OKX to Relaunch DEX Aggregator After Lazarus Group Attack, Adds Security Upgrades

Crypto exchange OKX has reactivated its decentralized exchange (DEX) aggregator, OKX Web3, following a temporary suspension in March prompted by a security breach linked to the North Korean state-sponsored Lazarus Group.

The relaunch includes a suite of enhanced security upgrades designed to prevent further exploitation by malicious actors.

In a May 4 post on X (formerly Twitter), OKX founder and CEO Star Xu announced the return of the service with “a real-time abuse detecting and blocking system.”

OKX CEO Calls Web3 Platform a ‘Blockchain Search Engine’ for Smarter DEX Trading

Xu described OKX Web3 as a “browser and search engine for blockchain,” offering users aggregated data from multiple decentralized exchanges and market makers to facilitate more efficient trading.

The newly deployed upgrades go beyond simple detection tools. OKX stated that it now operates a “dynamic database of suspect addresses” that actively blocks known hacker activity in real time.

The platform also issues proactive warnings to users when a potentially risky transaction is identified.

To bolster its credibility, OKX emphasized that its systems have been audited by leading blockchain security firms including CertiK, Hacken, and SlowMist.

The platform has also undergone stress testing through an ongoing bug bounty program.

Among the new features is an improved on-chain analysis tool that categorizes wallet holders, identifying patterns that may suggest whale activity or sniper trading strategies.

This intelligence layer is part of a broader effort to enhance transparency and security within its decentralized ecosystem.

OKX DEX will restart today with realtime abuse detecting and blocking system. OKX Web3 is Chrome and search engine to blockchain. Base on our understanding of onchain data, we help customers access to hundreds chains realtime data, manage multiple chains’ asset and engage with…

— Star (@star_okx) May 5, 2025

Back on March 17, OKX announced it had paused its DEX aggregator amid concerns that the Lazarus Group had been exploiting it to move illicit funds.

The company promised to roll out upgrades to prevent further misuse, including a system to track and block addresses associated with hackers.

The incident drew increased scrutiny, especially after a March 11 Bloomberg report suggested European Union regulators were investigating OKX’s DEX aggregator for its potential involvement in laundering funds from the $1.4 billion Bybit hack in February.

OKX denied those claims, clarifying that its wallet service is non-custodial and functions solely as a swap aggregator.

Other crypto platforms have also been impacted by the Lazarus Group.

On May 1, crypto exchange eXch shut down operations after acknowledging it had processed some funds linked to the February hack—despite earlier denials.

OKX CEO Defends Exchange Amid Justin Sun Freeze Dispute

Over the weekend, OKX CEO Star Xu responded to accusations from Tron founder Justin Sun, who claimed the exchange failed to act on a law enforcement request to freeze stolen funds linked to a hack of Tron’s official X account.

Sun alleged that OKX ignored a “freeze notice” from law enforcement following the May 3 breach, during which Tron’s X account was compromised.

The attacker reportedly posted a malicious smart contract address, sent direct messages, and engaged with unfamiliar accounts.

Star Xu dismissed the allegations. “OKX has a consumer protection policy governed by law.”