The cryptocurrency exchange OKX has temporarily halted its decentralized exchange (DEX) aggregator following serious allegations that the platform was used to launder $100 million connected to the recent Bybit hack. The incident, reportedly orchestrated by North Korea’s Lazarus hacker group, is raising new concerns about the vulnerabilities in decentralized financial platforms.

In a blog post released Monday, OKX announced the suspension of its DEX aggregator, citing a need to bolster its security infrastructure and address gaps in blockchain tracking systems. “Recently, we detected a coordinated effort by Lazarus group to misuse our defi services,” the exchange stated. It further explained that, after consulting with regulatory authorities, it made the “proactive decision to temporarily suspend our DEX aggregator services.” This step, according to OKX, will allow them to implement critical upgrades aimed at preventing similar incidents in the future.

The decision follows a wave of media reports suggesting that approximately $100 million in cryptocurrency, primarily Ethereum (ETH), stolen during the $1.5 billion Bybit hack, may have been funneled through OKX’s Web3 services. The Lazarus Group, long linked to cybercrimes targeting global financial systems, is accused of orchestrating the sophisticated laundering operation via decentralized platforms and cross-chain bridges.

While OKX has taken swift action to halt its DEX aggregator, it has assured users that wallet services remain functional. However, as a precautionary measure, the creation of new wallets has been restricted in certain regions. The company reiterated its commitment to strengthening security protocols and protecting user assets, emphasizing that these measures are part of a broader strategy to safeguard the integrity of its services.

Regulatory scrutiny has intensified following the allegations. Last week, Bloomberg reported that European Union regulators have opened an investigation into OKX’s potential involvement in laundering proceeds from the Bybit hack. Authorities are now examining whether OKX’s Web3 services fall under the jurisdiction of the Markets in Cryptoassets (MiCA) regulatory framework and whether punitive actions are warranted.

Earlier this year, OKX secured a MiCA pre-authorization through its base in Malta, later receiving approval to operate across the European Economic Area (EEA). However, in light of the recent claims, Malta’s financial watchdog is reassessing the exchange’s license and evaluating whether it should be revoked due to the alleged misuse of its services.

If OKX is found in violation of MiCA regulations, the consequences could be severe, potentially including sanctions or even the loss of its license to operate within the EU.

This incident not only underscores the persistent threat posed by state-sponsored hacking groups like Lazarus but also highlights the regulatory challenges facing decentralized financial ecosystems. As authorities and platforms grapple with evolving cyber threats, exchanges like OKX find themselves at the center of a growing debate over compliance, accountability, and security in the crypto world.

By Alejandro Silva Ramírez, Crypto Analyst & Columnist