What to do on OKX when a trading bot or tracker you used reports a security breach
Portfolio trackers, tax tools and trading bots often hold API keys for your OKX account. If one of these services announces a breach, the attacker may have copies of the keys. The right response is fast and slightly boring: delete first, investigate second. This guide gives the order of steps, what to look for in your account afterwards, and how to decide whether to reconnect the service at all.
Delete the affected key immediately
Log in to OKX on the website, open the profile menu and choose API. Find every key linked to the breached service; good naming at creation pays off here. Delete them. Deleting stops any further use instantly, while editing permissions can leave a window open. If you are unsure which key belongs to which tool, delete all keys you do not actively need and recreate the ones you do. Keep a screenshot of the API page before you delete, showing each key's name and permissions, because it helps support if you later need to report misuse.
Look for activity you did not make
Open order history and review the last few days for trades you do not recognise, especially in illiquid pairs, which attackers sometimes use to move value. Then open bills under Assets and look for unexpected transfers or conversions. If the key had withdrawal permission, check withdrawal records too. Write down anything suspicious with time and order ID, and report it through the in-app support chat.
Strengthen the account while you are there
Change your login password and the API passphrase you used, especially if you reused it anywhere. Check that your authenticator is active and review the device list in Security. If your email address may also have been exposed, change its password and enable two-factor authentication on the email account itself, since resets are sent there.
Reconnecting, if at all
Wait until the service explains what happened and what has changed. If you reconnect, create a fresh key with Read only or Read and Trade, never Withdraw, and bind it to the service's published IP addresses. Give it a new name with the date. If the service cannot explain the breach clearly, choose another tool. Keep a simple list of every tool that holds an OKX key, so the next incident takes minutes rather than an evening of searching through your inbox.
Risk boundary: OKX Italy Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Delete every API key linked to the breached service before reading any further news
- Review order history, bills and withdrawals for activity you did not make
- Recreate keys only with minimal permissions, an IP binding and a dated name