Is OKX safe?
Proof of reserves, licences and past incidents

Reserves: OKX publishes monthly proof-of-reserves reports with a Merkle tree of user balances, and says it holds 1:1 reserves for account assets. You can check that your own balance was counted; that tells you about the platform's books on that date, not about everything else.

Licences: a few of OKX's licences can be looked up in the regulator's own register (two are linked below). A licence in one country says nothing about whether you can use OKX where you live — OKX's Risk & Compliance Disclosure lists restricted jurisdictions including jurisdictions in the United States and its territories, Canada, Hong Kong, Japan, India and Malaysia, and okx.com does not serve mainland China.

History: OKEx (OKX's former name) suspended crypto withdrawals in October 2020 while its founder was cooperating with an investigation, and in February 2025 the entity operating OKX pleaded guilty in the U.S. to running an unlicensed money transmitting business. The history section lists only events we could tie to a primary source; it is not a complete record.

What to do with that: no exchange should hold more than you can afford to lose. Run the 7-item self-check on any exchange you use, and keep long-term holdings in self-custody.

"Safety" is actually three separate questions

When a normal user asks "is exchange X safe?", three distinct questions are usually rolled into one:

1. Asset side — does the exchange actually hold enough on-chain assets to cover all customer liabilities? This is the heart of the FTX-style blow-up (misuse of customer funds).
2. Regulation side — does the exchange hold legitimate licences? Does the jurisdiction provide bankruptcy-style protection? This is the heart of the Mt.Gox-style event (can users actually get their assets back?).
3. History side — has the venue ever misused, defrauded, or run away from users? This uses past performance as a reputation factor for future behaviour.

Taking the three apart is far more useful than asking "is it safe?" in the abstract. Below we go through OKX on each one, with links to the pages the facts come from so you can check them yourself.

1. Asset side: OKX's PoR Merkle Tree

What is Proof of Reserves (PoR)?

After FTX blew up in November 2022, major exchanges came under pressure to publish PoR — a mathematical proof to the public that "the assets the exchange holds on-chain are ≥ the sum of all customer balances".

A complete PoR has two parts:

• Proof of Reserves (asset side): the exchange discloses on-chain wallets it controls (or uses zero-knowledge methods to attest the holdings only), proving "we hold at least this much".
• Proof of Liabilities (liability side): the exchange hashes every user balance into a Merkle Tree and publishes the root hash. Each user can download their own Merkle path and verify their balance was counted in the total.

Only when both steps are present is the PoR complete. OKX publishes both parts, in monthly reports.

Where OKX's PoR actually stands

That covers the parts a complete PoR needs. It still has limits:

1. PoR is a snapshot in time — it describes a single moment. If an exchange borrows assets before the snapshot and returns them right after, PoR will still "pass" while the underlying exposure persists. This is an unsolved industry-wide issue, not unique to OKX.
2. Users have to actually verify themselves — the Merkle tree only catches an under-reported balance if the account holder checks it. Unless you download your own Merkle path and run the check, you don't know whether your balance was counted.
3. PoR cannot prove operational health — an exchange could be fully reserved yet have terrible liquidity and a long withdrawal queue. PoR cannot answer that.

What OKX's own PoR page says

According to OKX's proof-of-reserves page (checked October 2026), OKX says it maintains a 1:1 reserve of account assets and verifies its reserve ratio by comparing total OKX account assets with total exchange assets. It uses a zero-knowledge proof algorithm, zk-STARK, to prove and verify account assets, and refers to monthly Proof of Reserves reports. For the ratio in any specific report, go by that report.

2. Regulation side: OKX licences you can look up yourself

An exchange operating in several regions does so through separate local entities, each licensed (or not) by its own regulator. The useful test is what the regulator's own register shows. Two OKX entries, as the registers showed them in October 2026:

OKX entities in regulators' public registers

• EU (MiCA) — OKX Europe Limited appears in ESMA's interim MiCA register of crypto-asset service providers, home member state Malta, competent authority the Malta Financial Services Authority, authorised 27 January 2025.
• Dubai (VARA) — OKX Middle East Fintech FZE appears in VARA's public register with an active VASP licence (VL/23/12/003), issued 17 September 2024.

Holding a licence ≠ your region can definitely use it

A licence and access are two different things:

• OKX holds a Country X licence = OKX is legally allowed to operate certain business lines in Country X;
• It does not follow that all OKX products are legally available to all Country X residents;
• Nor does it follow that users in other countries can legally use OKX services operated through the Country X entity.

Which OKX entity you deal with depends on where you live: OKX's Terms of Service name different contracting entities for different regions, including a separate US entity for OKX US. okx.com lists jurisdictions in the United States (and US territories such as Puerto Rico) among its restricted jurisdictions; OKX US is a separate platform that this site does not cover.

3. History side: OKX's 2020 withdrawal suspension and what to check beyond it

The events below are the ones we could tie to a primary source. This is not a complete record of incidents or regulatory actions involving OKX.

What the 2020 suspension tells you

Withdrawals stopped because of something that had nothing to do with the exchange's reserves: a single person's absence was enough to freeze them. That is a risk specific to centralised exchanges, and no proof of reserves would have flagged it in advance. It's the strongest argument on this page for keeping long-term holdings off any exchange.

What the 2025 guilty plea tells you

The plea was about where OKX did business, not about customer balances: according to the press release, the exchange took on U.S. customers for years without the anti-money-laundering controls U.S. law requires. Whether an exchange is allowed to serve your country is something to check against regulators' and prosecutors' own releases, not the exchange's marketing.

Checking regulatory and legal history yourself

Enforcement actions and court cases are best read in the original, not in summaries. Search the press releases of the regulators and prosecutors in the countries where OKX entities operate (for example the US Department of Justice and the regulators listed above) for "OKX" or "OKEx", and read what the documents say about which entity was involved and what it agreed to.

7-item exchange safety self-check

This checklist works for any centralised exchange (not just OKX). Run it across every CEX you use, every few months:

1. Does it publish PoR monthly?
   Look for a dedicated PoR page, historical archive, and user self-verification tool. OKX: ✓
2. Does the PoR include a Merkle Tree liability proof?
   Asset-only PoR is not enough — you need a Merkle Tree so each user can verify they were included. OKX: ✓
3. Does it hold mainstream-jurisdiction licences?
   Look for entries in the regulators' own registers, not just the exchange's list. OKX: entries found in the EU (MiCA) and Dubai (VARA) registers — see above.
4. What share of exchange reserves is the platform's own token?
   FTX counting FTT as "assets" is the textbook self-collateralisation trap. For OKX, look at the asset breakdown in the monthly PoR report and see how much of it is OKB.
5. Any history of misusing customer assets, or enforcement actions?
   Misuse of customer assets is a hard veto. Check regulators' and prosecutors' press releases, not only the exchange's own account.
6. Are withdrawals consistently available without frequent delays?
   Do a small test withdrawal every few months and log the time. OKX has the October 2020 suspension on its record.
7. Does customer support communicate openly during major events?
   Watch official X / blog activity during major events (e.g. the FTX collapse) for speed and honesty.

5 red flags of an unsafe exchange

Conversely: any one of the following should knock a CEX off your shortlist immediately.

4 things you should do yourself

"Is exchange X safe?" is an external judgement. But even with the right venue, your own habits decide a lot of what can go wrong. Do these four things every few months:

1. Download your own Merkle path and verify PoR locally.
   Confirms OKX didn't under-report your balance in that snapshot. See account security · PoR self-verification.
2. Run a small test withdrawal.
   A small amount out and back confirms the withdrawal route works, for the cost of one network fee — far cheaper than discovering a problem when you urgently need the money. Network choice and fees in our OKX withdrawal guide.
3. Move long-term-static balances to self-custody hardware wallets.
   Exchanges are for trading, not storage. Long-term holdings on an exchange are continuous exposure to operational risk — the 2020 suspension above is the example.
4. Never leave more on any single CEX than you can afford to lose.
   This is the lesson everyone should have learned post-FTX.

Our OKX account security guide covers the settings that protect the account itself: 2FA, anti-phishing code, withdrawal allowlist, API limits and PoR verification.