Ben Strack

Spot cryptocurrency and derivatives exchange OKX is bolstering its efforts around transparency in a bid to reinforce trust from existing customers — and in a play to win over potential new traders — following the crash of rival FTX, which took the opposite approach.&nbsp;&nbsp;



The Seychelles company has rolled out a proof-of-reserves page on its website that shows its latest collateralization ratios, as well as a self-audit tool intended to verify assets are backed on a one-to-one basis, known as <a href="https://blockworks.co/news/what-are-proof-of-reserves-and-can-they-build-back-trust" target="_blank" rel="noreferrer noopener">proof of reserves</a>.



The concept, designed to act as a safeguard for client funds that becomes even more relevant in the event of another pronounced downturn and ensuing spate of withdrawals, is gaining traction. FTX’s <a href="https://blockworks.co/news/ftx-auditor-proof-of-reserves" target="_blank" rel="noreferrer noopener">auditor</a> and Binance have both pushed for the setup to become an industry standard.&nbsp;



OKX, meanwhile, is rolling out what it calls an independent custodial wallet designed to enable institutional clients to secure their assets separately from its reserves.&nbsp;



The wallet, set to launch in coming weeks, is designed as a real-time tracker for wallet balances and safeguard the private keys of customers in a custodial model.&nbsp;



Ripple effects have continued, largely unabated, following the liquidity crunch that essentially forced FTX <a href="https://blockworks.co/news/whats-next-for-ftx-and-its-customers-after-bankruptcy-filing/" target="_blank" rel="noreferrer noopener">to declare bankruptcy</a>. Lawyers for FTX and its affiliates said in a <a href="https://pacer-documents.s3.amazonaws.com/33/188450/042120644082.pdf" target="_blank" rel="noreferrer noopener">motion</a> that as many as <a href="https://blockworks.co/news/ftx-doom-draws-dozens-of-federal-state-international-agencies" target="_blank" rel="noreferrer noopener">one million creditors could be affected</a>.



Lennix Lai, OKX’s financial markets director, told Blockworks that while the crypto exchange had no direct exposure to FTX, customers are reeling and want to know what firms — especially exchanges and custodians — are doing about their unease.



“That’s why we’re in the process of a third-party audit to publish our <a href="https://www.investopedia.com/terms/m/merkle-tree.asp" target="_blank" rel="noreferrer noopener">Merkle Tree </a>proof-of-reserves, and we’ve shared 23 of our BTC addresses and 13 ERC20 addresses <a href="https://twitter.com/okx/status/1590812545346330624" target="_blank" rel="noreferrer noopener">publicly</a> to verify a portion of our reserves,” he said.&nbsp;



Added Lai: “Our new proof of reserves [and self-audit features] give users the ability to self-verify that their assets are 100% backed. But the third-party audit will provide additional reassurance.”



It is unclear just how effective so-called “<a href="https://blockworks.co/news/what-are-proof-of-reserves-and-can-they-build-back-trust" target="_blank" rel="noreferrer noopener">proof of reserves</a>” dashboards from OKX and others, like Crypto.com, will be in <a href="https://blockworks.co/news/crypto-exchange-proof-of-reserves-not-calming-investor-fears" target="_blank" rel="noreferrer noopener">calming investor fears</a>.&nbsp;



“As this crisis has made apparent, centralized intermediaries of financial transactions are opaque and often untrustworthy,” executives at crypto-focused asset managerPantera Capital wrote in a Nov. 11 letter to clients.. “Nothing could have made more obvious the need for decentralized, trustless protocols that allow users to trade, hold, and transfer their assets without relying on entities like FTX, Celsius or Voyager.”



Crypto storage wallet Arculus said it has seen a sales boost amid the recent heightened volatility, but declined to comment on specific sales. And digital assets access provider Wellfield Capital said last week it expects its revenue to rise, as the market shifts away from centralized exchanges — toward decentralized services and self-custody.



“Going forward, OKX will continue to do whatever we can to demonstrate our solvency and stability, while continuing to safeguard our users’ data,&#8221; Lai said.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Crypto Exchange OKX Has A Plan to Assuage Traders’ Fears: Transparency

Bessie Liu

<div id="highlights-block_62aa2d415a283" class="highlights">
 <ul>
 <li>The discovered vulnerability exposes browser wallet users’ secret recovery phrases</li>
 <li>Affected wallet providers were contacted, and the vulnerability was kept confidential until the security issues were remediated</li>
 </ul>
 
</div>



A number of popular browser-based crypto wallets are vulnerable to hacking under certain conditions, according to new research. 



Blockchain security firm Halborn found several instances where wallets including Brave, MetaMask and Phantom can be compromised under specific computer conditions — adding yet another wrinkle to traders still reeling from recent high-profile decentralized finance (DeFi) hacks.&nbsp;



The conditions can expose a crypto wallet user’s secret recovery phrase (a series of words generated that gives the owner access to their crypto), which can then be used to change their private key. All told, billions of dollars of digital assets are stored in software wallets.&nbsp;



Affected wallet providers were contacted and the vulnerability was kept under wraps until the security issues were remediated.



<h3>Who is affected? </h3>



Users who meet the following conditions may be at risk:



<ul><li>Users who have unencrypted hard drives</li><li>Users who have previously imported their secret recovery phrase into a web extension on a device that is in the possession of someone else or have had their computer compromised</li><li>Users who have used the “show secret recovery phrase” checkbox to view their secret recovery phrase on-screen during the import process</li></ul>



Cryptocurrency wallets like the ones impacted by this vulnerability, such as Metamask, are a self-custody wallet — meaning users alone are responsible for safeguarding their private keys. 



“Exchanges like Coinbase or Binance usually hold custody of those keys on the behalf of their customers,” Steven Walbroehl, Halborn’s chief security officer and co-founder, told Blockworks.



“This impact is only for those that self-custody those assets, and it is the users&#8217; responsibility to take it seriously, upgrade the wallets to the patched version listed on the wallet developer&#8217;s websites, and to rotate their mnemonic phrase if they think it may be at risk,” Walbroehl said.&nbsp;



MetaMask has <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">asked</a> users to update their extension versions to 10.11.3 and later and to “take the time to enable full disk encryption on computers.”



Echoing Walbroehl, Dan Finlay, founder and group manager at MetaMask <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">wrote in a blog post</a> that users should “remember that it’s your responsibility to keep your computer secure. No wallet or software can keep itself safe if the system it runs on is compromised. Take time to learn how to avoid installing a virus on your computer.” 



Phantom, meanwhile, wrote in a <a href="https://phantom.app/blog/demonic-vulnerability" target="_blank" rel="noreferrer noopener">blog post</a> that to protect themselves on Web3, on top of general internet safety measures, users should diversify their wallets to minimize risk and use hardware wallets to store large amounts of assets and currencies.



“Other mitigations include storing the mnemonic phrase/key on a hardware-based wallet like Trezor or Ledger. These wallets still work with software wallets like Metamask when physically connected via a USB cable&#8230;but it protects the keys from attackers that may access your disk,” Walbroehl said.



Halborn has been rewarded $50,000. The wallet providers did not immediately return requests for comment.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">