Kween👑 📈

Great to keep building with Mastercard. 🤝 Stablecoins are moving beyond trading and becoming part of everyday financial life. With OKX Card, we’re connecting digital assets to real-world payments—making spending as simple and seamless as using any traditional card, while rewarding users along the way. More to come. 🚀

看到这张漫画，我既感到自豪，也感受到巨大的压力。 我们从来不说 OKX 绝对安全，更不说我们能够免疫任何攻击。没有任何一家公司可以真正做到这一点。 但我可以负责任地说，OKX 始终把安全和保护客户资产作为第一生命线。 过去 13 年的安全记录，背后是十几年持续不断的技术投入、工程积累、安全体系建设、实战经验和严格的运营管理。 我们始终以专业、严肃的态度面对各种安全威胁，而不是把安全当成营销噱头。 在大家看不到的地方，OKX 建立了大量自主研发的安全技术、内部系统、策略、框架，以及持续进行的渗透测试和独立审计。出于安全原因，其中很多核心机制和技术细节无法公开。这些都是我们长期积累的安全能力，也在不断接受检验、挑战和升级。 有一件事情，我可以和大家分享：自从最近 Binance 发生安全事件以来，整个 OKX 团队同样非常忙碌，很多安全、技术和风控同事都在日夜奋战。 不是因为 OKX 遭到了攻击，而是因为任何一家大型交易所遭遇的安全事件，都是对整个行业的一次警示。 当一些人把友商遭遇安全事件当成推出营销活动、吸引流量、争夺市场份额的机会时，我们选择把精力放在另外一些事情上。 过去这段时间，我们的团队一直在围绕四个方面持续工作： 1. 实时追踪被盗资金流向。 以秒级延迟监控相关被盗资金的链上流转，持续识别可疑地址和交易，并采取必要措施，尽最大努力阻止被盗资金通过 OKX 交易所及 Web3 DEX 聚合器进行转移和洗钱。 2. 全面加强市场风险控制。 评估安全事件可能引发的市场风险，必要时进一步收紧相关风控措施，提前防范流动性冲击、连环清算和潜在的市场踩踏，尽最大努力避免风险扩散，保护用户和整个行业。 3. 深入分析攻击模式和潜在漏洞。 研究攻击者可能采用的技术手段、攻击路径和潜在漏洞，特别关注 Crypto 企业的软件开发供应链安全，以及 AI Coding Agent 和相关依赖组件可能引入的新型安全威胁。 4. 以友商的教训为镜子，重新审视我们自己的安全体系。 对内部控制、权限管理、钱包基础设施、安全架构等进行深入、系统性的检查和复盘，持续发现问题、挑战假设、完善防御体系。 我们绝不能因为过去没有发生过类似事件，就认为未来也不会发生。 安全从来不是一个可以宣布完成的项目，而是一项永无止境的责任。 它需要持续的投入、专业的技术、严格的执行，更需要始终保持谦卑、警惕和自我怀疑。 在友商遭遇攻击的时候，我们不选择通过高调营销来吸引眼球和流量，而是选择更加努力地工作，保护我们的客户，也尽自己最大的努力维护整个行业的安全和稳定。 商业竞争应该体现在更好的产品、技术和服务上。 但在安全面前，整个行业应该站在一起。 保护客户资产，是 OKX 永远不能妥协的第一责任。 感谢大家的信任。我们会始终保持敬畏，不敢有丝毫懈怠，更不会把大家的信任视为理所当然。

This cartoon makes me feel both proud and under tremendous pressure. I will never claim that OKX is absolutely safe or immune to attacks. No company can honestly make that promise. What I can say is that OKX has always treated security and the protection of customer assets as our highest priority. Our 13-year track record reflects more than a decade of continuous investment, engineering, operational discipline, and hard-earned experience. We take security threats seriously and professionally—not as a marketing opportunity. Behind the scenes, we have built extensive layers of proprietary technology, internal security systems, strategies, frameworks, penetration testing, and independent audits. Much of this infrastructure cannot be disclosed publicly for security reasons. But these capabilities are constantly being tested, challenged, and improved. Here’s something I can share: since the recent Binance security incident, the entire OKX team has been working just as hard and staying just as busy as the teams directly responding to the attack. Not because OKX was compromised. But because an attack on one major exchange is a warning to the entire industry. While some may see such moments as opportunities to launch promotional campaigns, generate traffic, or compete for market share, our priority has been different. Our teams have been working around the clock on four critical areas: 1. Tracking stolen funds in real time. Monitoring the movement of funds associated with the incident with second-level latency, identifying suspicious addresses and transactions, and taking available measures to prevent stolen funds from being laundered through OKX Exchange or our Web3 DEX aggregator. 2. Strengthening market risk controls. Assessing the potential market impact of the incident, tightening risk controls where necessary, and preparing for liquidity shocks or cascading liquidations that could threaten users and the broader market. 3. Analyzing emerging attack techniques. Studying the attack patterns, potential vulnerabilities, and methodologies involved, including threats to software development supply chains and the rapidly evolving security risks introduced by AI coding agents and their dependencies. 4. Challenging our own security assumptions. Using the lessons from this incident to conduct a fundamental review of our internal controls, access management, wallet infrastructure, and security architecture. We don’t assume that what protected us yesterday will necessarily protect us tomorrow. Security is never a finished project. It is a continuous responsibility that requires humility, vigilance, investment, and execution. We don’t choose to be the loudest when another company is under attack. We choose to work harder to protect our customers and strengthen the resilience of the entire industry. Competition should drive better products and services. Security should bring the industry together. Protecting customer assets is our first responsibility. And we will never take your trust for granted.

谢谢信任，OKX 一定不负所托。🙏 OKX 始终把安全和保护客户资产视为第一生命线。 事实上，OKX 每个月都会检测并应对各种各样的网络攻击，包括针对 Crypto 行业的高级持续性威胁（APT）攻击。正是过去 13 年持续积累的安全体系、技术能力和实战经验，让我们能够在复杂的安全威胁下始终保持平稳运行。 早在一年多以前，OKX 就启动了基于 LLM 的自动化渗透测试，持续提升安全测试的深度、广度和效率，进一步增强我们在 AI 时代的安全防御能力。 我们有信心，未来的 OKX 会更加安全。但我们也非常清楚，安全永远没有终点，更不能因为过去的成绩而产生任何侥幸心理。 对于近期友商遭遇的安全事件，我们一定会认真吸取经验教训，全面加强自查，持续完善安全体系，始终保持谦卑和警惕。 保护客户资产，是 OKX 永远不能妥协的底线。

With OKX Card, our goal is to make spending crypto as seamless as using a traditional card—with zero annual fees, zero monthly fees, and no added OKX FX fees. More importantly, users stay in control of their assets. Great to see the feedback. We’ll keep building. 💳🚀

Circle and Tether did a Great job this time. The crypto industry, including exchanges and stablecoin issuers, should work together to build an industry-wide security response mechanism. We need a real-time alert system that allows participants to share information immediately when a hack occurs, coordinate a rapid response, and temporarily freeze suspected stolen funds before they can be moved or laundered. Speed is critical. We should establish standardized protocols, clear responsibilities, and appropriate safeguards to ensure we can act within minutes, not hours or days. Protecting users and their assets should be a shared responsibility across the entire industry, not just individual platforms.

The recent security incidents involving Bybit, Bitget, and now Binance should serve as a wake-up call for every leader in the crypto industry. Security should never be an area of commercial competition. It is a shared responsibility to protect our customers and the entire industry. Over the past decade, major crypto exchanges have made significant progress in protecting private keys. We have seen relatively few incidents involving direct private key compromises in recent years. So far, we have not seen conclusive evidence that Binance’s hot wallet private key was leaked. The greater concern may lie in vulnerabilities in access controls and wallet management systems. Companies that have never experienced a major security incident should not assume they are inherently safer or immune to attacks. At OKX, we have built multiple layers of sophisticated security protection and maintained a strong security track record over the past decade. But we also recognize that no system is absolutely secure. We must remain humble, vigilant, and constantly challenge our own security assumptions. A major security breach at any exchange undermines trust in the entire crypto industry, ultimately hurting every company and every customer. I believe CEOs across the industry need to come together, just as we did during the Bitcoin fork crisis in 2017, to establish stronger industry-wide security standards and coordinated response mechanisms. For example, transfers and settlements between verified exchanges could be processed in real time, while large withdrawals to unknown or unverified addresses, as well as transactions granting smart contract permissions, should be subject to additional verification and appropriate security delays. Crucially, these safeguards should be enforced at the cryptographic signing layer, rather than relying solely on application-level controls. Even if an attacker compromises an exchange’s wallet management system, they should not be able to bypass these fundamental security restrictions. We should also establish industry-wide mechanisms for real-time security incident notifications, coordinated monitoring of suspicious funds, and rapid responses to potential attacks. Exchanges, stablecoin issuers, and other major industry participants should work together to enable the rapid, lawful temporary freezing of suspected stolen assets when necessary. We should also work together to accelerate the industry’s transition to quantum-resistant cryptography and strengthen our defenses against emerging AI-powered security threats. These are long-term challenges that no single company can solve alone, and they require coordinated research, shared standards, and collective action across the industry. Security is everyone’s responsibility. No company can protect the future of crypto alone.

Our priority is protecting users, maintaining market stability, and supporting the broader crypto community. Industry resilience is a shared responsibility.