Author uses Claude Opus5.5 + Blender to review OKX's five-year comeback

Seeing this cartoon, I feel both proud and enormous pressure. We never say that OKX is absolutely safe, let alone that we are immune to any attack. No company can truly achieve that. But I can say responsibly that OKX has always made security and the protection of customer assets its first lifeline. Behind the security record of the past 13 years are more than a decade of continuous technological investment, engineering accumulation, security system building, real-world experience, and strict operational management. We have always faced various security threats with a professional and serious attitude, rather than treating security as a marketing gimmick. In places that everyone cannot see, OKX has built a large amount of independently developed security technology, internal systems, strategies, and frameworks, as well as ongoing penetration testing and independent audits. For security reasons, many of these core mechanisms and technical details cannot be made public. These are security capabilities we have accumulated over the long term, and they are constantly being tested, challenged, and upgraded. There is one thing I can share with everyone: since the recent security incident at Binance, the entire OKX team has likewise been very busy, and many security, technology, and risk control colleagues have been fighting day and night. Not because OKX was attacked, but because a security incident at any major exchange is a warning to the entire industry. When some people treat a peer's security incident as an opportunity to launch marketing campaigns, attract traffic, and compete for market share, we choose to focus our energy on other things. During this period, our team has been continuously working on four aspects: 1. Tracking the flow of stolen funds in real time. We monitor the on-chain movement of relevant stolen funds with second-level latency, continuously identify suspicious addresses and transactions, and take necessary measures to do our utmost to prevent stolen funds from being transferred and laundered through the OKX exchange and Web3 DEX aggregator. 2. Comprehensively strengthening market risk control. We assess the market risks that a security incident may trigger, tighten relevant risk control measures further when necessary, and guard in advance against liquidity shocks, cascading liquidations, and potential market stampedes, doing our utmost to prevent risk from spreading and to protect users and the entire industry. 3. Deeply analyzing attack patterns and potential vulnerabilities. We study the technical means, attack paths, and potential vulnerabilities that attackers may use, with particular attention to the security of the software development supply chain of crypto companies, as well as new security threats that may be introduced by AI Coding Agents and related dependency components. 4. Using our peer's lessons as a mirror to re-examine our own security system. We conduct in-depth, systematic inspections and reviews of internal controls, permission management, wallet infrastructure, security architecture, and more, continuously discovering problems, challenging assumptions, and improving our defense system. We must never assume that because no similar incident has occurred in the past, none will occur in the future. Security is never a project that can be declared complete, but an endless responsibility. It requires continuous investment, professional technology, strict execution, and, above all, always maintaining humility, vigilance, and self-doubt. When a peer is attacked, we do not choose to attract attention and traffic through high-profile marketing, but instead choose to work harder to protect our customers and do our utmost to safeguard the security and stability of the entire industry. Commercial competition should be reflected in better products, technology, and services. But in the face of security, the entire industry should stand together. Protecting customer assets is the first responsibility that OKX can never compromise on. Thank you all for your trust. We will always remain in awe, not dare to slack off in the slightest, and never take everyone's trust for granted.

View original

看到这张漫画，我既感到自豪，也感受到巨大的压力。 我们从来不说 OKX 绝对安全，更不说我们能够免疫任何攻击。没有任何一家公司可以真正做到这一点。 但我可以负责任地说，OKX 始终把安全和保护客户资产作为第一生命线。 过去 13 年的安全记录，背后是十几年持续不断的技术投入、工程积累、安全体系建设、实战经验和严格的运营管理。 我们始终以专业、严肃的态度面对各种安全威胁，而不是把安全当成营销噱头。 在大家看不到的地方，OKX 建立了大量自主研发的安全技术、内部系统、策略、框架，以及持续进行的渗透测试和独立审计。出于安全原因，其中很多核心机制和技术细节无法公开。这些都是我们长期积累的安全能力，也在不断接受检验、挑战和升级。 有一件事情，我可以和大家分享：自从最近 Binance 发生安全事件以来，整个 OKX 团队同样非常忙碌，很多安全、技术和风控同事都在日夜奋战。 不是因为 OKX 遭到了攻击，而是因为任何一家大型交易所遭遇的安全事件，都是对整个行业的一次警示。 当一些人把友商遭遇安全事件当成推出营销活动、吸引流量、争夺市场份额的机会时，我们选择把精力放在另外一些事情上。 过去这段时间，我们的团队一直在围绕四个方面持续工作： 1. 实时追踪被盗资金流向。 以秒级延迟监控相关被盗资金的链上流转，持续识别可疑地址和交易，并采取必要措施，尽最大努力阻止被盗资金通过 OKX 交易所及 Web3 DEX 聚合器进行转移和洗钱。 2. 全面加强市场风险控制。 评估安全事件可能引发的市场风险，必要时进一步收紧相关风控措施，提前防范流动性冲击、连环清算和潜在的市场踩踏，尽最大努力避免风险扩散，保护用户和整个行业。 3. 深入分析攻击模式和潜在漏洞。 研究攻击者可能采用的技术手段、攻击路径和潜在漏洞，特别关注 Crypto 企业的软件开发供应链安全，以及 AI Coding Agent 和相关依赖组件可能引入的新型安全威胁。 4. 以友商的教训为镜子，重新审视我们自己的安全体系。 对内部控制、权限管理、钱包基础设施、安全架构等进行深入、系统性的检查和复盘，持续发现问题、挑战假设、完善防御体系。 我们绝不能因为过去没有发生过类似事件，就认为未来也不会发生。 安全从来不是一个可以宣布完成的项目，而是一项永无止境的责任。 它需要持续的投入、专业的技术、严格的执行，更需要始终保持谦卑、警惕和自我怀疑。 在友商遭遇攻击的时候，我们不选择通过高调营销来吸引眼球和流量，而是选择更加努力地工作，保护我们的客户，也尽自己最大的努力维护整个行业的安全和稳定。 商业竞争应该体现在更好的产品、技术和服务上。 但在安全面前，整个行业应该站在一起。 保护客户资产，是 OKX 永远不能妥协的第一责任。 感谢大家的信任。我们会始终保持敬畏，不敢有丝毫懈怠，更不会把大家的信任视为理所当然。