Concerns arose when users started to notice unauthorized transfers from addresses associated with the OKX DEX platform. Previously, these addresses had authorization to perform operations on OKX DEX. There is suspicion that the address 0x1f14e38666cdd8e8975f9acc09e24e9a28fbc42d may be associated with potential wrongdoers, as it was used for significant transactions.
The vulnerability was in an outdated proxy contract on the OKX DEX aggregator platform, which was no longer in use for user operations. It is presumed that OKX updated the contract version but did not deactivate the old version, allowing an unauthorized party to gain control over this contract.
According to analysts from Slowmist, once the hacker gained access to the contract using a compromised private key, they used previous token confirmations provided by users to carry out cryptocurrency asset theft.
OKX has successfully regained access to the contract and has taken the necessary steps to secure the assets of its remaining users. The exchange has also committed to compensate losses for all affected customers and will conduct a thorough security review to prevent similar incidents in the future.
OKX has already reached out to relevant authorities to recover the stolen funds. In the last 30 days, there have been more than 50,000 active addresses on OKX DEX, and the exact number of users affected by the breach is currently unknown.
In November, a cryptocurrency exchange HTX (formerly known as Huobi) and the HECO network suffered an attack that resulted in hackers withdrawing $110 million worth of cryptocurrencies. According to BitOK analysts, November saw the highest cryptocurrency theft of the entire year, leading to losses of nearly $330 million for cryptocurrency market participants.
