When Hacker Attacks Shift from "Hard" to "Soft": Integrated Defense, Prevention, and Compensation Have Changed the CEX Security Logic

Author: TechFlow

Introduction

The aftershocks of the $6.34 billion Binance hack continue to ripple.

Tracing fund flows and dissecting attack methodologies are already being done by many, but at its core, the fundamental question everyone is concerned about is:

When even exchanges with exceptionally robust technical reserves cannot escape such incidents, how should we truly evaluate security?

This is also an urgent question that all CEXs are keen to answer:

As the offensive side (hackers) rapidly evolves in speed, scale, and stealth, the defensive side (exchanges) cannot remain stuck in outdated systems; they must provide users with a sufficient sense of security.

And for OKX, which has recently garnered significant attention due to its "never been hacked" record, the answer comes with an additional layer of proof: "never been hacked" is not a past fluke, but a continuous state.

On this matter, Vitalik Buterin recently highlighted the concept of "Bunker Mode" in an interview.

This is a nearly cold-hearted worst-case scenario assumption:

Assuming all front-end web pages, API interfaces, employee computers, and even cloud servers are under strict surveillance and infiltration, the only way to survive is to freeze the most critical customer assets in an untouchable physical bunker.

Some consider this a highly pragmatic security philosophy under current realities, while others find the concept too passive and conservative. Beyond the "physical bunker":

Beyond defending against attacks, how can unexposed vulnerabilities or potential threats be proactively discovered and risks blocked?

Meanwhile, if an attack ultimately occurs, how should the platform step in to safeguard user interests?

From this perspective, extending from Vitalik's "bunker" concept, a layered security framework covering core asset protection, proactive risk defense, and post-incident user guarantees may now be taking shape.

Viewing this CEX security upgrade through these three layers, every move made by OKX, situated at the center of this trust test, might well serve as a definitive microcosm.

The Bunker: A Security Fundamental for Every CEX

This is the hardest lock for asset security, a fortress designed solely to ensure core assets are as protected as possible.

At the same time, it faces the most intense attacks: breaching the bunker means acquiring the exchange's ultimate cards, an absolute temptation for any hacker.

A single bunker divides two worlds: tranquility inside, warfare outside.

One could even say that without a reliable "bunker," no CEX can truly claim to have established a "security system."

Therefore, exchange security must first be evaluated starting from the fundamentals of "bunker" construction.

To guard fund security, OKX's "bunker" is built on three key actions.

Segregation of hot and cold wallets:

Hot wallets act as counters, while cold wallets serve as vaults.

Through physical isolation to control asset exposure, over 90% of OKX's assets are stored in fully offline, air-gapped cold wallets, with only a small amount of liquidity kept in hot wallets for daily withdrawals.

Multi-signature + Distributed permissions:

The essence of multi-sig shifts the confidence in security from "how secure a single lock is" to "requiring multiple people to unlock it."

OKX cold wallet withdrawals require independent verification and signatures from multiple parties. Keys are held by different individuals across different physical locations, ensuring no single person or device can move funds alone. Meanwhile, the signing environment is isolated from daily development and deployment to prevent single-point compromises via social engineering or device infiltration.

Hot wallets employ semi-offline multi-sig to reduce single-point exposure.

Regular third-party independent audits:

A security system cannot rely solely on internal self-checks.

OKX collaborates with professional security firms like Hacken, SlowMist, and CertiK to conduct continuous system vulnerability assessments and specialized audits, identifying potential weak links in the security architecture from an external perspective.

These three actions form the foundational base of OKX's bunker.

This may not differ significantly from the security bunker construction of most other CEXs.

Yet between identical fundamentals, what truly creates a gap are the details in their execution.

A clear shift is evident: hacker strategies are transitioning from "hard attacks" to "soft attacks." The growing trend of exchanges being compromised by infiltrating internal personnel, tools, or processes, ultimately causing the entire security system to collapse from within, perfectly illustrates this point.

A sharp watershed shared by Vitalik aligns with this transition, stating:

Thanks to mature toolchains, audit mechanisms, and formal verification, hacker thefts caused purely by smart contract logic vulnerabilities have plummeted; however, hacker firepower has completely shifted to front-end interaction interfaces, centralized operational nodes, multi-signature private key holders, and complex social engineering intrusions.

This means code vulnerabilities are decreasing while human vulnerabilities are increasing, necessitating upgrades to bunker construction accordingly.

OKX CEO Star Xu also holds a similar insight. When the Binance hack sparked extensive CEX security discussions, Star posted:

Cold wallets alone are insufficient. Even with secure private keys and robust algorithms, if the treasury management system is breached, hackers can still forge withdrawal requests. Therefore, OKX requires its signature system to understand the substantive content of transactions and trigger circuit breakers during anomalies. Development, security, risk control, and internal audit teams jointly review the asset framework.

In other words, security cannot only verify who holds the key, but also why they want to open the door.

Beneath the "never hacked" record, this may represent a more nuanced step taken by OKX in bunker construction.

Greater differences are built upon:

Locking assets prevents hackers from taking them; identifying and blocking anomalies prevents hackers from getting in.

The former is a fundamental skill, the latter a new battlefield.

Beyond the Bunker: Intensifying Offense-Defense Imbalance, AI Spells Clash on Both Sides

Why are security alarms in the crypto industry sounding increasingly frequently?

AI cannot escape the blame.

According to reports, a key factor in the recent Binance hack was that attackers exploited compromised internal AI tools to further control employees' devices, gradually approaching wallet infrastructure.

Immunefi CEO Mitchell Amador has repeatedly warned that AI has completely tipped the offense-defense balance in favor of attackers.

In the past, vulnerability mining heavily relied on the expertise and technical skills of security researchers. Now, AI Agents can assist 24/7 without interruption in analyzing code, identifying anomalous logic, generating test cases, exploring attack paths, and repeatedly executing automated tests.

Even harder to guard against, AI can combine deepfake technology with automated penetration scripts to launch millisecond-precision attacks targeting exchange operations personnel and internal signature pipelines.

Regarding this, Cyvers CEO Deddy Lavid once publicly stated: The crypto industry is "the first market to truly feel the impact of AI".

AI not only leaves behind more vulnerability risks but is also making vulnerabilities easier to discover and exploit.

The watershed between security offense and defense is shifting from technical capability to technical efficiency.

And efficiency is precisely AI's forte.

Prior to this, a core judgment Vitalik emphasized multiple times is: AI possesses immense potential on the defensive end, particularly for code vulnerabilities and overall cybersecurity.

This is hardly difficult to grasp, viewing the duality of technology: AI can be hackers' handy "spear," or it can be the exchanges' defensive "shield."

In fact, such attempts have become quite common. For example, several platforms including Coinbase and Fireblocks are negotiating access to Anthropic's latest Claude Mythos model to address user-side fraud/scams, transaction anomalies, and vulnerability discovery and verification at the smart contract/protocol level.

In this clash of AI spells on both offense and defense sides, OKX not only belongs to the vanguard but is dedicated to expanding from individual points to broader coverage, integrating AI into multiple security phases to form systematic defensive capabilities.

According to public tweets from OKX founder and CEO Star on X, since early 2025, OKX has explored using AI for vulnerability mining and penetration testing, deeply integrating it into proactive defense, real-time monitoring, penetration testing, and anti-fraud systems.

Regarding preventive defense:

OKX's LLM-based automated penetration testing can simulate various attack paths to identify vulnerabilities in code, configuration, and permissions in advance, significantly enhancing the depth, breadth, and efficiency of testing.

Additionally, OKX utilizes AI to continuously scan and evaluate systems, assisting in vulnerability mining and security self-assessments.

This logic is straightforward: rather than waiting for attackers to find vulnerabilities, let AI continuously simulate attackers and constantly self-inspect the system.

Regarding in-process identification and blocking, OKX's AI security network is denser and more robust:

SkyNet AI monitors on-chain addresses, focusing on detecting fraudulent on-chain addresses by analyzing blockchain data to instantly flag malicious activities and addresses;

TARDIS closely watches user behavior, identifying anomalous logins, unusual withdrawals, and suspicious actions through deep analysis of user behavior patterns and transaction sequences;

Eagle Eye focuses on identity verification, recognizing AI-driven deepfake detection and authentication technologies to prevent impersonation, document forgery, and other social engineering attacks.

The investments run deep, and the returns are equally significant.

Internally, according to official OKX disclosures: AI has been used to discover and patch a series of long-hidden security vulnerabilities.

Externally, the OKX security team has also submitted vulnerability reports to third-party infrastructure vendors, most notably reporting OS-related security issues to Apple. Having received official acknowledgment from Apple multiple times, OKX extends its security capabilities to a broader collaborative ecosystem.

For users, AI prevention and control capabilities are more easily perceptible.

According to official website data, the OKX Security Assistant has detected over 86,000 pieces of malware, issued over 360,000 transaction risk alerts, protected over $1.8 billion in USDT, and secured the safety of tens of millions of OKX users.

Another set of more intuitive data comes from the "H1 2026 Web3 Security and Risk Control Report" co-published by OKX with Elliptic, SlowMist, and OttoSec: OKX's risk control system intercepted over 5.7 million high-risk transactions in the first half of the year, blocked over 7 million visits to risky websites, and protected over $1.1 billion in customer assets.

Of course, this AI defense system is not a silver bullet, and it currently faces many limitations, such as:

AI may generate excessive noisy alerts, potentially leading to false positives or missed detections;

Training data bias could lead to unfair alert decisions;

Currently, AI lacks clear permission boundaries, behavioral red lines, and defined liability frameworks for when issues arise.

In other words, AI makes defenses sharper but does not make security simpler. This is an industry-wide challenge that requires long-term refinement between technology and practice.

But behind every interception lies real loss mitigation, and mitigating losses is precisely where the value of security needs to be verified.

The Final Link: "Affordability" is True Security

No platform can guarantee itself to be 100% secure.

With attack methods constantly escalating and risk boundaries continuously expanding, this statement may well have become a reality all CEXs must face.

Thus, while doing everything possible to avoid incidents, we must still consider:

If the defenses ultimately fall, who will cover the asset losses?

This is becoming an increasingly important metric for users when evaluating platform security. It also explains why Binance's recent $6.3 billion hack, despite its massive scale and high visibility, did not trigger widespread panic, largely because:

Binance committed to compensation, and the market has confidence that Binance can afford it.

This confidence stems from several factors:

Backed by the revenue capacity of large platforms with substantial accumulated reserves

Routine work is solidly executed, with proof of reserves available for inspection at any time

The security fund is explicitly allocated, with clear compensation capabilities

Across these three aspects, within the current competitive landscape, OKX may well be one of the few platforms capable of holding its own against Binance.

On the revenue and capital fronts, OKX also has strong backing: On one hand, like Binance, OKX operates as a major exchange with annual revenues in the billions; on the other hand, in March 2026, OKX secured strategic investment from ICE, the parent company of the NYSE, valuing it at approximately $25 billion, which supports revenue growth and serves as institutional recognition of OKX's robust profitability.

Regarding specific measures, following the FTX collapse, OKX was among the first CEXs to implement Proof of Reserves.

Since its first PoR release in November 2022, OKX has consistently published monthly reports, expanding the disclosed asset count from 3 initially to over 20. It has sequentially introduced Merkle trees, panoramic Merkle trees, and zk-STARK zero-knowledge proof technologies, continuously upgrading its reserve verification system.

On November 2, 2026, OKX released its 49th Proof of Reserves (PoR), with total assets across 21 PoRs reaching $33.8 billion, all maintaining a 100% reserve ratio, including mainstream assets valued at $27.8 billion (BTC, ETH, USDT, USDC), clearly demonstrating whether user deposits on the platform are backed by genuine, verifiable reserves.

The OKX Shield program serves as another layer of reassurance for users.

As a voluntary compensation plan subject to specific eligibility reviews, OKX Shield aims to guide users toward strengthening security from the outset: participants must first complete a security checklist, including enabling Passkeys, high withdrawal limits protection, web withdrawal protection, and setting up MFA.

In the event of actual incidents, OKX will provide eligible hacked users with up to $500,000 in additional financial compensation coverage, covering scenarios such as unauthorized third-party access or account control with asset transfers, abnormal logins and unauthorized transfers following credential phishing, and malware or remote control attacks.

CEX Security: No Permanent Perfect Scores, Only Continuously Updated Examinations

Finally, returning to the beginning:

After experiencing consecutive breaches across multiple CEXs, how should we truly evaluate CEX security?

No one can provide a standard answer before incidents occur.

What is certain is:

Starting with CEXs, crypto security has entered an era of continuous confrontation and dynamic evolution in offense and defense.

As OKX founder Star himself posted following the Binance hack:

Security has never been a project that can be declared complete, but rather an endless responsibility.

In the past, security was a static report card, primarily revolving around traditional methods like code audits, permission management, and hot-cold wallet segregation;

Today, with AI accelerating vulnerability mining, attack path exploration, and social engineering, security boundaries are extending from code, systems, and funds to personnel, organizations, and even entire supply chains. Defenses must also shift from reactive responses to proactive identification, and from point-to-point protection to systematic layered defense.

Security holds no permanent perfect scores, only continuously updated examinations.

Like all its peers, OKX remains in the examination hall.

And continuously improving answering capabilities may well be the most effective passport for trust in this new cycle.