Crypto users shouldn’t have to take security on faith, says OKX Europe CEO

Personal wallet and account breaches jumped to 158,000 incidents globally in 2025, Chainalysis says, showing a wider shift by threat actors toward phishing and attacks that steal everyday users’ login data. At the same time, European regulators have taken steps to move liability for fraud toward traditional payment service providers and fintechs with PSD3 and updates to PSR, which puts the digital assets space under rising pressure to show how it shares security responsibility with retail customers.

OKX Europe CEO Erald Ghoos traced the industry’s approach to user responsibility back to the principle of “not your keys, not your coins,” which was originally intended to empower users:

“In practice, it has too often functioned as a disclaimer, a way for platforms to hand users sovereignty and liability in the same breath, without doing much to earn the trust that comes with either,” Ghoos said.

The OKX exec added that this risk-shifting model is increasingly outdated as millions of users now rely on digital asset platforms for everyday financial functions once reserved for banks and brokers, including holding assets, making payments, transferring value and accessing markets. While custody practices have matured and regulation has advanced in major markets — including the EU, where OKX is authorized under MiCA, MiFID and Payment Institution licenses — consumer recourse that goes beyond the minimum regulatory requirements when an individual account is compromised remains a critical blind spot.

Europe’s €4.2 billion payment fraud problem

Ghoos used the most recent figures from the European Banking Authority (EBA) and the European Central Bank (ECB) to note that payment fraud in Europe reached €4.2 billion in 2024, up from €3.5 billion the year before. In that wider threat landscape, he identified “account takeover” — where an attacker compromises a user’s credentials or device rather than exploiting a weakness in the platform itself — as a distinct risk that platforms can reduce with stronger default safeguards and clearer protection for users who enable them.

While most of the fraud reported by the EBA has taken place on traditional financial platforms, it remains a risk for any account that holds any kind of value.  “This is an area where crypto platforms can take the lead and introduce greater protections. One of crypto’s greatest strengths is that it is fast and irreversible, with no intermediaries to slow things down and take a cut, but that also means crypto platforms have a responsibility to ensure that their customers are equipped with the tools they need to protect their accounts,” Ghoos added.

“Early adopters were willing to take security into their own hands, but as crypto becomes increasingly mainstream, regular customers need guidance and protection for their platform. It’s not about whether any single platform’s security is good; most regulated platforms today meet a high technical bar, but whether the industry can show users those controls work, and what happens when something goes wrong.”

Moving beyond self-attested security

To bridge that accountability gap, Ghoos advocated for recurring independent audits that test whether a platform’s security controls work in practice. OKX’s European operations are built around external security assessments and standards, including SOC 1 Type 2 and SOC 2 Type 2 audits, ISO 27001, 27017 and 27018 certifications, PCI-DSS v4.0.1 for payment data handling, and the Cryptocurrency Security Standard (CCSS) for crypto key custody.

“At OKX, we’ve built our European operations around this set of certifications precisely because we think this should be the baseline expectation, not a differentiator,” Ghoos added.

Beyond third-party audits, Ghoos called for security teams to share findings from internal testing, including failures that reveal weaknesses in their own systems. He pointed to a recent exercise shared by OKX’s Central Information Security team at the DEFCON security research conference, where company engineers were tasked with finding ways to bypass a production AI-based code scanner.

During the exercise, engineers exposed several blind spots in the AI tool — overwhelming the system with volume until its attention degraded, hiding logic inside unsupported file formats, and embedding misdirection to manipulate how the model reasoned. To address those weaknesses, OKX turned to redundancy, splitting reviews across multiple independent reviewers with isolated context and requiring agreement before code is cleared.

“We shared that publicly, because a security function that only ever reports good news isn’t being tested hard enough,” Ghoos explained. “We’d rather our own teams find the gaps than wait for someone outside the company to find them for us, and we think the rest of the industry sharing its failures as openly as its successes would make everyone’s systems more resilient.”

Security as a shared responsibility

Ghoos described account security as shared: platforms build and independently verify enhanced security controls, and users switch on the safeguards available to them. He pointed to OKX Shield, the company’s account-protection program, as OKX’s own approach to that balance.

“Security works best when it’s shared. We build and test the controls, users enable the protections we give them, and OKX Shield backs that up with reimbursement starting from €100,000 and going up to €500,000 for customers affected by account takeover, calibrated to the safeguards they’ve enabled,” Ghoos said.

The OKX Europe CEO argued that independent, verifiable security controls should become an industry-wide baseline.

“The broader point is this: trust in crypto won’t be built by any one company’s product launch,” Ghoos concluded. “It will be built when verifiable controls and independent audits become the standard the whole industry is expected to meet. Users shouldn’t have to take a platform’s security on faith. They should be able to see it for themselves.”

Disclaimer

This is a marketing communication. OKX is the trading name of OKX Europe Ltd, a Malta-registered company licensed by the MFSA as a Crypto-Asset Service Provider. This email is not (i) investment, financial, accounting, legal or tax advice, or (ii) an offer or solicitation to buy, sell or hold crypto/digital assets. Crypto/digital assets, including stablecoins and NFTs, are subject to market volatility, involve high risk, can lose value, and can become worthless. You should buy crypto/digital assets only if you are prepared to accept the risk of losing all of the money you put into such assets. Please consult your advisors for questions about your circumstances. Not all products offered in all regions. For more details, see OKX Terms of Service and Risk & Compliance Disclosure.