Cryptocurrency exchange OKX, in collaboration with security partner SlowMist, is investigating the theft of millions of dollars from two user accounts following a sophisticated SIM swap attack. The incident, which occurred on June 9, involved the unauthorized access and subsequent theft of assets from these accounts, as reported by SlowMist founder Yu Xian on X (formerly Twitter).

The attack was executed through an SMS-based risk notification originating from Hong Kong, leading to the creation of a new API key with withdrawal and trading permissions. Despite the scale of the theft, Xian noted that the exact amount stolen remains unclear, but it is estimated to be in the millions.

While the on-chain security firm SlowMist continues to investigate the incident and track the hacker’s wallet, initial findings suggest that OKX’s two-factor authentication (2FA) mechanism was not the primary vulnerability. In a statement, Xian mentioned, "I haven’t turned on a 2FA authenticator like Google Authenticator, but I'm not sure if this is the key point." This indicates that the attackers exploited an alternative method to bypass the security measures in place.

Further analysis by the Web3 security group Dilation Effect revealed that the attackers were able to exploit a lower-security verification method within OKX's 2FA system. This allowed them to whitelist withdrawal addresses through SMS verification, circumventing the higher security protocols typically provided by 2FA tools like Google Authenticator.

This incident is part of a broader trend of increasingly sophisticated phishing and hacking attacks within the crypto industry. In early June, a Chinese trader lost $1 million in a scam involving a malicious Google Chrome plugin, Aggr, which stole user cookies to bypass passwords and 2FA authentication. Additionally, a data breach at CoinGecko's third-party email management platform, GetResponse, led to the distribution of nearly 24,000 phishing emails.

Phishing attacks, which aim to steal sensitive information such as crypto wallet private keys, have been on the rise. These attacks often involve address poisoning scams, where hackers trick users into sending funds to fraudulent addresses that resemble those they have previously interacted with.

Private key and personal data leaks have become a significant vulnerability in the crypto space. According to Merkle Science’s 2024 HackHub report, over 55% of hacked digital assets in 2023 were lost due to private key leaks, highlighting the critical need for enhanced security measures in protecting user assets.

As OKX and SlowMist continue their investigation, the crypto community remains vigilant, emphasizing the importance of robust security practices to mitigate the risk of such attacks in the future.