SECURE YOUR OKX ACCOUNT

Protect the exchange account before you protect the assets.

OKX provides multiple account-security controls, including authenticator-app verification, passkeys, anti-phishing protection, device management and withdrawal allowlisting. Use the checks below to strengthen your account before relying on it for valuable assets.

Crypto exchange security is different from wallet security.

Your OKX exchange account uses login credentials and authentication methods. Your separate OKX Web3 wallet can involve its own recovery phrase or private keys.

Never confuse the two security models, and never give your password, verification code, recovery phrase or private key to someone claiming to be support.

What should I never share?
Never share your OKX password, 2FA code, verification code, recovery credentials or private key. Treat unexpected requests for these secrets as suspicious.
What is an anti-phishing code?
An anti-phishing code is a code you create in OKX that can appear in legitimate OKX email communications. It helps you distinguish genuine messages from phishing messages pretending to be from OKX.
What is a withdrawal allowlist?
An allowlist restricts withdrawals to addresses saved in your OKX address book. OKX also provides a new-address withdrawal lock that can delay withdrawals to newly added addresses when enabled.
What if I see an unfamiliar device or passkey?
Treat it as a possible compromise. Remove the unauthorized access, change your password and review the rest of your security controls before continuing normal activity.
OKX EXCHANGE SECURITY

Work through the security controls one at a time.

Do not simply turn features on without verifying them. After each change, confirm that the protection is actually active.

Use a strong, unique OKX password

Your OKX login password protects access to an account that may control valuable assets. Do not reuse your email or banking password.

Click to see protection steps

Step-by-step

  1. Open OKX through the official app or website.
  2. Open your Profile / Security settings.
  3. Find Login password and choose the option to change it if necessary.
  4. Create a strong password using a combination of uppercase and lowercase letters, numbers and symbols.
  5. Make the password unique to OKX.
  6. Store it in a trusted password manager rather than reusing it elsewhere.

VERIFY: Confirm that your OKX password is unique and is not reused for your email, banking or other important accounts.

Enable authenticator-app 2FA

An authenticator app adds another verification layer to your OKX account and can be used for sensitive actions such as login and withdrawals.

Click to see protection steps

Step-by-step

  1. Open the OKX app and go to Profile & Settings → Security, or open Security from your OKX account on the web.
  2. Find Authenticator app under Authentication methods.
  3. Start the setup and open your authenticator app.
  4. Scan the QR code or enter the displayed setup key manually.
  5. Enter the current 6-digit verification code from the authenticator app.
  6. Store the authenticator setup information securely so that changing devices does not leave you without a recovery path.

VERIFY: Sign in or perform a security check and confirm that OKX requests the authenticator verification when appropriate.

Protect your account with a passkey

OKX supports FIDO passkeys, which can use device biometrics, a device PIN or a compatible physical security key.

Click to see protection steps

Step-by-step

  1. Open Profile → Security on OKX.
  2. Find Passkeys in the Security Center.
  3. Select Set up or the option to enable a passkey.
  4. Choose whether to create the passkey on your current device or use another compatible device or physical security key.
  5. Complete the device's biometric or PIN verification.
  6. Give the passkey a recognizable name so you can identify it later.

VERIFY: Return to the Passkeys section and confirm that the passkey belongs to a device or security key you recognize.

Review your passkeys

A passkey you did not create can represent unauthorized access. Regularly review the passkeys associated with your account.

Click to see protection steps

Step-by-step

  1. Open Profile & Settings → Security.
  2. Open the Passkeys section.
  3. Review every listed passkey.
  4. Identify the device or security key associated with each one.
  5. Remove any passkey you do not recognize.
  6. If you discover an unauthorized passkey, change your password and review the rest of your security settings.

VERIFY: Every passkey shown in your OKX Security Center should correspond to a device or security key that you intentionally control.

Create an anti-phishing code

An anti-phishing code can help you distinguish genuine OKX emails from phishing messages pretending to come from OKX.

Click to see protection steps

Step-by-step

  1. Open your OKX Security settings.
  2. Find Anti-phishing Code under Advanced Security.
  3. Create a code that is not your password or PIN.
  4. Complete the requested verification.
  5. Remember the code and check for it in OKX emails that claim to be legitimate.
  6. If a message claiming to be from OKX does not contain your expected anti-phishing code, do not trust the message or its links.

VERIFY: Confirm that your anti-phishing code is enabled and that you know what it should look like in legitimate OKX communications.

Review linked devices

Device management helps you identify computers and phones that have accessed your OKX account.

Click to see protection steps

Step-by-step

  1. Open Security in OKX.
  2. Find Device Management / Linked Devices.
  3. Review the devices listed.
  4. Check whether the device names, locations and activity make sense.
  5. Remove any device you do not recognize.
  6. If you discover an unfamiliar device, change your password and review your authentication methods.

VERIFY: Every device with access to your OKX account should be recognizable and under your control.

Review third-party authorizations and APIs

Third-party applications and APIs can create additional access paths to an exchange account. Remove authorizations you no longer need.

Click to see protection steps

Step-by-step

  1. Open the relevant API or authorization managementarea in your OKX account.
  2. Review the applications and API keys listed.
  3. Identify every authorization that you actually created.
  4. Delete unknown or unused API keys.
  5. Do not create API permissions unless you understand exactly what the application will be allowed to do.
  6. Keep trading or withdrawal permissions as restricted as your intended use allows.

VERIFY: Confirm that every API key and third-party authorization is intentional and still required.

Enable withdrawal allowlisting

OKX's allowlist can restrict withdrawals to addresses saved in your address book. A new-address withdrawal lock can add another delay for newly added addresses.

Click to see protection steps

Step-by-step

  1. Open Assets → Withdraw and select the cryptocurrency you want to manage.
  2. Open the Address Book.
  3. Open the address settings.
  4. Enable Allowlist only.
  5. Consider enabling the New address withdrawal lock if the option is available for your account.
  6. Add only addresses that you have independently verified.
  7. Review the address book regularly and remove unauthorized addresses.

VERIFY: Confirm that withdrawals are restricted to addresses you intentionally added and verified.

Verify every withdrawal

A crypto withdrawal can be irreversible. Verify the recipient address, network, asset and amount before approving it.

Click to see protection steps

Step-by-step

  1. Confirm the recipient address from a trusted source.
  2. Verify that the network on OKX matches the network supported by the receiving wallet or exchange.
  3. Confirm the asset being withdrawn.
  4. Check the amount carefully.
  5. Check whether the asset requires a memo or tag.
  6. Review the withdrawal security verification before confirming.
  7. For a high-value transfer, consider making a small test transaction first when practical.

VERIFY: Before confirming, independently verify the recipient, asset, network, amount and any required memo or tag.

Secure your email and phone recovery channels

Your email address and phone number may be used as part of OKX authentication and recovery. They need their own strong protection.

Click to see protection steps

Step-by-step

  1. Confirm that the email address connected to OKX is still yours.
  2. Protect that email account with a unique password and MFA.
  3. Confirm that the phone number linked to OKX is current and under your control.
  4. Review the email account's active sessions and recovery methods.
  5. Never give an OKX verification code to another person.
  6. Treat unexpected password-reset or verification messages as possible signs of an attack.

VERIFY: Confirm that the email and phone channels connected to OKX are secure and accessible only to you.

Use only official OKX apps and websites

Fake exchange websites and malicious applications can capture passwords, verification codes or other sensitive information.

Click to see protection steps

Step-by-step

  1. Access OKX through the official website or official app store listing.
  2. Avoid installing OKX applications from unofficial download links.
  3. Do not trust an OKX link simply because it was sent through email, SMS, Telegram, WhatsApp or social media.
  4. Check the domain carefully before entering credentials.
  5. Never enter your OKX password or verification code into a page reached through an unexpected message.

VERIFY: Confirm that you are using the genuine OKX application or website before entering credentials.

Protect your device

A secure exchange account can still be compromised if the phone or computer used to access it is infected or poorly protected.

Click to see protection steps

Step-by-step

  1. Keep your phone or computer's operating system updated.
  2. Install OKX only from an official source.
  3. Keep your device protected by a strong screen lock.
  4. Remove suspicious applications and browser extensions.
  5. Be cautious with applications requesting unnecessary accessibility or device-control permissions.
  6. Avoid performing important account recovery actions on a device you suspect may be compromised.

VERIFY: Confirm that the device you use for OKX is updated, locked and free from suspicious applications or extensions.

Review your account after unusual activity

An unfamiliar login, device, passkey, API or withdrawal address should be treated as a security incident rather than an ordinary account check.

Click to see protection steps

Step-by-step

  1. Stop performing unnecessary transactions on the affected account.
  2. If possible, switch to a trusted device.
  3. Change your OKX login password.
  4. Review and remove unrecognized devices.
  5. Review and remove unrecognized passkeys.
  6. Review your API keys and third-party authorizations.
  7. Review your withdrawal addresses.
  8. If necessary, use OKX's official account-freezing or support process.
  9. Preserve suspicious transaction details and other evidence before deleting anything.

VERIFY: Do not resume normal trading until you have identified and addressed the source of the suspicious activity.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Okx security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts