OKX relaunches DEX aggregator after allegations of money laundering for DPRK hackers
Developers have implemented an improved anti-fraud protection system in the service
05.05.2025 - 15:15
552
3 min
0
What’s new? OKX has resumed the operation of its decentralized exchange (DEX) aggregator with an improved security system. The service was suspended in March since it was used by DPRK-based hacker group Lazarus to launder assets stolen from crypto exchange Bybit.
What else is known? OKX founder and CEO Star Xu told on X that aggregator DEX is relaunching with several new features, including a “real-time abuse detection and blocking system.”
The DEX aggregator is a service that pulls data from multiple decentralized exchanges and market makers and then presents it to users to help them trade. Star Xu calls OKX Web3 a browser and search engine for the blockchain.
The OKX team clarified that the latest upgrade includes other new security measures to detect suspicious or fraudulent on-chain activity from hackers and other malicious actors:
“Our dynamic database of suspect addresses blocks hackers and bad actors real-time, while proactive alerts warn you about risky transactions.”
The service has partnered with IS companies CertiK, Hacken, and SlowMist, and the infrastructure is being tested as part of an internal bug bounty program.
Another feature added to the on-chain analysis tool categorizes wallet holders, identifying them as possible large holders or snipers. Sniping involves instantly buying new assets on the DEX using automated solutions and then selling them on a sharp rise.
Bloomberg said on March 11 that EU regulators have launched an investigation into aggregator OKX for its involvement in laundering funds from the $1,4 billion Bybit hack in February.
Launder $200 million and walk off into the sunset: how the eXch exchange worked and why it shut down
eXch openly clashed with Bybit even before the latter was hacked for $1,5 billion
Other crypto services have also been implicated in the hack. Crypto exchange eXch announced it was ceasing operations on May 1 following reports that it was used to launder Bybit assets.
Useful material?
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Incidents
The user spent weeks unsuccessfully trying to guess the password until Claude helped find an old wallet backup file
May 14, 2026
Crypto regulations
Authorities are introducing mandatory registration for companies handling cross-border crypto transactions
May 8, 2026

Telegram
Twitter