Author | Chu Yan

Translated by GPT and may contain errors. Please refer to the original article.

Recently, the cryptocurrency exchange Bybit was involved in the largest theft in the crypto industry, with North Korean hackers stealing approximately $1.4 billion in cryptocurrency from Bybit's cold wallet. According to information disclosed by Bybit CEO @benbybit on X, the hackers converted the majority of the stolen ETH into BTC via THORChain, with around 16% of the illicit funds transferred to ExCH and another 8% exchanged through the OKX Web3 proxy contract.

Picture: Bybit Hacking and Money Laundering Chain Link (Source: LazarusBounty)

Following this incident, Bloomberg reported that European cryptocurrency regulators are investigating the usage of OKX wallet services by the hackers to mix and exchange the stolen funds. Today, OKX announced through an official statement that it has proactively decided to temporarily suspend its DEX aggregator service after consulting with regulatory authorities.

DEX aggregator service

So, why did the OKX Web3 self-custodial wallet decide to suspend its DEX aggregator service? What regulations might wallet services in the crypto industry be violating in light of EU cryptocurrency regulations?

Does OKX DEX Fall Under the Scope of MiCA Regulation?

The regulatory body reviewing OKX is the European Securities and Markets Authority (ESMA). The main legal framework for cryptocurrency regulation in the EU is the Markets in Crypto-Assets Regulation (MiCA), which will fully come into effect by the end of 2024.

Brief Overview of the MiCA Regulation

This regulation clarifies the scope of cryptocurrency asset oversight, categorizing regulated crypto assets into three types: asset-referenced tokens (ART), electronic money tokens (EMT), and other crypto asset tokens that do not fall under ART or EMT. It also provides detailed regulatory guidelines.

Specific regulatory requirements are established for various crypto asset service providers, including exchanges and institutions. Additionally, it includes provisions to prevent insider trading, protect users, and facilitate cooperation among national regulatory authorities in investigations and penalties. For a deeper analysis of MiCA, you can refer to prior articles discussing this regulation in detail. link

Legal Basis for OKX DEX Being Subject to MiCA Regulation

1. OKX DEX Provides Crypto Asset Services Requiring Licensing Under MiCA

The MiCA regulation states that if crypto asset services are provided cross-border within the EU jurisdiction, a MiCA authorMiCA-compliant license as a licensed crypto asset service provider (CASP) is required.

The definition of crypto asset services includes exchanging one type of crypto asset for another and executing trading orders on behalf of clients.

While OKX DEX does not directly provide liquidity for token exchanges, it operates as a liquidity aggregator. In simple terms, if a user wants to exchange 1 Bitcoin (BTC) from their OKX Web3 wallet for an equivalent value of Ethereum (ETH), OKX DEX calculates the optimal exchange path through algorithms to facilitate the conversion.

Although OKX DEX does not use its own funds to assist customers in token exchanges, regulators could still interpret its operations as executing orders for clients to purchase or sell crypto assets, which, if within the EU jurisdiction, would necessitate applying for a MiCA CASP license.

2. OKX DEX is Not a Fully Decentralized Protocol and Cannot Evade MiCA Regulation

The MiCA regulation specifies that if crypto asset services are provided entirely in a decentralized manner without any intermediaries, they are not subject to regulation.

Although the OKX Web3 wallet is a decentralized self-custodial wallet, the wallet service page is integrated with the OKX exchange. According to Bloomberg's report, the usage agreement for the OKX Web3 wallet clearly states that the Singapore entity of OKX acts as the operator.

Thus, the DEX aggregator service provided by the OKX Web3 wallet is challenging to classify as a fully decentralized protocol, and therefore cannot evade MiCA regulation.

Why Did OKX DEX Suspend Its Services Urgently?

Once OKX DEX is identified as falling under the MiCA regulation, the fact that the current aggregation proxy service of the OKX Web3 wallet was exploited by North Korean hackers for money laundering becomes a significant concern. According to Article 64, point 7 of the MiCA regulation, if a crypto asset service provider fails to establish effective systems to detect and prevent money laundering and terrorist financing, the regulatory authority may revoke its MiCA-compliant license.

OKX officially announced in January that it had obtained a MiCA license with Malta as its host country. If OKX DEX is found to violate anti-money laundering regulations, it could jeopardize its recently acquired MiCA license.

Furthermore, the MiCA regulation stipulates that before revoking the authorization of a crypto asset service provider, the supervisory authority may consult with agencies responsible for overseeing compliance with anti-money laundering and counter-terrorism financing rules.

Therefore, this morning, OKX CEO Star Xu emphasized on X that the OKX Web3 wallet has introduced features such as blocking specific IPs and real-time detection and prevention systems for blacklisted addresses to combat related money laundering activities. The aim is to demonstrate to anti-money laundering regulators that the OKX Web3 wallet has equipped its crypto asset services with necessary on-chain anti-money laundering detection and prevention systems, thus mitigating potential regulatory penalties.

Conclusion and Outlook

As an on-chain wallet, serving as an entry point to the Web3 world, it embodies the cryptocurrency industry's aspiration for a decentralized world. Leading decentralized exchanges are striving to develop on-chain businesses, and OKX is at the forefront of providing an excellent product experience in on-chain wallets, but it currently faces compliance challenges.

Observant readers may notice that Binance, after undergoing regulatory compliance adjustments, has integrated wallet functionality within its centralized exchange. To use Binance Wallet, one must register a Binance account, unlike the OKX wallet, which allows for direct use without being tied to the OKX exchange account.

As global regulatory frameworks for the cryptocurrency industry become more refined, it is inevitable that regulation will exist wherever there are people. Thus, future on-chain wallet services will likely need to incorporate corresponding on-chain anti-money laundering systems to detect, prevent, and combat on-chain crimes, thereby providing crypto asset services to users within a compliant regulatory framework.

Follow us

Twitter: https://twitter.com/WuBlockchain

Telegram: https://t.me/wublockchainenglish