Star Xu, founder and CEO of OKX, published a detailed statement about the most common causes of cryptocurrency losses. According to him, users often misjudge risk sources and overestimate the protection level of individual products, while solutions marketed as decentralized may carry centralized threats.
Who is Star Xu and Why His Opinion Matters
Star Xu is the founder and CEO of OKX. In his statement, he systematized the main sources of wallet compromises. His conclusions are valuable for users as they come from practical observations of a major platform operator; more details about the exchange itself can be found in the OKX review, which covers basic operational principles and security.
Risks Associated with DEX Bots
The first key issue named by Star Xu is DEX bots, which require uploading private keys to third-party service servers. He noted that in some cases these keys are stored in plain or easily decrypted form, meaning technical staff can access them and, if the infrastructure is compromised, the risk level is comparable to that of a centralized exchange.
He also pointed out that such services should not be automatically considered self-custodial, and bot operators in some jurisdictions may be subject to KYC and AML requirements, creating additional legal and criminal risks for developers and providers of such solutions.
Vulnerabilities of Self-Custodial Wallets
The second threat source identified by Star Xu is errors in self-custodial wallet code and supply chain attacks, including repository compromises. As a result of such incidents, private keys can be stolen without the user's knowledge, and he emphasizes that open source code alone does not guarantee security.
Compromise of User Devices
The third risk group involves malware infection on devices that can intercept keyboard input or clipboard data. An additional threat comes from screenshots of seed phrases that are automatically uploaded to cloud services, making seed phrases accessible beyond the user's control.
Automated Trading Strategies and New Technologies
Star Xu noted that to operate automated strategies, many users are forced to hand over private keys to third-party services, creating significant operational risks. As an alternative, he announced that OKX Wallet is preparing to implement Smart Accounts based on Trusted Execution Environment: this architecture will allow running automated strategies without transferring key control.
The topic of wallet security is also discussed by other industry leaders; ideas for enhancing wallet protection can be found in the article about proposals from other executives, including ways to strengthen wallet security, which presents comparable approaches to risk reduction.
The Future of Cryptocurrency Wallet Security
In conclusion, Star Xu emphasized that security and convenience are not mutually exclusive and pointed to wallet development trends toward architectures that combine automation and key control. This clearly demonstrates an attempt to reduce operational risks without sacrificing user functionality.
Why This Matters
Even if you mine and manage wallets on a small number of devices, the listed risks directly affect fund safety: uploading keys to services, code vulnerabilities, and device infections increase the likelihood of losses. Additionally, for those developing or using bots, regulatory KYC and AML requirements should be considered as they may have legal consequences for operators.
What to Do?
- Do not upload private keys to third-party servers and treat services requiring this step as centralized in terms of risk.
- Do not store seed phrases as screenshots or in the cloud; avoid automatic synchronization of data containing secrets.
- Monitor device status: update software, use antivirus solutions, and minimize using the same machines for mining and key management.
- Before using bots and automated strategies, verify the service architecture; prefer solutions that do not require transferring key control (e.g., Smart Accounts/TEE when available).
- If you develop or operate services, comply with KYC and AML requirements in your jurisdiction to reduce legal risks for the project and users.