OKX account security settings:
what each one stops, and what it doesn't

1. 2FA: use Google Authenticator, not SMS

2FA stands for two-factor authentication: the second proof — beyond your password — that it's actually you logging in. Even if an attacker has your password, they can't get in without your second factor.

Two 2FA options compared

SMS 2FA isn't strong enough on its own because of SIM swap attacks — an attacker socially engineers your carrier's support desk into porting your number to their SIM, then receives every SMS code. From then on the codes go to the attacker, so SMS 2FA protects nothing.

2. Anti-phishing code: spot fake emails instantly

The anti-phishing code is a string only you know — e.g. BlueDesk2026. From the moment you set it, every legitimate OKX email includes this string in the footer.

How you use it:

• Got an "OKX" email? Glance at the footer for your code first;
• Missing the code → phishing, delete;
• Code present but wrong characters → more sophisticated phishing, delete immediately.

How to set it

1. On the web, go to Profile → Security and open the anti-phishing code setting;
2. Enter a string of your choice (the form shows the length it accepts). Don't reuse another password, don't use your own name, don't use pure digits.
3. The next OKX email will already include the new code.

3. Withdrawal allowlist: shut the door on "withdraw to a stranger"

The withdrawal allowlist limits withdrawals to addresses you've saved in advance. OKX's address book page puts it simply: if Allowlist is enabled, you can withdraw only to recipients saved in the address book. So even someone who gets into your account can't send funds to an address that isn't already in your book.

How to set it

1. Open the withdrawal address book in your OKX account;
2. Add the addresses you regularly withdraw to (e.g. your Ledger / Trezor self-custody addresses);
3. Turn on Allowlist.

Key details

• The allowlist itself does exactly one thing: once it's on, withdrawals can only go to addresses in your address book and nowhere else. It does not come with a built-in time delay.
• What makes a new address wait is a different switch — the new address lock. OKX's Help Center says withdrawals to newly added allowlisted addresses are restricted for 24 hours while it's on, and that it can be turned off under Address Book → Address settings. Two switches, flipped independently; don't treat them as one feature.
• Saved addresses carry a 30-day verification period by default, according to OKX's page on the 30-day verified address feature: each withdrawal to the address restarts the 30 days, and if none is made before the period ends, the verification expires. You can choose permanent verification for an address instead.
• Turning the allowlist off makes withdrawals to any address possible again, which is why losing your 2FA is far worse than losing the allowlist.
• Double-check the address before saving it — OKX notes that verifying an address doesn't confirm the details are correct, and a wrong network or wrong address still loses funds.

Why OKX pauses withdrawals after you change a security setting

Taking money out of someone else's account takes four steps, and each has a lock:

That last row is the one people run into. OKX's Help Center says withdrawals aren't allowed for 24 hours after you change your login password, and are restricted for 24 hours after you change any authentication method (phone, email or authenticator). It's annoying when you've just replaced your phone and want to withdraw — but those are exactly the changes an attacker makes first after getting in, so the pause means that even if they change everything, the money hasn't left yet. That is your window to contact OKX support, freeze the account and change your email back.

Two things follow from this:

• Don't let alerts go only to your login email. If the attacker controls that inbox, you won't see the warnings during the pause. App push notifications help.
• Do the waiting before you need the money. Add the addresses you use to the allowlist and switch 2FA away from SMS when nothing is urgent, so any lock runs out while you don't need it. Don't plan on support shortening a lock for you: a lock that could be lifted on request could be lifted by an attacker's story too.

4. API permission limits: never give more than "Read"

If you don't use third-party trading tools or bots, skip this section — with no API keys on your account, there's nothing here to lock down.

If you do use third-party tools (Cointracker for tax accounting, TradingView for charts, a market-making bot), this matters:

Three API permission levels

Recommended setup

1. Create a separate API key for each third-party tool, never reuse;
2. Grant only the minimum permission needed — accounting tools get Read only, never Trade or Withdraw;
3. Enable IP whitelisting so only the tool's server IP can use your key;
4. Review your keys from time to time and regenerate them when you rotate tools;
5. When you stop using a tool, delete the corresponding key immediately.

5. PoR self-verification: run it every few months

PoR stands for Proof of Reserves — OKX publishes monthly proof-of-reserves reports built on a Merkle tree of user balances, to show the exchange holds assets that cover its liabilities. Exchanges began publishing these widely after FTX collapsed in 2022.

First, where this belongs on the list: PoR checks the platform's books, not your account's defences. The first four items govern whether someone else can get in and move your coins out; PoR governs whether the platform counted your money in the liabilities it published. Run a PoR check and you can still get phished; lock your account down completely and it still won't save you if the platform blows up. Treat them as two separate things.

But "the snapshot exists" is not the same as "you're in it." If the exchange under-reported your balance, the snapshot maths would still check out. That's why every user should run the inclusion check on their own balance at least occasionally.

How to verify

8 common scam tactics aimed at OKX users

None of the settings above help if you're talked into moving the money yourself, so learn to recognise these.

Final self-audit checklist

Run through this list. Only when every box is checked is your account "baseline secure":

• ☐ Password ≥ 16 characters, generated by a password manager, not reused on other sites
• ☐ Google Authenticator 2FA enabled, setup key backed up offline
• ☐ Phone number on the account kept up to date
• ☐ Anti-phishing code set (not your name, not another password)
• ☐ Withdrawal allowlist enabled with at least one self-custody address added
• ☐ The separate "new address lock" switch confirmed on as well (that's the one that keeps a new address unusable for 24 hours)
• ☐ Security alerts reach you somewhere other than your login email (app notifications, for example)
• ☐ No third-party tools — or, if you use them, API keys are Read-only with IP whitelisting
• ☐ okx.com bookmarked; never reach OKX via a Google search result
• ☐ You know OKX support only appears inside the app / website and never DMs you
• ☐ Long-term holdings moved off the exchange into a Ledger / Trezor
• ☐ PoR self-verification run at least once every 1-3 months