Is OKX safe to connect?
Exchange · Multi-asset centralized exchange (spot, derivatives). Checked 2026-10-24; every line links its source.
Worst case: OKX holds your coins and its terms let it freeze, block or seize them without notice during a review or legal order; a leaked trade/withdraw key not bound to an IP stays usable until 14 days of inactivity.
Safe setup in 3 steps
- Create bot keys with Read+Trade only and bind them to your server IP; never grant Withdraw to third-party tools
- Keep the withdrawal allowlist to your own addresses, since API withdrawals can only go to saved addresses
- Verify any OKX 'support' account or site with OKX's channel-verification tool before sharing anything
OKX also has a full listing with an Agent Risk Score Agent risk 84% (partial, 5 of 7 inputs): OKX on TradingAgentStack.
What it can do with your money
| Who holds the keys | The exchange holds your funds Custodial exchange account (the OKX Wallet is a separate self-custody product). source |
|---|---|
| Can funds be sent out to any address? | Yes. Withdrawals available; OKX may suspend withdrawals to resolve platform incidents (ToS §4.1). source |
| Can it hold or freeze your funds? | OKX ToS: may 'freeze/lock any Assets in your Account' on suspected violations, unauthorized access or unreconciled balances (§7.6); may 'block transactions or freeze your funds immediately without notice' for suspected prohibited activity (§3.2); may suspend, freeze or seize accounts under investigation, subpoena or levy (§7.7); may restrict services and later suspend/terminate if requested information isn't provided in a timely manner (§4.16); may freeze/transfer assets under authority orders (§8.2(e)); may terminate 'at any time and for any reason' (§7.8). After termination you get 30 days to supply a withdrawal address before assets may be liquidated (§7.9). No fixed review duration is stated. source |
| What a leaked API key can do | Permissions are Read, Trade and Withdraw. Keys not bound to an IP that have trade or withdrawal permission are automatically deleted after 14 days of inactivity; up to 20 IPs per key. API withdrawals only go to addresses added on the withdrawal page. Default permissions for new keys are not stated. source |
| Monero and Zcash | XMR: delisted (spot pairs removed 2024-01-05; no XMR-USDT spot or XMR-USDT-SWAP instrument in OKX's public API on 2026-10-24) ZEC: delisted 2024-01-05, relisted for spot (ZEC/USDT) on 2025-11-24; ZEC-USDT state 'live' in OKX public API on 2026-10-24 source Regions: Availability on OKX's EEA entity not checked source |
Official links
- Website:
okx.com - X:
@okx
Where we confirmed these
Deadlines
- 2027-07-10: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service. source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2025-03-17 | OKX suspended its Web3 DEX aggregator after misuse by Lazarus Group to launder Bybit-hack proceeds | Service paused; not a loss of OKX customer balances | source | |
| 2024-01-05 | OKX delisted XMR, ZEC and DASH spot pairs (announced 2023-12-29); withdrawals for these tokens suspended from 2024-03-05 | Users had to withdraw before the suspension; ZEC later relisted 2025-11-24 | source |