OKX suspends the DEX Aggregator service to prevent abuse by Lazarus Group

The cryptocurrency exchange OKX has temporarily suspended its decentralized exchange (DEX) aggregator to counter possible illicit uses by the North Korean hackers Lazarus Group.

OKX suspends the DEX Aggregator after consultations with the Regulatory Authorities  

OKX has announced that it has identified a coordinated attempt by Lazarus Group to exploit its DeFi services. Following this discovery, the exchange has decided to temporarily suspend the DEX aggregator service and implement advanced security measures.

“After consulting with the regulators, the company has chosen to voluntarily suspend the aggregation service to avoid further violations,”

has declared OKX.  

Currently, the customer service team of the platform has confirmed the temporary block of the DEX aggregator for an internal review and a system update, without specifying a specific period for its reactivation.  

Despite the suspension, cryptocurrency services and wallets will remain accessible for users. However, the creation of new wallets will be limited in some markets until the completion of the updates.  

Investigation by the European Union on OKX Web3 and the Bybit case  

On March 11, Bloomberg revealed that the financial authorities of the European Union were investigating OKX Web3 and the platform’s wallet services. The investigation was initiated after the report of the platform’s possible involvement in laundering funds resulting from the cyberattack suffered by Bybit, another major exchange.

According to Ben Zhou, CEO of Bybit, about 100 million dollars from the 1.5 billion dollar theft against Bybit would have been transferred through OKX Web3, making part of the funds now untraceable.  

OKX promptly responded to the accusations, claiming that the Bloomberg article was misleading. The company stated that it immediately implemented security measures, including the blocking of compromised funds and the development of new hack detection features to prevent suspicious transactions.  

Enhanced system for transaction security  

The objective of OKX is to ensure that transactions are correctly attributed to the DEX that actually execute them, avoiding being mistakenly identified as the exchange point.  

To improve security, the exchange has implemented an advanced system for detecting addresses linked to illicit activities. Thanks to this technology, OKX is able to track and block in real-time the addresses associated with hackers, preventing them from using the platform to move stolen funds.  

The CEO of OKX, Star Xu, stated on March 17 that the company has already introduced many measures to counter the abuse of its Web3 platform. Among these are blocking IPs from prohibited markets and a real-time system to detect and prevent operations with suspicious addresses.  

OKX reiterates its role and distances itself from the accusations  

OKX clarified that its DEX aggregator does not directly hold customer assets, but is solely involved in facilitating access to the liquidity of decentralized protocols. However, the platform reported that some operators have deliberately spread incorrect information to tarnish the exchange’s reputation.  

The company also emphasized that it is the target of targeted attacks by the media, just as it is actively working to combat financial crime in the cryptocurrency sector.  

Conclusion  

The temporary suspension of OKX’s DEX aggregator highlights the growing focus of exchanges on security and regulatory compliance. While financial authorities continue to investigate, the platform is strengthening its protection measures to prevent the illicit use of its services.  

With the implementation of advanced detection systems and the blocking of suspicious IPs, OKX aims to protect its users and the crypto sector from cyber attacks.