The security breach at crypto exchange OKX has garnered attention, with reports emerging of hackers targeting the platform. At least two users have come forward, alleging that their funds were siphoned off after receiving SMS risk alerts purportedly from Hong Kong. According to Yu Xian, the founder of SlowMist, a mysterious entity managed to create new API keys equipped with withdrawal and trading authorizations. This granted them unfettered access to manipulate and drain assets from the exchange.

Responding swiftly to the incident, OKX's Chinese division posted on Jun. 9, reassuring users that they are actively engaging with those affected and conducting a thorough investigation into the matter. However, the full scope of the attack remains shrouded in uncertainty, leaving many questions unanswered regarding the precise methods employed by the hackers to infiltrate the trading accounts.

This breach underscores the persistent threat posed by SIM swapping, a sophisticated form of phone hijacking. Over time, this tactic has increasingly menaced crypto investors, even ensnaring prominent industry players. For instance, in a troubling revelation in 2021, Coinbase divulged that hackers managed to abscond with cryptocurrency holdings from approximately 6,000 users. This exploit involved circumventing multi-factor authentication, suspected to be part of a nefarious phishing expedition that exploited the interception of two-factor authentication SMS messages.

Instances of hijackers manipulating phone numbers to seize one-time passwords and validate transactions or alter account credentials have been on the rise. Consequently, many leading cryptocurrency firms have taken proactive measures to distance themselves from reliance on SMS-based two-factor authentication. Despite these efforts, some entities continue to employ this method, prompting a reevaluation of security protocols across the industry.