OKX shuts down DEX aggregator as European regulators probe Bybit hack
OKX license under regulatory scrutiny
OKX has shut down its DEX aggregator after regulators found that $100 million laundered through the platform came from the $1.5 billion Bybit hack. European regulators are investigating whether OKX Web3 violates MiCA regulations, which could lead to fines or even license revocation.
The crypto exchange OKX suspended its service used to launder funds from the $1.5 billion Bybit hack after European regulators concluded that the platform's DEX aggregator enabled North Korean hackers to move at least $100 million in stolen Bybit assets in February 2025.
"After consultations with regulators, we have proactively decided to temporarily suspend our DEX aggregator services," OKX stated on Monday.
The shutdown will allow OKX to implement additional updates to prevent similar incidents in the future.
According to Cryptopolitan, OKX’s decision followed a March 6 meeting of European regulators, where officials discussed how the OKX Web3 platform was used to process stolen cryptocurrency.
Did OKX Web3 violate MiCA regulations?
OKX operates under the European Markets in Crypto-Assets (MiCA) regulations, which impose strict rules on exchanges. During the March 6 meeting, regulators from all 27 EU member states debated whether OKX Web3 should fall under MiCA rules. The key issue is that while fully decentralized platforms are generally exempt, OKX's platform is not entirely decentralized.
OKX’s DEX aggregator was directly integrated into the company’s main platform, leading regulators from Austria and Croatia to argue that this connection places OKX under MiCA jurisdiction, potentially exposing the exchange to fines. However, OKX disagrees.
"OKX Web3 is a DEX aggregator, not a custodian of client assets. Our role is to provide access to liquidity across multiple protocols, offering users an efficient peer-to-peer trading experience. Despite this, some have deliberately misrepresented our platform, undermining not only OKX Web3 but also the broader industry and regulatory discussions," OKX stated.
OKX license under regulatory scrutiny
OKX has been expanding in Europe through MiCA licensing. In January, the company received preliminary authorization via Malta and, by February, gained approval to passport its services across the European Economic Area (EEA). Now, that approval is under threat.
A presentation at the March 6 meeting highlighted that the OKX Web3 platform lists OKX Singapore as its primary operator. Regulators are now questioning whether this platform was truly decentralized or whether it falls under MiCA jurisdiction.
The most severe consequence could be the revocation of OKX’s EEA license, which would block the exchange from offering services across the EU. However, under Article 64 of MiCA, regulators can only revoke a license if a company fails to prevent money laundering or violates other key regulations. Additionally, ESMA and the EBA have the authority to instruct national regulators to reassess whether a company still meets licensing requirements.
"Claims that OKX was involved in laundering any funds are inaccurate and absurd. We are assisting Bybit in tracking wallet addresses and blocking assets in real time… We comply with local laws, work closely with regulators, and respond to requests as they arise," OKX stated.
Regulators in Malta, where OKX’s MiCA approval was processed, are now in discussions with the company’s senior management regarding the Bybit hack. However, they have not yet taken any official action. ESMA issued a statement saying it is “prepared to use all available regulatory tools if necessary to ensure market integrity and protect investors.”
As we wrote, OKX, one of the world’s largest cryptocurrency exchanges, has secured a Markets in Financial Instruments Directive II (MiFID II) license, marking a significant step in its European expansion.
