OKX account security 5-pack
Set up in 15 minutes · never panic again

① 2FA: use Google Authenticator, not SMS

2FA stands for two-factor authentication: the second proof — beyond your password — that it's actually you logging in. This is the single most important defense. Even if an attacker has your password, they can't get in without your second factor.

Three 2FA options compared

SMS 2FA isn't strong enough on its own because of SIM swap attacks — an attacker socially engineers your carrier's support desk into porting your number to their SIM, then receives every SMS code. SIM swap has been responsible for multiple seven-figure crypto losses; the US FCC has formally warned consumers about it.

② Anti-phishing code: spot fake emails instantly

The anti-phishing code is a string only you know — e.g. BlueDesk2026. From the moment you set it, every legitimate OKX email includes this string in the footer.

How you use it:

• Got an "OKX" email? Glance at the footer for your code first;
• Missing the code → phishing, delete;
• Code present but wrong characters → more sophisticated phishing, delete immediately.

How to set it

1. OKX avatar → Security Center → Anti-Phishing Code;
2. Enter a 6-20 character string. Don't reuse another password, don't use your own name, don't use pure digits.
3. The next OKX email will already include the new code.

③ Withdrawal whitelist: shut the door on "withdraw to a stranger"

The withdrawal whitelist limits withdrawals to addresses you've pre-approved. Even if an attacker has your account, password, and 2FA, they cannot send funds to their own address — only to addresses you've added (i.e. your own wallets).

How to set it

1. OKX avatar → Security Center → Address Management;
2. Add the addresses you regularly withdraw to (e.g. your Ledger / Trezor self-custody addresses);
3. Turn on "Only allow withdrawals to whitelisted addresses".

Key details

• Adding an address requires 2FA — this is the intentional cooling-off step that prevents an attacker from instantly adding their own address;
• Newly added addresses have a 24-48 hour activation delay depending on the network, before they can be used for a withdrawal;
• Double-check the address before saving it — wrong network or wrong address still loses funds.

④ API permission limits: never give more than "Read"

If you don't use third-party trading tools or bots, skip this section — your account has no API keys, attack surface is zero.

If you do use third-party tools (Cointracker for tax accounting, TradingView for charts, a market-making bot), this matters:

Three API permission levels

Recommended setup

1. Create a separate API key for each third-party tool, never reuse;
2. Grant only the minimum permission needed — accounting tools get Read only, never Trade or Withdraw;
3. Enable IP whitelisting so only the tool's server IP can use your key;
4. Set an API expiration (e.g. 90-day auto-expire) and regenerate on rotation;
5. When you stop using a tool, delete the corresponding key immediately.

⑤ PoR self-verification: run it once a quarter

PoR stands for Proof of Reserves — OKX publishes a monthly Merkle tree of all user balances to prove the exchange controls on-chain assets that cover its liabilities. This became the industry baseline after FTX collapsed in 2022.

But "the snapshot exists" is not the same as "you're in it." If the exchange under-reported your balance, the snapshot math would still check out. That's why every user should run the inclusion check on their own balance at least occasionally.

How to verify

8 common scam scripts

Recognizing these scripts matters more than any technical setting — most losses happen when the account wasn't compromised but the user was tricked.

Final self-audit checklist

Run through this list. Only when every box is checked is your account "baseline secure":

• ☐ Password ≥ 16 characters, generated by a password manager, not reused on other sites
• ☐ Google Authenticator 2FA enabled, setup key backed up offline
• ☐ SMS 2FA configured as a backup
• ☐ Anti-phishing code set (not your name, not another password)
• ☐ Withdrawal whitelist enabled with at least one self-custody address added
• ☐ No third-party tools — or, if you use them, API keys are Read-only with IP whitelisting
• ☐ okx.com bookmarked; never reach OKX via a Google search result
• ☐ You know OKX support only appears inside the app / website and never DMs you
• ☐ Long-term holdings moved off the exchange into a Ledger / Trezor
• ☐ PoR self-verification run at least once every 1-3 months