OKX Suspends DEX Aggregator to Strengthen Security After Lazarus Group Exploit

OKX has temporarily halted its decentralized exchange (DEX) aggregator service to address concerns about misuse by the Lazarus Group, a North Korean hacking organization.
The decision was announced on March 17, after the crypto exchange detected coordinated efforts by the group to exploit its decentralized finance (DeFi) services.
Following consultations with regulatory bodies, OKX opted to suspend the DEX aggregator to implement additional security upgrades designed to prevent future misuse. While the aggregator is under review and enhancement, the company confirmed that crypto wallet services would remain operational, though the creation of new wallets in certain regions would be paused.
READ MORE: Strategy Boosts Bitcoin Holdings to 499,226 BTC with Latest Purchase
This move comes amid increased scrutiny from European regulators, who are investigating the potential role of OKX’s Web3 DEX aggregator and wallet services in facilitating the laundering of funds from the Bybit hack. Reports from Bloomberg indicated that approximately $100 million from the $1.5 billion hack may have been funneled through OKX’s services. In response, the company denied the claims, asserting that it had acted swiftly to freeze any funds associated with the hack and to introduce new measures to enhance security.
In addition to the suspension, OKX has already implemented several measures to combat misuse, including a “hacker address detection system” and real-time blocking of suspicious addresses. The platform also clarified that its Web3 DEX aggregator does not hold customer assets but simply facilitates access to liquidity from multiple protocols. Despite some negative media coverage, OKX reiterated its commitment to combating financial crime and misrepresentation of its platform.