Affiliate disclosure: This article contains an OKX partner link. If you register or trade through it, the site operator may receive compensation. User benefits vary by account, region, VIP tier and campaign; check the sign-up page and My Rewards for the terms actually applied.
OKX Exchange safety should be assessed separately in terms of proof of reserves (PoR), account security, and eligibility to use services. PoR is evidence that verifies assets and customer balances at a specific time and within a defined scope; it is not insurance that guarantees against all losses or ensures future withdrawals. Even with security features enabled, platform, market price, regulatory, and technical risks remain.
Based on OKX official materials reviewed on October 24, 2026, this article summarizes what can and cannot be verified. Available services and menus vary depending on your account interface, the entity providing the service, and your region of residence. Check the guidance in your own account and consult official customer support to confirm the conditions that apply to you.
Safety cannot be assessed using a single metric
| Area to check | What to check | What this alone does not guarantee |
|---|---|---|
| Proof of reserves | Reporting date, included assets, whether balances are included, verification results | Overall financial soundness of the company; future withdrawals |
| Account security | Login methods, devices, withdrawal addresses, API permissions | Prevention of all phishing, device infections, or platform incidents |
| Service eligibility | Residence, service-providing entity, product-specific terms | Eligibility to use every product based only on access, registration, or verification |
| Asset custody | Who has control, recovery methods, asset concentration | That either an exchange or a personal wallet is always safe |
For example, being able to log in to an account does not confirm eligibility to use a particular product. Conversely, strong account security does not eliminate market price declines or platform operational risks. This article's assessment criteria begin by distinguishing the purpose of custody and the extent of losses you can afford to bear.
Three things to check in PoR and what cannot be verified
The official PoR page of OKX explains separately whether customer balances are included, verification related to total balances, and assets held in public wallets. According to the latest reserves report shown on the page when checked on October 24, 2026, the reporting reference time was October 3, 2026, 00:00 (UTC+8). This is not the date this article was reviewed or a real-time balance.
- Whether your balance is included: After logging in, go to View my report in PoR to review the report and detailed information. Check the balance and scope of inclusion at that point in time, and, if necessary, use the inclusion proof file and verification tool provided in the official guidance.
- Verification of total balances: Publicly available Liability verification materials are separate from proof that an individual balance is included. The official guidance describes a structure for verifying totals, non-negativity, and inclusion relationships. Do not compare files from different reporting dates.
- Checking public wallets: Proof of wallet ownership and verification of holdings at a specific block height are distinct from customer balance verification. Check the included assets, addresses, and dates, as well as whether assets held by third-party custodians are identified separately.
What you can check directly on the official site is the PoR explanation and self-verification process and the page for downloading reserves and Liability materials. This does not mean that AKEYX has verified a reader's private balance or proof file on their behalf. Never send your password, private key, or recovery phrase to anyone on the grounds that it is needed for verification.
Limits of interpretation: These materials alone cannot be used to assess transactions after the snapshot, assets not included, or all of the company's liabilities and operational circumstances. Therefore, it is reasonable not to interpret PoR as equivalent to an audit of the company's overall financial statements, deposit protection, loss insurance, or a guarantee of future withdrawals. This is AKEYX's interpretation, distinguishing the scope of the publicly available materials.
Passkeys, 2FA, and device checks reduce different risks
According to the official FAQ, passkeys are an optional feature, not a stated requirement for using the service. Check supported devices, browsers, password managers, and recovery methods before using them. Do not skip checks of your email, device, or withdrawal settings just because you have set up a passkey or an authenticator app.
| Check | What to check | Important limitation |
|---|---|---|
| Passkeys and 2FA | Registered methods, whether you control them, and whether recovery is possible | Check recovery options before replacing a device or reinstalling an app |
| Email and anti-phishing code | Email account security, sender, and official domain | Do not trust an entire message based on a single code |
| Devices and sessions | Unrecognized logins; consistency of times, devices, and notifications | Do not conclude that an account is compromised or safe based only on an IP address difference |
| Apps and browsers | Official distribution channels, extensions, unnecessary permissions | Search ads and messaging app files are not necessarily official apps |
Check your devices under Device Management on the official security page, and review registered items under Passkeys. Menu labels may vary between the app and web versions and by account. Before removing all existing devices or login methods, make sure you can safely regain access. Sources: App Security Guide (officially updated 2026-09-22), Passkey FAQ, and Account Security Guide (both documents officially updated 2026-08-26).
Distinguish the conditions for withdrawal Allowlist and new-address lock
When Allowlist is enabled, withdrawals are restricted to recipient addresses saved in the address book. If you also enable new address withdrawal lock, withdrawals to newly added addresses are restricted for 24 hours. This is not a fixed waiting period that always applies to every withdrawal from every account, nor does it remove other security or review requirements.
The path shown in the official app is Assets → Withdraw → select a crypto asset → Address book → Address settings. Allowlist registration and exemption from additional recipient verification are separate settings, so do not assume that no additional checks will apply just because an address is registered. If you see an unfamiliar address, do not transfer funds; check your settings from a trusted device. Source: Official Allowlist Guide (officially updated 2026-09-09).
- Make sure the asset and network match on both the sending and receiving sides.
- Check the full address and whether a Memo/Tag is required. After pasting, make sure the address has not changed.
- Check the current screen for minimum amounts, fees, temporary suspensions, address locks, and review conditions.
- If a transfer is necessary, confirm receipt first within an amount you can afford to lose. Even a small amount may not be recoverable if sent incorrectly.
The step-by-step checks are covered separately in Deposit and Withdrawal Methods and Troubleshooting Missing Funds. This explanation is not a recommendation to deposit or trade.
APIs can pose a loss risk even without withdrawal permissions
The official API documentation distinguishes Read, Trade, and Withdraw permissions. Read includes access to private account information, and Trade may include not only orders but also fund transfers and changes to certain settings. Withdraw is permission to withdraw funds. Therefore, even a Trade key that does not allow withdrawals can cause losses through erroneous orders or misuse of permissions.
- Grant only the minimum permissions actually needed, and remove keys when they are no longer needed for their intended purpose.
- Where supported, restrict access to trusted IP addresses, and do not share keys, Secrets, or Passphrases in messaging apps or public code.
- Do not rely solely on an external bot's claims; check the permissions it requests, the scope of fund transfers, and how to stop it.
- If you see abnormal orders or an unfamiliar key, block access from a trusted device and check the official support procedure.
Sources: Official API Permissions Documentation and API Key Security Guide (the relevant sections checked on 2026-10-24). This is not a firsthand account of creating a key or testing a specific bot.
Regional conditions and account restrictions are separate from security settings
Official risk and regulatory notices advise that services related to derivatives and P2P, among others, may be restricted for residents of Korea. Conditions vary by service-providing entity, country of residence, and product, so being able to access the site, seeing a menu, or completing KYC does not establish eligibility for all services. Review the official notice (officially updated 2026-07-08) together with the guidance on Korean users and regional conditions. No methods for circumventing regional or identity restrictions are provided.
Account restrictions can have different causes, including unusual activity, requests for additional information, periodic compliance reviews, and confirmed violations of the terms. Check the actual notification, Ticket Center, or registered email for the restricted features, required documents, and deadlines. Do not assume that an account you urgently froze yourself can be handled through the same process as an account under review by the platform.
If there is no update 48 hours after you have submitted all the required information, you are advised to contact official customer support with your ticket number. This is not a promise that the restriction will be lifted within 48 hours. Whether withdrawals are possible after a permanent restriction, and the applicable deadlines, may also vary by notification. Source: Account Restriction Response Guide (officially updated 2026-10-16). For basic identity verification procedures, see the KYC Guide, but it does not guarantee the outcome of additional account-specific reviews.
Do not confuse recovery responsibilities for exchange accounts with those for Web3 wallets
Exchange accounts depend on the service provider’s account, custody, and review procedures. With wallets where you hold your own private keys or recovery phrases, you bear greater responsibility for key leaks, loss, and malicious signatures. Not all Web3 wallets use the same key storage and recovery methods, so check what type of wallet you use. Recovering exchange login credentials and recovering wallet assets are not the same process. For more details, see Exchange accounts and OKX Wallet: differences.
Steps to take if you suspect phishing or a security breach
- Stop taking further actions. Stop using suspicious links, files, signatures, or transfers, and do not continue using a potentially compromised device to check your account.
- Check from a trusted device. Open the official address directly and review your login methods, devices, withdrawal addresses, and API keys. If necessary, check the official freeze feature or contact customer support as instructed.
- Preserve evidence. Record the time of the incident, order and transfer identifiers, notifications, and ticket numbers. Do not disclose personal or authentication information in public posts.
- Contact support through official channels. Do not comply with requests for additional transfers, remote access, recovery phrases, or authentication codes under the pretext of urgent recovery.
If the recovery phrase or private key for a personal wallet has been exposed, changing your exchange password or revoking token approvals alone does not mean the problem is resolved. Check the official response guidance for your wallet type. These steps do not guarantee recovery, compensation, or immediate removal of restrictions.
Checklist to review before use
- Have you checked the terms of use that apply to your residence, product, and service entity?
- Have you distinguished the PoR reporting date and scope from whether your own balance is included?
- Are you in control of your login, email, devices, API, and recovery methods?
- Have you checked the withdrawal address, network, Memo/Tag, locks, and review requirements?
- Can you afford a loss or temporary restriction of access?
OKDCC and conditional benefits shown on the sign-up screen are separate from a safety assessment. Seeing a code does not guarantee asset protection, compensation for losses, or eligibility to use the service under local regulations. Differences in eligibility, rates, duration, and payment records are covered in Guide to Checking Code Application Terms, while the usage sequence can be reviewed separately in OKX core guide.
Frequently asked questions
If there is a PoR, does that eliminate all risks associated with OKX?
No. PoR is documentation that verifies reserves and customer balances at a specific time and within a specific scope. It is not the same as a full financial audit, loss insurance, or a guarantee of future withdrawals. Account, market, regional, and platform risks should be checked separately.
Is it mandatory to register a passkey?
The official FAQ describes passkeys as an optional feature. You can use one after checking supported devices and recovery methods, but you should also separately review your email, 2FA, device, and withdrawal settings.
Will withdrawals to an allowlisted address require no additional verification?
No. Allowlist registration and exemption from additional recipient verification are separate settings. If the new address lock is also enabled, a 24-hour restriction applies to newly added addresses, but this does not remove other security or review requirements.
Will an account restriction be lifted after 48 hours?
This is not guaranteed. The guidance is to contact official support with your ticket number if there is no update 48 hours after you have submitted all the required information. Check the account-specific notification for the actual scope of the restriction, review outcome, and deadline.
Does using OKDCC protect your assets?
No. OKDCC is a referral code for checking conditional sign-up benefits. It does not guarantee asset safety, compensation for losses, returns, or eligibility to use the service in a particular region.
Official sources and actual review scope
Last reviewed: 2026-10-24. We checked the linked PoR and reserve information screens, app and account security, passkeys, Allowlist, account restrictions, risk and regulatory disclosures, and API permissions and security. The official document update date and AKEYX review date are different. We did not verify the actual eligibility of private accounts, withdrawal availability, or the results of balance proof execution. Digital assets are subject to price volatility and platform, custody, regulatory, and technical risks, and you may lose all of your assets. This article is for informational and educational purposes and is not investment or legal advice.