API keys that aren't bound to IP and have transaction or withdrawal permissions will be automatically deleted after 14 days of inactivity. API keys will not be considered inactive if they are used to call private or account-related interfaces that require identity verification, such as viewing account balance, billing data, or placing orders.

Monitor your login activity in the app regularly for any suspicious devices or IP addresses. Save and use only the official OKX website (https://www.okx.com/) and download the app from verified app stores. If something seems off, contact OKX support through the app for official assistance.What I should NOT do: Don’t click on links from suspicious or unexpected SMS messages. Don’t call phone numbers from SMS messages unless you’ve confirmed their legitimacy through official sources.

When entering the verification code and completing facial verification, please ensure both steps are performed in the same IP network environment. If the network environment differs between the web and app, to complete the process more smoothly (such as resetting your password), we recommend performing the operation directly in the app. Depending on your country and available choices, you may need to take certain steps in order to authorize your device.

A VPN hides your IP from local observers, but it doesn’t stop on-chain analysis. Wallet hygiene (avoiding address reuse, using HD wallets) is more effective. Explore more about risk and fraud by visiting here.

Use IP whitelisting and withdrawal address whitelisting to restrict unauthorized access. Use Secure Wallets for Storage Store long-term holdings in a dedicated hardware wallet. Keep only essential working capital on exchanges. Protect Credentials and Access Provide view-only API keys to accountants or advisors. Never share login or trading credentials. Implement a Risk-Control Strategy Define rules for position sizing, exchange diversification, and cold storage thresholds.