Your phone lost service, and your OKX account was drained. A scammer SIM-swapped your number, intercepted SMS 2FA, and withdrew your crypto. OKX operates through multiple entities (Seychelles, Dubai, Australia) — the response depends on which entity holds your account. OKX's DEX aggregator creates an additional risk: the scammer may swap tokens to obscure the trail before withdrawing. We trace through the DEX and file with the correct OKX entity.
A SIM swap attack (also called SIM hijacking or port-out fraud) is when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your phone number, they intercept SMS-based 2FA codes and gain access to your OKX account — bypassing SMS verification, changing the password, and withdrawing your crypto. The attack often happens at night, and victims discover it when they wake up to a dead phone and an empty OKX account.
Why OKX is targeted for SIM swap attacks: OKX is a major exchange with significant user balances. OKX offers SMS 2FA (though Google Authenticator is recommended). OKX's DEX aggregator creates a unique SIM swap risk: the scammer can swap your tokens through multiple DEX pools before withdrawing, making the on-chain trail harder to follow. However, OKX's internal records show all DEX swaps — we obtain these through the legal request.
The attack sequence: First, the scammer gathers your personal information through data breaches, social media, or phishing. Then they contact your mobile carrier (or bribe an insider) to port your number to their SIM. Once they have your number, they intercept the OKX SMS 2FA code, log into your account, change the password and 2FA settings, and withdraw your crypto to addresses they control. The entire attack takes 2-6 hours — usually while you sleep.
Regulatory structure: OKX's primary entity is registered in Seychelles. OKX DMCC (Dubai) is VARA-regulated, and OKX Australia is AUSTRAC-regulated. Response times: 7-21 business days (Seychelles), 5-14 days (Dubai), 3-10 days (Australia). We identify the correct entity and file there — filing with the wrong entity wastes 2-3 weeks.
Freeze capability: OKX can freeze the scammer's receiving account. Requires a police report or court order. OKX Seychelles may be slow — we escalate through OKX DMCC (Dubai) and file a VARA complaint if needed. Response: 7-21 business days (Seychelles), 5-14 days (Dubai).
KYC disclosure: OKX discloses account holder information to law enforcement or through a court order. OKX's KYC includes: government ID, selfie verification, and proof of address. However, OKX Seychelles has less stringent KYC verification.
The DEX aggregator tracing challenge: If the scammer used OKX's DEX aggregator to swap tokens before withdrawing, the on-chain trail may be harder to follow — the funds move through multiple DEX pools. We trace through the DEX pool contracts and identify the final output address. OKX's internal records also show all DEX swaps — we obtain these through the legal request.
A client woke up at 7 AM to find their phone had no service since 2 AM. When they restored service, they found their OKX account had been accessed — the scammer had SIM-swapped their Three UK number, intercepted OKX SMS 2FA, and logged in. The scammer found €42,000 in the account, used the DEX aggregator to swap €30,000 through 4 different token pools (ETH → USDC → USDT → MATIC), and withdrew the swapped funds to 3 external wallets. The remaining €12,000 was withdrawn directly in USDT.
Our response: We traced the withdrawal transactions on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also filed a police report and coordinated with the mobile carrier's fraud department.
Outcome: 31% recovery (€13,000 of €42,000). We traced the DEX aggregator swaps through the pool contracts — the final output went to 2 wallets on Binance and 1 on a personal wallet. We filed freeze requests with Binance (the scammer's Binance KYC revealed a resident of Nigeria). €13,000 was frozen on Binance. The €30,000 swapped through DEX pools was partially recovered (€8,000 from the second Binance wallet), but €21,000 on the personal wallet was untraced. The mobile carrier (Three UK) was found liable for the unauthorized port-out.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does a SIM swap differ from phishing? In a SIM swap, the attacker takes over your phone number — you don't click any link. In phishing, the attacker tricks you into entering credentials on a fake site. See phishing on OKX →
Warning: After a SIM swap, fake "recovery services" may contact you. Read our recovery scam warning.
Three differences: (1) OKX operates through multiple entities (Seychelles, Dubai, Australia) — we must identify the correct one. (2) OKX Seychelles is slow (7-21 days vs Binance's 3-7 days). (3) OKX's DEX aggregator lets the scammer swap tokens to obscure the trail. However, we can escalate through OKX DMCC (Dubai) and trace DEX swaps. Recovery rates are 30-50%, lower than Binance.
Yes, but it takes longer. The DEX aggregator swaps tokens through multiple DEX pools. We trace each swap through the pool contracts and identify the final output address. OKX's internal records also show all DEX swaps — we obtain these through the legal request. The DEX trail is on-chain and traceable, but adds 24-48 hours to the tracing process.
It depends on your registered jurisdiction. International users are under OKX Seychelles. Middle East users may be under OKX DMCC (Dubai). Australian users are under OKX Australia (AUSTRAC). We identify the entity by analyzing your account registration. Filing with the wrong entity wastes 2-3 weeks — we verify before filing.
If the scammer's account is under OKX Seychelles and compliance is slow, we file a parallel complaint with OKX DMCC (Dubai, VARA-regulated) and with VARA directly. This creates regulatory pressure on OKX to respond. The Dubai escalation typically accelerates response by 5-7 business days compared to filing with Seychelles alone.
7-21 business days for OKX Seychelles (slowest), 5-14 days for OKX DMCC (Dubai), 3-10 days for OKX Australia. OKX Seychelles is the slowest major exchange for SIM swap cases. For OKX SIM swap cases, early filing is critical — especially if the scammer is using the DEX aggregator to swap tokens.
Switch from SMS 2FA to Google Authenticator. Contact your mobile carrier and request a port-out PIN. Use a separate email for your OKX account. Avoid keeping large balances on OKX — move excess funds to a hardware wallet. Disable the DEX aggregator if you don't use it (so a scammer can't use it to obscure the trail). These measures make SIM swap attacks much harder.
Describe what happened. Include your mobile carrier, when you lost service, OKX withdrawal transaction hashes, and total amount lost. We respond within 6 hours.