OKX, a leading cryptocurrency exchange, is facing a significant outflow of funds totaling $837 million in the past week, amid rumors of security breaches and suspected SIM swap hack. The exchange has lost $204 million in the past 24 hours alone, surpassing the outflows of other exchanges, according to data from Defillama. In contrast, Binance, OKX's main competitor, has enjoyed a net inflow of $1.364 billion during the same period.

The security concerns at OKX have been heightened by user reports of major thefts, with two users reportedly losing their funds last week due to a sophisticated SIM swap attack. The attackers breached the SMS notification security of the OKX platform, creating new API keys with withdrawal and trading permissions, leading to significant losses. Although initially suspected to be cross-trading attempts, this theory has since been dismissed.

The security breaches at OKX have led to a significant drop in the price of its native cryptocurrency, OKB, which has fallen by over 4.5% from $47.72 to $45.78. Despite this decline, the daily trading volume of OKB has surged by over 31% in the past 24 hours, reaching $6.7 million, indicating continued market activity.

The exchange has launched an investigation into the security breaches and is working to identify the root cause of the hacks. However, many users have continued to withdraw their funds, making OKX the exchange with the largest outflows in the past seven days. While the exchange grapples with these security challenges, blockchain investigators have come up with different theories pertaining to the possible cause of the attacks.

According to Yu Xian, the founder of blockchain security firm SlowMist, the thieves exploited a loophole on OKX's two-factor authentication system to conduct the attack. The method involved sending the victims SMS risk notifications that originated from Hong Kong before creating a new API key as part of their account authentication process. A group of crypto security enthusiasts known as Dilation Effect also discovered a loophole on OKX's authentication system, which gave the thieves access to the platform.

The exchange allows users to switch from two-factor authentication to lower security verification methods, such as SMS verification, during sensitive user operations such as withdrawals and whitelisting addresses. None of these actions trigger a 24-hour withdrawal ban on the exchange, adding that the ban is only activated when logging into a new device. If an address is whitelisted, large amounts of crypto can be withdrawn from the account without additional verification.

The security breaches at OKX have raised concerns among users and industry observers about the robustness of the exchange's security architecture. While the exchange has promised to take full responsibility if the platform is found to be at fault, the incident highlights the need for cryptocurrency exchanges to prioritize security and implement robust measures to protect users' funds. As the investigation into the security breaches continues, OKX faces the challenge of balancing user security with the need to maintain a seamless trading experience.