OKX Shield Brings Account Takeover Reimbursements to U.S. Customers

OKX expands its account takeover program

OKX is bringing its account takeover reimbursement program to U.S. customers, with payouts capped at $100,000 for most eligible users and as high as $500,000 for its largest VIP accounts. The offer has no subscription or activation fee, but customers must maintain a prescribed set of security controls to qualify. That structure makes the program less like a general promise to cover fraud and more like a benefit tied to how an account is configured and used.

VIP tier 1 through 3 customers can claim up to $250,000, while those in VIP tier 4 and above face a $500,000 cap. The program targets losses caused by outsiders who take over accounts through phishing, malware or SIM swaps. Those methods can exploit a customer’s device or phone number, but the terms make clear that the method of attack alone won’t guarantee reimbursement. A claim still has to meet OKX’s eligibility requirements and survive its review.

The headline caps are substantial, but they’re ceilings, not guaranteed payments. Most eligible users face the lower limit, and the largest cap is reserved for higher VIP tiers. That distinction matters: the advertised maximum can make the offer sound broader than it is for customers who don’t qualify for those tiers.

Security settings determine eligibility

Customers must set up a passkey, enable large withdrawal protection and transaction verification, and turn off web withdrawals. OKX also scans linked phones and computers for malware and checks whether devices are rooted or jailbroken. Protection applies only while all required settings remain enabled, so account security becomes an ongoing condition rather than a one-time enrollment step. A setting changed later could affect whether a loss qualifies.

These controls are intended to make unauthorized access and transfers harder, while also giving OKX a defined set of conditions to assess after an incident. Passkeys and transaction checks add steps between account access and a completed transfer; device checks look for potential compromises. The tradeoff is practical: customers have to keep track of the required setup across their linked devices, and eligibility depends on those controls being in place when the loss occurs.

“We are so confident in our system that we will voluntarily reimburse you if you are a victim of fraud,” said Andrew Cuomo, a former New York governor who joined OKX’s board in July. He made the comment at a virtual press conference on Tuesday. The statement presents Shield as a sign of confidence in OKX’s security, though the program’s terms leave the exchange discretion over individual claims.

At the same event, OKX Head of Risk Xiancheng Han described the exchange’s layered asset protections and its approach to vendor governance. He was responding to questions from Unchained about security measures beyond Shield. Those broader practices may matter to customers assessing how the exchange manages risk, but Shield’s own reimbursement promise is governed by the program’s specific conditions. OKX first made the program available to European customers in September.

Claims face limits and individual review

The program terms describe Shield as a “voluntary, discretionary goodwill initiative,” not insurance. Customers can receive no more than one approved claim in their lifetime across OKX entities, and must file within 72 hours of the last unauthorized transfer. That short deadline puts a burden on customers to identify suspicious activity quickly and begin the claim process promptly.

Approved payments are made in stablecoins. The terms exclude transfers a customer authorized, even if deception led them to approve the transaction. Trading losses and funds held in OKX Wallet or on external platforms are also outside the program. OKX evaluates claims individually and retains discretion over whether to pay. In other words, a qualifying-looking incident doesn’t by itself establish that a customer will receive money.

This is more significant than it looks: the distinction between an unauthorized transfer and one a customer was tricked into approving can decide whether the program applies. Fraud often involves pressure or deception, but Shield’s stated exclusions put customer-authorized transfers beyond its coverage. Customers will need to understand that boundary before treating the program as a backstop for every kind of scam.

That leaves customers with a defined but narrow form of recourse: the reimbursement ceiling depends on VIP status, and eligibility hinges on both the cause of the loss and the security settings in place. OKX’s European launch came before this U.S. expansion. If you're working in this space, the operational details matter as much as the cap: required controls, the 72-hour filing window and the one-claim lifetime limit shape what customers can actually expect.

What the expansion signals

Shield gives OKX a way to pair a security message with a conditional reimbursement offer. That may reassure some customers, but the program’s discretionary terms limit how far that reassurance can go. The useful question isn’t only how much a user might receive; it’s whether the incident fits the narrow category the program covers, and whether every required setting was active at the time.

And yet. A reimbursement offer can still draw attention to the work customers must do themselves. Passkeys, transaction verification and withdrawal restrictions can reduce exposure to certain account attacks, but they also require customers to maintain settings and monitor their devices. The program’s practical value will depend on how clearly customers understand those obligations before something goes wrong (and this is the part most people overlook).

OKX returned to the U.S. market in 2025. That February, its operating entity pleaded guilty to operating an unlicensed money-transmitting business and paid more than $504 million. That history sits alongside the launch as context for the company’s U.S. presence, while Shield addresses a separate question: how the exchange says it will handle certain customer losses from account takeovers.

For customers, the offer is a limited form of recourse with concrete conditions attached. The stated caps may stand out, but the exclusions, eligibility rules and claim review will determine whether they translate into a payment. A promise with conditions.

Related Listen: How Did Hackers Take $388M From Bitget Without a User Withdrawal?