Last updated:
Author
Hongji Feng
Author
Hongji Feng
Share
Why Trust Cryptonews
Key Takeaways:
- EU regulators are reexamining crypto oversight as platform designs blur centralized and decentralized boundaries.
- Scrutiny focuses on ensuring robust anti-money laundering practices within evolving service models.
- Potential enforcement actions could redefine compliance standards across similar crypto platforms.
European crypto regulators are considering penalties against OKX after hackers allegedly laundered $100 million in stolen funds through its Web3 platform, following an exploit on the crypto exchange Bybit.
Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing…
— Bybit (@Bybit_Official) February 21, 2025
According to a Bloomberg report on March 11 citing anonymous sources familiar with the discussions, authorities from the European Securities and Markets Authority (ESMA) and national regulators met on March 6 to assess whether OKX’s Web3 platform should fall under the EU’s Markets in Crypto-Assets (MiCA) regulations.
Regulators Debate Whether OKX’s Web3 Service Falls Under MiCA Rules
While fully decentralized platforms are exempt, some regulators argue that OKX’s service is integrated into its main exchange, making it subject to MiCA rules.
A presentation at the meeting reportedly stated that OKX’s Web3 user interface, token-swapping services, and terms of use indicate control by an OKX Singapore entity, suggesting that the platform should be regulated under MiCA.
The sources said some regulators recommended revoking OKX’s MiCA permit and restricting its operations in the European Economic Area (EEA).
Others raised concerns over Malta’s decision to grant OKX MiCA pre-authorization, urging the country’s financial authority to reassess the exchange’s compliance.
A presentation at the meeting suggested regulators consider whether the case could involve a violation of North Korea-related sanctions, given Bybit’s claim that the hackers are linked to North Korea.
Potential Penalties Could Reshape Compliance for Crypto Platforms
OKX has denied wrongdoing, stating that it is assisting Bybit and regulators in tracking and blocking wallet addresses linked to the stolen funds.
The exchange emphasized its compliance with local laws and said it responds to regulatory inquiries as needed.
The Bloomberg article is misleading. Like all other major crypto exchanges, OKX provides a self-custody wallet service/swap feature that serves as an aggregator to create efficiency for the users. When Bybit got hacked, we reacted in two ways. (1) We froze associated funds moving… https://t.co/HUUmA8W2eq
— OKX (@okx) March 11, 2025
ESMA has not confirmed any enforcement action but said it “stands ready to deploy all available regulatory tools, if necessary, to safeguard market integrity and investor protection.”
Regulators face ongoing challenges in defining the boundary between centralized exchanges and Web3 services, especially as platforms integrate more features.
If hybrid models like OKX’s Web3 platform fall under stricter oversight, other exchanges offering similar services may also come under regulatory scrutiny.
Stronger enforcement on exchange-linked Web3 services could lead to tighter compliance requirements, particularly around anti-money laundering measures.
If regulators impose penalties on OKX, it may push other platforms to reassess how they manage decentralized products within regulated frameworks.
Frequently Asked Questions (FAQs):
MiCA applies to active crypto services in the EU. Decentralized platforms are theoretically exempt, but regulators argue that OKX’s Web3 service is linked with its main exchange and therefore is under MiCA rules.
The money launderers of hackers on OKX’s Web3 platform are allegedly North Korea-linked. The Lazarus Group has been responsible for large crypto hacks, stealing funds to get around sanctions and finance state operations.
Regulators weighed whether or not the case could involve North Korea-linked sanctions violations. If so, enforcement could shift outside of MiCA to international financial sanctions.
Some exchanges, including Coinbase, have already altered services to comply with MiCA. Others will be compelled to reconsider offerings that blend centralized and decentralized elements to avoid regulatory scrutiny.
