Author: Fu Heshuo, Odaily Planet Daily
On November 16, a major security incident broke out on the trading platform DEXX. Hackers exploited the platform's technical loopholes and stole more than $21 million in user funds, with nearly 1,000 victims. This incident not only caused serious economic losses to users, but also had a profound impact on the industry's trust mechanism, and quickly became a hot topic in the field of Web3 security.
After the incident, the DEXX project team failed to disclose the specific reasons for the theft for nearly a month. To make matters worse, the platform founder and users publicly argued on social media, and the conflict between the two sides continued to escalate.
Recently, Roy, the founder of DEXX platform, accepted an interview with Odaily Planet Daily for the first time, and gave detailed answers to the causes of the security incident, the compensation plan for the victims, and the future improvement direction of the platform, trying to respond to various questions from the victims and the market. (Odaily Note: The following response is only the views of DEXX and does not represent the position of Odaily Planet Daily.)
The following is the interview transcript
Odaily Planet Daily: Can you explain the reason why DEXX was stolen? Is it related to the platform's private key management solution?
Roy: The main reason for the theft was our team's mistake in security management, not a problem with the private key management solution itself.
We use the mainstream trading and custody solutions in the market, which are consistent with many leading platforms (such as BananaGun, Unibot, etc.). This solution has advantages in transaction speed and limit order experience, but it requires extremely high security management of the team. Our mistakes led to the leakage of private keys, and the responsibility lies entirely with us.
Although users reported that private keys were uniformly stored on the server and lacked encryption, this was a misunderstanding of the technical details. In fact, the logic of this solution is to independently generate wallet addresses and is widely used on mainstream platforms in the market. The problem is not the solution itself, but the mistakes made by our team in implementation and management.
Odaily Planet Daily: On social media, many victims believe that their assets were stolen, but in fact the DEXX platform insisted on stealing them. How do you prove your innocence?
Roy: I have explained many times that if we really have misconduct:
Security agencies like SlowMist will not cooperate with us.
Investment institutions will not continue to provide funds.
Law enforcement agencies will take action against us directly rather than assist in hunting down hackers.
In fact, my team and I have no reason to destroy our future for more than 20 million US dollars. Our daily revenue can reach 300,000 or 400,000 US dollars during the peak period of business, and the platform valuation before the incident reached 60 million US dollars. If we really need funds, we can get them in a more reasonable way, such as issuing platform coins or attracting institutional investment.
Odaily Planet Daily: How is the current progress in investigating the theft cases? What difficulties does the platform encounter in handling the incidents?
Roy: The suspect has been identified in China, but the investigation process is very complicated and involves a lot of time and resources. Law enforcement agencies have been involved since the early stages. To ensure the smooth progress of the investigation, we did not disclose details in the early stages of the case, and only released some information on December 6. Disclosure in advance may affect the progress of law enforcement or "alert the enemy", so information disclosure needs to be cautious.
For our team, handling the incident not only requires cooperation with law enforcement agencies, but also requires bearing high technical and management costs. In addition, due to the complex technical details involved in the case and the interests of investment institutions, we still need to further confirm what information can be made public.
Odaily Planet Daily: DEXX officially announced a compensation plan on December 6, including compensation from investment and financing or compensation from self-employed income, but the victims are not satisfied. What do you think about this issue?
Roy: The compensation plan was originally designed based on the worst-case scenario. Although we knew at the time that the worst-case scenario was unlikely to happen, in order to give victims a psychological expectation of the most basic protection, we chose to announce a most conservative plan first. The actual implementation of the plan will be adjusted according to the investment of institutional funds.
At present, the connection of institutional funds has been basically negotiated, but it has not yet been finalized. Since details such as investment amount and institutional valuation have not yet been finalized, we cannot disclose them to the public for the time being. Disclosure in advance may cause market misunderstandings or affect the cooperation intentions of institutions. Therefore, we hope to explain and update the plan to users through a formal announcement after the funds are fully secured.
Odaily Planet Daily: Victims reported that the project team had repeated statements on the compensation plan. For example, on November 28, they promised to finalize the plan within 48 hours, but it was not announced until December 6. How do you explain this?
Roy: First of all, we admit that there is indeed a delay in the release of the plan, but the main reason comes from some uncontrollable external factors and limitations of objective conditions.
In negotiations at the institutional level, the project party is in a weak position. We hope to cooperate with more powerful and reputable institutions to strive for the best interests of users, but this means repeatedly evaluating conditions and delaying the final confirmation of the plan.
In addition, during the hacker hunt, some details involve sensitive information about the cooperation between law enforcement agencies and security companies. Excessive disclosure may cause misunderstandings and even damage the reputation of the parties involved. Therefore, we choose not to disclose it to the public for the time being.
Although the decision to delay was made out of an abundance of caution, we are deeply sorry that our failure to communicate the specific reasons to users in a timely manner led to misunderstandings, for which we are deeply sorry.
Odaily Planet Daily: On December 6, DEXX officially announced that it will finalize the plan within 7 working days. Now the time is almost up. Can the platform confirm the specific compensation plan?
Roy: Our current plan is to launch a compensation platform entrance within the deadline. The specific process is as follows:
User confirmation of the amount of loss: The amount of loss calculated by the third-party agency may be inaccurate or incomplete, so we need users to verify and confirm whether the amount of loss is correct through the platform entrance. Once the user confirms the amount and clicks "Confirm", the final debt record is formed.
Compensation according to claims: The confirmed claims record will be used as the basis for compensation. When the institutional funds are in place, we will make compensation as soon as possible according to the user's claim ratio.
Clarify the debt structure and compensation plan: The "7 working days" we proposed means that we first confirm whether the debt structure is correct, and then the user checks and agrees on the amount of the debt. After this step is completed, the final debt is determined.
At present, the specific compensation plan has been formulated, but it has not been announced to the public due to factors such as institutional funds. The overall process is carried out in stages. After the institutional funds are in place, we will handle the debt compensation in echelons. If the user has any questions after confirming the amount, we will also verify and handle it according to the records.
Odaily Planet Daily: The victim mentioned that the platform had lost contact in the few days before December 6. Why didn’t you step forward in time to maintain close communication?
Roy: There is no such thing as "lost contact". Many people feel this way because we may not respond to their questions within 1-2 days, and users think we are no longer responding. In fact, the pressure and uncertainty we faced at that time were very great, but we were always working hard behind the scenes to deal with the problems. The main work during this period can be divided into three stages:
Tracking the hackers: We spent the first week focusing on working with security agencies and law enforcement agencies to track the hackers. This was the biggest and most expensive part of the early work.
Security upgrade and compensation plan development: In the second week, we comprehensively upgraded the platform's security measures and developed product features related to compensation to provide users with an entry point for compensation.
Institutional docking: In the third week, we shifted our focus to negotiation and communication with institutions. This phase of work is particularly complex and requires dealing with a lot of details.
Although our customer service team will occasionally reply to messages in the group, due to the large number of affected users and the huge number of questions, we are unable to reply to every user immediately.
In addition, there are also great restrictions on the release of announcements. Every time we release an announcement, we need to confirm with 2 to 3 security agencies or law enforcement agencies whether the content can be made public. If some information is disclosed, it will affect the law enforcement agencies' tracking of suspects. For example, law enforcement agencies locked on some suspects in the early stage, but after in-depth investigation, they found that the direction was wrong and needed to be confirmed repeatedly. These repeated verifications took up a lot of our time and energy.
Users may not be able to directly feel our efforts, but behind the scenes, we have indeed put in a huge amount of work. Whether it is tracking hackers, communicating with agencies, or developing compensation plans, we have been moving forward. It’s just that due to the restrictions of law enforcement agencies and the need to protect case investigations, we cannot announce all progress immediately.
In general, we have not lost contact. Instead, while facing pressure from multiple sides, we have worked hard to solve problems for the victims and move the situation in a positive direction.
Odaily Planet Daily: Just because of this incident, many people's trust in DEXX's security capabilities and brand has dropped drastically. If DEXX is launched again one day in the future, how do you think you should gain users' trust and get them to use it again?
Roy: The core of user trust lies not only in security technology, but also in the support and guarantee behind the platform. To this end, we plan to start from the following aspects:
Compensation transparency and fairness: The platform will launch an online verification portal, and users need to confirm the amount of damage to ensure the accuracy of the data. After confirmation, the system will generate a record of the debt and pay compensation in stages after the institutional funds are in place. The entire compensation plan will be based on the principle of openness and transparency, and the progress of compensation will be updated in real time.
Comprehensive security upgrade: Hire a number of top security auditing agencies to conduct in-depth security assessments on the platform. Publicize the upgraded security mechanism, disclose technical details and improvement plans to users. Establish a complete technical support and problem handling system to ensure the stability and security of the platform operation.
Rebuilding brand credibility: Introducing a number of world-renowned exchanges and financial institutions as endorsements to enhance users’ trust in the platform. Through a strong partnership lineup, users can clearly perceive the future security of the platform.
Optimize user emotion management: Establish an efficient user communication mechanism and respond to feedback in a timely manner. Strengthen public relations capabilities and formulate clear crisis response strategies to make users feel valued and understood emotionally.
Strengthening trust: We realize that 99% of users do not understand technology. What they need is not complicated explanations of security technology, but a real sense of trust. Through endorsements from multiple parties and practical actions, users can believe that the future of the platform is worthy of trust.
