OKX brings Shield to the US with reimbursement tied to security controls

OKX announced the US rollout of Shield on 20 October, extending its account-takeover reimbursement programme to eligible US exchange customers with no subscription or activation charge. The announcement, independently reported by Unchained, ties participation to a passkey, withdrawal protections, transaction verification and device checks. The commercial proposition adds a conditional reimbursement benefit to those security controls.[1][2]

The programme is voluntary and discretionary, not insurance or a deposit guarantee. OKX reviews each case and can reject or reduce payment under its terms. A customer receives at most one approved claim during their lifetime across OKX entities, even when that claim uses only a small part of the available limit. That makes the headline ceiling materially different from an annually renewing allowance.[4]

Authorisation is the decisive boundary

The FAQ distinguishes an outsider taking control of an exchange account from a customer personally approving a transfer after being deceived. The latter is excluded. Credential phishing, malware or a SIM swap may qualify when the evidence shows unauthorised control and the resulting transfer. Shield also excludes trading losses and assets outside the exchange account, so it cannot be read as protection for every loss associated with the OKX brand.[3]

The current terms add an important evidential hurdle: transactions completed using advanced authentication are generally treated as authorised. A customer can challenge that conclusion with objective, verifiable technical evidence; an unsupported assertion is insufficient. Confirmed platform security defects are handled through a separate security-incident process, rather than the standard Shield review and its per-case limits. That provision does not itself specify an alternative compensation amount.[5]

These distinctions affect claims handling as much as product marketing. A fraudulent destination, by itself, does not establish an eligible takeover. The distinction between unauthorised access and a user-authorised payment means the account’s authentication and transfer history are central to understanding a claim. Evidence of a loss answers only part of that question.[4]

Activation creates an ongoing operational condition

Completing the security checklist is insufficient without accepting the terms and activating Shield. Current and linked devices are checked, and all required controls must remain valid. The FAQ says eligibility becomes inactive immediately when a required condition fails, including disabling a required safeguard. Restoration is normally automatic after the problem is corrected and OKX verifies the conditions again. A customer’s displayed status at the incident matters, rather than whether they enabled the programme at some earlier point.[3]

For an approved crypto loss, valuation is fixed at the last unauthorised transfer associated with the incident, using the specified price hierarchy. Later market gains are excluded. Other recoveries reduce the eligible loss, and reimbursement is made in a stablecoin selected under the terms, which may differ from the stolen asset. Shield therefore addresses a measured monetary loss rather than restoring every asset position.[5]

For OKX, the launch makes continued use of restrictive security settings part of the customer proposition. For the customer, the useful question is whether the account is active under the programme and the particular incident qualifies. The upper dollar limit becomes relevant only after those conditions have been established.[1]

Report an error or submit an update