When Hacker Attacks Shift from "Hard" to "Soft": The Integrated "Defend - Block - Compensate" Model Is Changing CEX Security Logic

Binance's $6.34 billion hack has pushed centralized exchanges to overhaul security models, with OKX positioning itself as a case study in a three-layer "vault-block-compensate" framework. OKX says over 90% of assets sit in fully offline, air-gapped cold wallets, with withdrawals requiring multi-party signatures held by different people across separate physical locations, backed by continuous third-party audits from firms including Hacken, SlowMist and CertiK. The shift comes as attacks move from "hard" exploits of smart contracts to "soft" breaches of front-ends, internal tooling and signing key holders—Binance's incident reportedly involved a compromised internal AI tool used to reach employee devices and wallet infrastructure. OKX CEO Star Xu said cold storage alone is insufficient, arguing signing systems must interpret the substance of each transaction and halt on anomalies, with development, security, risk and audit teams jointly reviewing the asset framework. Since early 2025 OKX has embedded AI across vulnerability discovery, penetration testing, real-time monitoring and anti-fraud, including its SkyNet AI on-chain address screening and TARDIS user-behavior monitoring. Watch whether peers adopt comparable transaction-level circuit breakers and AI-driven defense, and whether OKX's "never hacked" record holds as AI lowers the cost of finding and exploiting flaws.