Author: Deep Tide TechFlow

Introduction

The shockwaves from the Binance theft of $6.34 billion are still propagating.

Tracing the flow of funds and dissecting attack methods are tasks many are already undertaking, but ultimately, what everyone is concerned about is the fundamental question:

When even exchanges with extremely strong technical reserves are hard to escape unscathed, how should we evaluate safety?

This is also a question that all CEXs are urgently trying to answer:

When the speed, scale, and stealth of attackers (hackers) are rapidly evolving, defenders (exchanges) cannot remain in the old systems and must provide a sense of security to users.

For OKX, which is currently under the spotlight because it has "never been hacked," the answer carries an additional layer of proof: "never being hacked" is not just past luck, but a sustained state.

Regarding the answer to the question, Vitalik Buterin emphasized the "Bunker Mode" concept in a recent interview.

This is a nearly ruthless worst-case assumption:

Assuming that all frontend webpages, API interfaces, employee computers, and even cloud servers are under strict monitoring and infiltration, the only way to survive is to freeze the most core customer assets in an untouchable physical bunker.

Some believe this is a pragmatic security philosophy under current realities, while others feel this mindset is overly passive and conservative. Beyond the "physical bunker":

How to proactively identify undisclosed vulnerabilities or potential attacks and block risks, in addition to defending against attacks?

At the same time, if an attack ultimately occurs, how can the platform ensure user rights are protected?

From this perspective, based on Vitalik's "bunker" concept, a comprehensive security system covering core asset protection, proactive risk defense, and post-event user protection may be gradually taking shape.

Following this three-layer perspective on the upgrade of the CEX security system, OKX, at the heart of this security trust test, may have become an extreme microcosm of the situation.

Bunker, the basic security essential for every CEX

This is the hardest lock for asset security, with a strong wall only to ensure core assets are kept safe as much as possible.

At the same time, it also bears the most intense attacks: capturing the bunker means touching this exchange's trump card, which is an absolute temptation for any hacker.

A layer of bunker separates two worlds: inside the bunker, things are calm; outside the bunker, war rages on.

It can even be said that without a reliable "bunker," no CEX can genuinely claim to have established a "security system."

Thus, secure exchanges should first be viewed from the basic construction of the "bunker."

To protect fund security, OKX's "bunker" is built upon three actions.

Separation of hot and cold wallets:

Hot wallets serve as counters, while cold wallets act as vaults.

By controlling the exposure of assets through physical isolation, over 90% of OKX's assets are stored in completely offline, air-gapped cold wallets, while hot wallets retain only a small amount of liquidity for daily withdrawals.

Multi-signature + Distributed permissions:

The essence of multi-signature is to shift security confidence from "how strong one lock is" to "many people must open the lock."

Funds exiting OKX's cold wallets must undergo independent verification and signatures from multiple parties, with keys held by different individuals in different physical locations. No single person or device can move funds alone. Additionally, the signing environment is isolated from daily development and deployment to prevent single point permissions from being compromised by social engineering or device infiltration.

Hot wallets also implement semi-offline multi-signatures to reduce single-point exposure.

Regular third-party independent audits:

A security system cannot rely solely on internal checks.

OKX collaborates with professional security organizations like Hacken, SlowMist, and CertiK to conduct ongoing system vulnerability assessments and special audits, examining potentially overlooked weak points in the security architecture from an external perspective.

The three actions constitute the foundation of OKX's bunker.

These may not differ significantly from the construction of security bunkers at most other CEXs.

However, what truly distinguishes the fundamental skills are the details between the techniques.

One obvious change is that hacker strategies are shifting from "hard attacks" to "soft attacks." Currently, more attacks targeting exchanges are conducted by infiltrating internal personnel, tools, or processes, leading to the collapse of the entire security system from within, which exemplifies this shift well.

A striking turning point shared by Vitalik coincides with this transformation, where he stated:

Thanks to mature toolchains, audit mechanisms, and formal proofs, incidents of theft caused by underlying pure smart contract logic vulnerabilities have dramatically decreased; however, hacker efforts are now becoming fully directed at frontend interfaces, centralized operation nodes, multi-signature key holders, and complex social engineering infiltrations.

This means that while code vulnerabilities are decreasing, human vulnerabilities are increasing, necessitating an upgrade in bunker construction.

OKX CEO Star Xu also shared similar insights. Following the extensive safety discussions triggered by Binance's theft, Star posted:

Simply having a cold wallet is not enough. Even if private keys are secure and algorithms are robust, if the fund management system is compromised, hackers can still forge withdrawal requests. Therefore, OKX requires the signing system to understand the real content of transactions and to cut off in case of abnormalities, with the development, security, risk control, and internal audit teams jointly reviewing the asset framework.

In other words, security cannot just verify who holds the key, but also why they want to open the door.

Under the record of "never being hacked," perhaps this is a more nuanced step OKX has taken in building the bunker.

More distinctions lie in:

Locking assets prevents hackers from taking them; recognizing and blocking anomalies keeps hackers from getting in.

The former is basic skill, the latter is the new battlefield.

Beyond the bunker: An imbalance in attack and defense intensifies, AI attacks and defenses clash

Why is the security alarm in the crypto industry ringing more frequently?

AI is hard to exonerate.

According to reports, a significant reason behind the recent Binance theft was that the attackers utilized compromised internal AI tools to further control related employees' devices and gradually approach wallet infrastructure.

Immunefi CEO Mitchell Amador has repeatedly warned that AI has completely tipped the balance of attack and defense in favor of attackers.

In the past, vulnerability digging heavily relied on the experience and technical capabilities of security researchers. Now, AI agents can assist in analyzing code, identifying anomalous logic, generating test cases, exploring attack paths, and executing automated testing around the clock.

Even more insidious, AI can also combine deepfake techniques with automated penetration scripts to launch precision attacks against exchange operation personnel and internal signing pipelines, down to millisecond-level timing.

In this regard, Cyvers CEO Deddy Lavid has publicly stated that the crypto industry is "the first market to truly feel the impact of AI."

AI not only leaves more loophole hazards, but it is also making vulnerabilities easier to discover and exploit.

The pivot in the security offense and defense landscape is shifting from technical capabilities to technical efficiencies.

And efficiency is precisely where AI excels.

Previously, one of the core judgments Vitalik repeatedly emphasized is that AI holds great potential on the defense side, particularly against code vulnerabilities and overall network security.

This is easy to understand, considering the duality of technology: AI can be the hacker's sharp "spear," as well as the exchange's defensive "shield."

In fact, this attempt has become quite common, with several platforms, including Coinbase and Fireblocks, communicating to obtain access to Anthropic's latest Claude Mythos model to tackle user-side fraud/scams, transaction anomalies, as well as vulnerabilities in smart contracts/protocols.

In this battle of magic between AI attack and defense, OKX not only belongs to the pioneering group but also strives to integrate AI into multiple security aspects, forming systemic defensive capabilities.

According to a public tweet from OKX Founder and CEO Star on the X platform, from early 2025 onwards, OKX has been exploring the use of AI for vulnerability digging and penetration testing while deeply integrating AI into proactive defense, real-time monitoring, penetration testing, and anti-fraud systems.

In preemptive defense:

OKX's LLM-based automated penetration testing can simulate various attack paths, proactively discovering vulnerabilities in code, configurations, permissions, etc., significantly enhancing the depth, breadth, and efficiency of testing.

Additionally, OKX continuous scanning and assessment of the system using AI assist in vulnerability digging and security self-checks.

The logic is straightforward: rather than waiting for attackers to find vulnerabilities, it’s better for AI to continuously simulate attackers, constantly self-checking the system.

In terms of in-process identification and blocking, OKX's AI security net is tighter and more practical:

SkyNet AI focuses on monitoring on-chain addresses, concentrating on detecting fraudulent addresses on-chain, analyzing blockchain data to real-time mark malicious activities and addresses;

TARDIS focuses on user behavior, identifying abnormal logins, abnormal withdrawals, and suspicious operations through in-depth analysis of user behavior patterns and transaction sequences;

Eagle Eye focuses on identity verification, recognizing AI-driven deepfake detection and identity verification technologies to prevent impersonation, document forgery, and other social engineering attacks.

The investment is deep, and the output is significant.

Internally, according to OKX's official disclosure: they have discovered and fixed a batch of long-hidden security vulnerabilities through AI.

Externally, the OKX security team has submitted vulnerability reports to external infrastructure vendors, one of the most well-known cases being feedback on operating system-related security issues to Apple, resulting in multiple official acknowledgments from Apple, extending their security capabilities to a broader cooperative ecosystem.

On the user side, AI's preventive capabilities are more easily perceived.

According to official website data, the OKX security assistant has detected over 86,000 pieces of malware, issued more than 360,000 transaction risk alerts, and protected over $1.8 billion in USDT, safeguarding more than ten million OKX users' safety.

Another set of more intuitive data comes from the "2026 Mid-Year Web3 Security and Risk Control Report" released by OKX in collaboration with Elliptic, SlowMist, and OttoSec: OKX's risk control system intercepted over 5.7 million high-risk transactions in the first half of the year, blocking over 7 million visits to risky websites and protecting customer assets exceeding $1.1 billion.

Of course, this AI defense system is not a one-time solution; it also faces many issues that are currently beyond reach, such as:

AI may produce numerous noise warnings, possibly leading to false positives/negatives;

Bias in training data can result in unfair decision-making;

Currently, AI also lacks clear authority boundaries, behavioral red lines, and the identification of responsible parties in case problems arise.

This means that while AI makes defense more sensitive, it does not make security simpler. This is a common industry issue that requires long-term reconciliation between technology and practice.

Yet, behind every interception is a real loss prevention, and loss prevention itself is the most worthy aspect to be validated in security.

The last link: "Affordability" is the true sense of security

No platform can promise 100% safety.

In an era where attack methods are continually upgrading and risk boundaries are constantly expanding, this statement has perhaps become a reality all CEXs must face.

Thus, while we strive to avoid incidents, we must still consider:

If the defense line ultimately falters, who will cover the asset losses?

This is becoming an increasingly significant metric for users assessing platform security, which also explains why Binance's recent theft of $6 billion, though large in scale and high in attention, did not cause widespread panic; a considerable part of the reason is:

Binance stated it would compensate, and the market has confidence that Binance can afford to compensate.

This confidence stems from several factors:

• The backing of revenue capability from large platforms, with a long-accumulated base.
• Solid everyday work, with reserve proofs that can be verified at any time.
• A security fund clearly established, with known compensation capability.

Among these three aspects, in the current competitive landscape, OKX may be one of the few platforms capable of going head-to-head with Binance.

In terms of revenue and capital, OKX also has support: on one hand, like Binance, OKX is a major player with annual revenue in the billion-dollar range; on the other hand, in March 2026, OKX secured strategic investment from ICE, the parent company of the New York Stock Exchange, with a valuation of approximately $25 billion, which supports revenue growth and recognizes OKX's strong profitability at the institutional level.

In terms of concrete measures, after the FTX collapse, OKX was one of the first CEXs to implement proof of reserves.

Since the first release of proof of reserves in November 2022, it has consistently published PoR monthly, increasing the number of reported currency types from an initial three to over twenty, and successively introducing technologies such as Merkle trees, Merkle tree summaries, and zk-STARK zero-knowledge proofs to continuously upgrade the proof of reserves verification system.

On November 2, 2026, OKX released the 49th proof of reserves (PoR), with the total value of 21 PoR assets reaching $33.8 billion and a reserve ratio of 100%, including mainstream tokens valued at $27.8 billion (BTC, ETH, USDT, USDC), clearly conveying to everyone: whether the assets deposited on the platform have real, verifiable reserves as support.

The OKX Shield plan is another layer of assurance for users' peace of mind.

As a compensation plan that users can voluntarily participate in and is reviewed according to specific terms, OKX Shield was initiated with the goal of guiding users to strengthen their security protection: to activate this plan, users must first complete security checklists such as activating Passkey, enabling large withdrawal protection, enabling webpage withdrawal protection, and setting up MFA.

When issues genuinely occur, OKX will provide eligible users who have been hacked with up to $500,000 in additional financial compensation protection, including unauthorized third-party access or control of accounts and asset transfers, abnormal logins after credential phishing, and malicious software or remote control attacks.

CEX Security: There are no permanent full scores, only continuously updated test questions

Finally, back to the beginning:

After experiencing a series of breaches from various CEXs, how should we assess CEX security?

Before incidents occur, no one can provide a standard answer.

But what can be confirmed is:

Starting with CEX, crypto security has entered an era of continuous confrontation and dynamic evolution of offense and defense.

As OKX founder Star himself said in a post following the Binance theft:

Security has never been a project that can be declared complete; it is an endless responsibility.

In the past, security was a static report card, focused more on traditional means such as code auditing, permission management, and the separation of hot and cold wallets;

Now, with AI accelerating vulnerability digging, attack path exploration, and social engineering attacks, security boundaries are extending from code, systems, and funds to personnel, organizations, and even the entire supply chain. Defense must also shift from passive response to proactive identification, from single-point protection to systematic and layered defenses.

Safety does not have a permanent full score, only continuously updated test questions.

OKX, like all its peers, is still in the examination room.

And continually enhancing the ability to answer questions may well be the most effective trust passport in the new cycle.