According to SlowMist, despite the two similar phishing incidents, OKX’s two-factor authentication mechanism was not the main vulnerability point.

OKX cryptocurrency exchange, in collaboration with security partner SlowMist, is investigating a significant exploit that led to the theft of millions of dollars from two user accounts. The attack, which occurred on June 9, was executed through an SMS attack, also known as a SIM swap, as reported by SlowMist founder Yu Xian on X.

Key Details of the Incident:

1. Nature of the Attack:
- The attackers used an SMS risk notification from Hong Kong to create a new API key with withdrawal and trading permissions, leading to the suspicion of cross-trading intentions. However, this suspicion has since been ruled out.

2. Stolen Assets:
- While the exact amount of assets stolen remains unclear, Yu Xian confirmed that "millions of dollars of assets were stolen."

Investigation Insights:

1. Role of Two-Factor Authentication (2FA):
- Contrary to initial suspicions, the 2FA mechanisms might not have been the primary vulnerability. According to Xian, he had not enabled a 2FA authenticator like Google Authenticator, although it remains uncertain if this was the critical point of failure.

2. Exploitation of Security Flaws:
- Analysis by Web3 security group Dilation Effect suggests that the attackers exploited OKX's 2FA mechanism by switching to a low-security verification method. This allowed them to whitelist withdrawal addresses via SMS verification.

3. Advanced Hacking Techniques:
- There has been a rise in sophisticated attacks bypassing 2FA. For instance, at the beginning of June, a Chinese trader lost $1 million to a scam using a Google Chrome plugin called Aggr, which steals user cookies to bypass passwords and 2FA authentication.

Rising Phishing Attacks:

1. June Phishing Surge:
- CoinGecko reported a data breach via its third-party email management platform, GetResponse, leading to the attacker sending 23,723 phishing emails.

2. Types of Phishing Attacks:
- Hackers aim to steal sensitive information like crypto wallet private keys.
- Address poisoning scams trick investors into sending funds to fraudulent addresses resembling ones they previously interacted with.

Broader Implications:

1. Vulnerability Exploitation:
- Private key and personal data leaks have become predominant reasons behind crypto-related hacks. In 2023, over 55% of hacked digital assets were lost due to private key leaks, according to Merkle Science’s 2024 HackHub report.

2. Need for Enhanced Security Measures:
- These incidents highlight the importance of robust security protocols and the need for exchanges and users to adopt more sophisticated and secure authentication methods.

Conclusion:
The OKX and SlowMist investigation into the multi-million dollar exploit underscores the evolving nature of security threats in the cryptocurrency space. As hackers become more sophisticated, both exchanges and users must stay vigilant and adopt advanced security measures to protect their assets.