OKX Europe CEO Erald Ghoos stated that as the boundaries between crypto exchanges and traditional financial applications become increasingly blurred, platforms have often left users to bear security risks on their own in the past.
According to Chainalysis, in 2025, the number of global incidents of personal wallets and accounts being hacked soared to 158,000, indicating that threat actors are increasingly turning to phishing attacks and stealing login information from ordinary users. At the same time, European regulatory authorities have adopted PSD3 and updates to PSR, shifting more of the responsibility for fraud to traditional payment service providers and fintech companies. This also puts increasing pressure on the digital asset industry, which needs to demonstrate how it will share security responsibilities with retail customers.
Ghoos traces the industry's perspective on user responsibility back to the principle that "if it's not your key, it's not your coin." He says that this principle was initially intended to empower users:
"But in practice, it often becomes a type of disclaimer. While the platform hands over sovereignty to users, it also shifts responsibility onto them, yet it does not truly earn the trust that should correspond to that."
This executive, OKX, added that as millions of users now rely on digital asset platforms to perform daily financial functions that were once exclusive to banks and brokers, including holding assets, making payments, transferring value, and entering the market, this risk transfer model is becoming increasingly outdated. Although custody practices have matured and regulation in major markets is also advancing—including in the European Union, where OKX has been authorized to operate under the frameworks of MiCA, MiFID, and payment institution licenses—consumer relief beyond the minimum regulatory requirements remains a key blind spot when personal accounts are stolen.
420 million euros in payment fraud issues in Europe
Ghoos Citing the latest data from the European Banking Authority (EBA) and the European Central Bank (ECB), it is stated that the scale of payment fraud in Europe reached 4.2 billion euros in 2024, up from 3.5 billion euros the previous year. In this broader threat environment, they consider "account takeover" – where attackers gain access to users' credentials or devices rather than exploiting vulnerabilities in the platforms themselves – as a separate risk. Platforms can reduce this risk by implementing stronger default protections and providing clearer safeguards for users who opt to enable these protections.
Although most of the fraud reported by EBA occurs on traditional financial platforms, it remains a risk for any account that holds value. "This is an area where crypto platforms can take the lead in introducing stronger protections. One of the greatest advantages of crypto is its speed and irreversibility, and there are no intermediaries to slow down the process or charge fees. However, this also means that crypto platforms have the responsibility to ensure that customers are equipped with the tools needed to protect their accounts," added Ghoos.
Early users were willing to take on their own security responsibilities, but as encryption becomes more mainstream, ordinary customers need platforms to provide guidance and protection. The focus is not on whether a particular platform's security is good enough; nowadays, most regulated platforms have met very high technical standards. Instead, the question is whether the industry can prove to users that these control measures are indeed effective, and what would happen in the event of a problem.
Claiming to go beyond declarative security
To address this gap in responsibility, Ghoos advocates for regular independent audits to verify whether the platform's security controls are truly effective in practice. OKX's European operations are built around external security assessments and multiple standards, including SOC 1, Type 2, and SOC 2 audits, ISO 27001, 27017, and 27018 certifications, PCI-DSS for payment data processing, as well as v4.0.1 for encrypted key management, and Cryptocurrency Security Standard ( CCSS ).
"At OKX, we built our European business around this set of certifications because we believe it should be the basic requirement of the industry, rather than a differentiating advantage." Ghoos added further.
In addition to third-party audits, Ghoos also calls on the security team to make public the results of internal tests, including failed cases that exposed weaknesses in their own systems. He mentioned that the central information security team at OKX recently shared an exercise at the DEFCON Security Research Conference, where engineers were required to find ways to bypass the AI code scanner in the production environment.
In this exercise, engineers exposed several blind spots of the AI tool: overwhelming the system with massive input, which led to a decline in its performance; hiding logic in unsupported file formats; and embedding misleading information to manipulate the model's reasoning process. To address these weaknesses, OKX adopted a redundant mechanism, distributing the review tasks among multiple independent reviewers who were isolated from each other in terms of context, and requiring consensus before the code was released.
"We made this public because if a security function only reports good news, it means that the tests it undergoes are not rigorous enough." Ghoos explained, "We would rather have our own team discover the vulnerabilities first than wait for external parties to do so on our behalf. We also believe that if the entire industry could share failures as openly as they share successes, all systems would become more resilient."
Security should be a shared responsibility of the platform and users.
Ghoos describes account security as a shared responsibility: the platform builds and independently verifies enhanced security controls, while users enable available protective measures. He views OKX's account protection program OKX Shield as the company's practice of this balance.
"Security is most effective when shared. We are responsible for building and testing control measures, users are responsible for enabling the protections we provide, and OKX Shield offers corresponding support: compensation for account takeover affecting customers starts from 100,000 euros and can reach up to 500,000 euros, with the specific amount depending on which protective measures they have enabled." Ghoos says.
This CEO, OKX Europe, believes that independent and verifiable security controls should become the industry-wide baseline standard.
More broadly speaking, trust in encryption cannot be established by the release of products from any single company. Ghoos summarized,"Trust can only be established when verifiable control and independent auditing become standards that the entire industry must meet. Users should not rely solely on trust to accept the security of a platform; they should be able to see for themselves."
Disclaimer
This is a marketing communication. OKX is the trading name of OKX Europe Ltd. The company is registered in Malta and has obtained an encryption asset service provider license issued by MFSA. This email is not: (i) investment, financial, accounting, legal, or tax advice; nor is it (ii) an offer or solicitation to buy, sell, or hold encryption/digital assets. Encryption/digital assets, including stablecoins and NFT, are subject to market fluctuations and carry higher risks; they may depreciate in value or even become worthless. You should only purchase encryption/digital assets if you are prepared to bear the risk of losing all your invested funds. If you have any questions about your own situation, please consult your advisor. Not all products are available in all regions. For more details, please refer to the OKX Service Terms and Risk and Compliance Disclosure.
