Verify a decision

{"actor":"system:backfill","investigation_id":"37d902e3-aec9-4679-8048-058ca5d1ebbb","kind":"publish","page_slug":"okx-nft-aggregator","published_at":"2026-05-29T16:12:52.466Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"OKX NFT Aggregator","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://arxiv.org/html/2508.02145v1","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/267405/okx-dex-suffers-apparent-2-7-million-exploit-following-suspected-private-key-leak","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/okx-dex-2-7-m-exploit-proxy-admin-contract-upgrade","type":"other","url":""},{"credibility":3,"name":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/okx-dex-hacked-2-7-million-after-private-key-leak/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptoslate.com/okx-suspends-web3-aggregator-amid-probe-into-100m-bybit-hack-laundering-links/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/346538/okx-suspends-dex-aggregator-following-lazarus-misuse-and-heightened-eu-scrutiny","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/security/okx-suspends-dex-aggregator-after-lazarus-hackers-try-to-launder-funds/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/okx-suspends-dex-aggregator-further-misuse-lazarus","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/academy/article/okx-halts-dex-aggregator-services-amid-lazarus-group-misuse-and-eu-investigations","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.justice.gov/usao-sdny/pr/okx-pleads-guilty-violating-us-anti-money-laundering-laws-and-agrees-pay-penalties","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2025/02/24/okx-close-to-large-settlement-agreement-with-u-s-regulators-source","type":"other","url":""},{"credibility":3,"name":"https://coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","type":"other","url":""},{"credibility":3,"name":"https://www.sanctions.io/blog/okxs-500-million-penalty-key-takeaways-for-aml-pros","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/okx-non-compliance-settlement-doj-2025/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.okx.com/en-eu/help/okx-nft-marketplace-your-gateway-to-a-multi-chain-nft-universe","type":"other","url":""},{"credibility":3,"name":"https://www.globenewswire.com/news-release/2023/09/19/2745261/0/en/Flash-News-OKX-NFT-Marketplace-Witnesses-a-114-Rise-in-Daily-Trading-Volume.html","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2023/12/19/okx-wallet-users-warned-to-update-app-to-avoid-code-vulnerability","type":"other","url":""},{"credibility":3,"name":"https://hackenproof.com/programs/okx","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://tradelize.com/crypto-exchange-reviews/okx-review/","type":"other","url":""},{"credibility":3,"name":"https://www.coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/eus-okx-regulatory-investigation-eu-considers-stripping-okx-of-mica-license-following-1-5-billion-heist-fallout/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto.news/exchanges-face-heat-as-okx-funds-zachxbt-probe-into-95-rave-crash/","type":"other","url":""},{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""},{"credibility":3,"name":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","type":"other","url":""},{"credibility":3,"name":"https://arxiv.org/html/2508.02145v1","type":"other","url":""}]}],"sources_used":[],"summary":"OKX NFT Aggregator is the NFT marketplace and aggregation layer of OKX, one of the world's largest crypto exchanges, supporting over 21 blockchains and 32 aggregated markets. The product has been implicated in a smart contract storage-collision exploit (June 2024), operates within an exchange that pleaded guilty to U.S. AML violations and agreed to a $504 million DOJ settlement (February 2025), and saw its parent DEX aggregator suspended in March 2025 after North Korea's Lazarus Group used the broader OKX Web3 infrastructure to launder approximately $100 million from the Bybit hack. ZachXBT has flagged the entity in the context of these broader OKX platform concerns.","timeline":[{"date":"2023-09-16","event":"OKX NFT Marketplace records single-day trading volume of $11.54 million, a 114.5% increase, reflecting rapid growth of the aggregator product.","source":""},{"date":"2023-12-12","event":"OKX DEX Proxy Admin Owner upgrades the proxy contract to a malicious implementation, opening the claimTokens exploit vector.","source":""},{"date":"2023-12-13","event":"OKX DEX exploited for approximately $2.7 million via compromised Proxy Admin private keys; OKX confirms the incident and pledges user compensation.","source":""},{"date":"2023-12-19","event":"CertiK discloses a critical Remote Code Execution vulnerability in OKX iOS wallet app (version prior to 6.45.0); OKX patches immediately.","source":""},{"date":"2024-02-24","event":"CFTC issues a subpoena to OKX referencing alleged fraud and illegal activities in digital asset transactions.","source":""},{"date":"2024-06-20","event":"OKX NFT Aggregator suffers a smart contract storage-collision exploit during a contract upgrade; part of a combined ~$6.9 million loss across OKX NFT Aggregator, EFVault, and PikeFinance.","source":""},{"date":"2025-02-21","event":"Lazarus Group executes the $1.5 billion Bybit hack; approximately $100 million is subsequently routed through OKX Web3 DEX aggregator infrastructure.","source":""},{"date":"2025-02-24","event":"Aux Cayes Fintech Co. Ltd (OKX operator) pleads guilty in SDNY to operating an unlicensed money transmitting business, agreeing to pay $504 million in penalties and forfeitures.","source":""},{"date":"2025-03-06","event":"ESMA convenes meeting with representatives of all 27 EU member states to discuss OKX's role in Bybit hack laundering and MiCA compliance status.","source":""},{"date":"2025-03-17","event":"OKX voluntarily suspends its DEX aggregator service, citing Lazarus Group misuse and the need for security upgrades including real-time hacker-address blocking.","source":""}]},"v":1}