Blockchain Security Firm CertiK Warns OKX IOS Users to Update After Flagging Vulnerability

Blockchain security firm CertiK has issued a warning to all users of OKX wallets on iPhones, urging them to update their iOS applications promptly. Posted on X on December 19, an alert disclosed CertiK’s identification of a critical RCE vulnerability in OKX’s iOS App.

CertiK stressed urgency, urging users to update to avert security risks and safeguard against potential compromise of data and assets. An RCE vulnerability, as explained by CertiK, allows an attacker to execute malicious code on an organization’s computers or network, posing significant threats such as the theft of funds or data breaches.

🚨 Attention! We urge users of OKX wallets to update their iOS app to the latest version immediately. Earlier this month, we identified and reported a critical Remote Code Execution (RCE)  vulnerability in the OKX iOS App,  leading to potential compromise of sensitive data and…

— CertiK (@CertiK) December 19, 2023

Responding promptly to the security concerns raised by CertiK, OKX took swift action to address the issue. On December 19, the exchange swiftly upgraded, fixing the vulnerability, and advised users to shift to iOS version 6.45.0. CertiK subsequently confirmed that the security flaw had been successfully resolved.

OKX reassured its user base: “We have verified that this did not impact any customer assets.” This quick response from the exchange is crucial in maintaining user confidence and preventing potential security breaches.

Thanks @Certik for the note.

We've completed the relevant upgrade & this is no longer an issue. We have verified that this did not impact any customer assets.

The fix has been deployed to iOS version 6.45.0 & we recommend you update the app asap. pic.twitter.com/5HfOnATPeu

— OKX (@okx) December 19, 2023

It’s worth noting that this incident follows a $2.7 million hack on OKX’s decentralized exchange, OKX DEX, on December 13. The breach occurred after the private key of the proxy admin owner was reportedly leaked.