The cryptocurrency exchange OKX and its security partner SlowMist are investigating a major exploit that resulted in the theft of assets from two users.

The investigation pertains to the theft of two accounts on the OKX exchange, which occurred on June 9 through a SIM-swap attack. This information was reported by Yu Jian, founder of SlowMist, in a post on X.

Although the exact amount of stolen funds is unknown, Jian noted that “assets worth millions of dollars were stolen.”

SlowMist: 2FA is Not the Main Issue in the Attack

The security firm SlowMist continues to investigate the incident, and the exchange’s two-factor authentication (2FA) mechanisms may not be the primary vulnerability.

In a post on X dated June 9, Yu Jian wrote:

“I did not enable a 2FA authenticator such as Google Authenticator, but I am not sure if this is the key point.”

According to the analysis by the Web3 security group Dilation Effect, OKX’s 2FA mechanism allowed the attackers to switch to a less secure verification method, enabling them to whitelist withdrawal addresses through SMS verification.

However, more experienced hackers have begun to bypass 2FA methods. In early June, a Chinese trader lost $1 million due to fraud involving a Google Chrome ad plugin called Aggr. This plugin steals users' cookies, which are then used by hackers to bypass passwords and 2FA.

Increase in Phishing Attacks

In June, the number of phishing attacks increased after CoinGecko confirmed a data breach on its third-party email management platform GetResponse. As a result of the breach, the attacker sent 23,723 phishing emails.

Phishing attacks aim to steal sensitive information such as private keys of cryptocurrency wallets. Some attacks, known as address poisoning scams, trick investors into voluntarily sending funds to fraudulent addresses similar to those they have previously interacted with.

Leaks of private keys and personal data have become the main cause of cryptocurrency-related breaches, as attackers target the easiest victims.

According to the HackHub report by Merkle Science for 2024, over 55% of hacked digital assets were lost due to private key leaks in 2023.