OKX DEX aggregator hack — December 2023

The OKX DEX aggregator was drained on 12 December 2023 after the private key controlling the proxy admin of one of its contracts was compromised. Reports place the first malicious transaction at 22:23 UTC.

SlowMist, which published the first technical account, said the proxy admin owner's key appeared to have been leaked. With it, the attacker upgraded the DEX proxy implementation to malicious code and called claimTokens directly, moving tokens out of wallets that had granted allowances to OKX's TokenApprove contract. Assets were taken from eighteen addresses tied to a deprecated market-making contract; reported tokens included WETH, USDC, USDT, SHIB, ELON and BTT. SlowMist noted the attacker upgraded the contract a second time and continued draining afterwards.

The size of the loss is disputed. PeckShield put it at more than $2.7 million, and that is the figure carried by most coverage. OKX's own assessment, reported through its Chinese-language channels, was far lower, around $370,000 and in any case under $400,000. Neither side published a reconciliation and the gap has never been explained; the two figures may be measuring different things, such as total outflows from all affected addresses versus the subset OKX regarded as its own liability.

OKX described the incident as the theft of management rights over an abandoned market-maker contract no longer in use, said it had secured user funds and revoked the contract's permissions, and committed to reimbursing affected users while working with authorities on recovery. Arkham Intelligence linked the same actor to exploits of LunaFi, Uno Re and RVLT and offered a 5,000 ARKM bounty for identifying information. No arrest or formal attribution has been reported.