlawful conduct in digital asset transactions.

2025

OKX receives a MiCA license from European regulators, allowing compliant operation across EU markets.

24 February 2025

OKX parent Aux Cayes FinTech Co. Ltd. pleads guilty and settles with U.S. DOJ for $504 million — $420.3 million forfeiture plus $84.4 million fine — for operating an unlicensed money-transmitting business and facilitating $5 billion+ in suspicious transactions. Three-year compliance monitor accepted.

17 March 2025

OKX suspends its DEX aggregator service after detecting Lazarus Group exploitation; Bybit CEO confirms approximately $100 million of the $1.5 billion Bybit hack was laundered through OKX Web3. European regulators (Austria, Croatia) open MiCA jurisdiction inquiry.

April 2025

Malta FIAU issues €1.1 million fine to OKCoin Europe for 'serious and systematic' AML breaches found during April 2023 on-site examination, including deficient customer risk assessments and inadequate methodology for high-risk asset categories.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain24 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (4 events). 24 of 29 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-09-0723 claims checked2 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:36 AM

last updated: 8/30/2026, 5:14:08 AM

4 views

avoid.net — verified advice for a post-truth world