What can we learn from the DEXX incident?

The DEXX platform recently faced a significant asset theft crisis, exposing vulnerabilities in its centralized asset custody model. Unlike traditional exchanges, DEXX allowed users to create addresses but lacked robust security measures like cold/hot wallet isolation, leading to widespread asset losses. This incident highlights key differences between custodial (platform-controlled) and self-custodial (user-controlled) wallets, emphasizing the risks of centralized management. Users are advised to balance convenience with security, avoid blindly trusting third-party tools, and educate themselves on Web3 fraud prevention. The event underscores the need for vigilance in blockchain-based asset management. For detailed safety tips, refer to Bitrace's anti-fraud guide: https://bitrace.io/en/blog.

Key takeaways:

Custodial vs. self-custodial wallets: Custodial wallets (e.g., CEX) rely on platform security, while self-custodial wallets grant users full control via private keys.
DEXX’s critical flaw: Centralized architecture without pooled fund security measures enabled single-point failures.
Risk mitigation: Limit custodial service usage, manage permissions carefully, and stay informed about fraud tactics.

The incident serves as a reminder to prioritize asset security over convenience in decentralized finance.

Recently, the DEXX platform has encountered a serious asset theft crisis. As a multi-chain on-chain comprehensive trading tool, DEXX supports functions such as quick trading, anti-MEV, and strategic trading. Under the outbreak of memecoin market, it has provided hundreds of thousands of users with an extremely convenient trading experience. However, on November 16, many users found that their account assets were emptied.

The reason is that it adopts a centralized asset custody form similar to that of an exchange, but does not adopt an asset management solution with a corresponding level of security. This architecture exposes almost all users' assets to risks.

This incident not only reveals DEXX’s loopholes in asset management, but also provides us with an opportunity to gain a deeper understanding of the risks of custodial wallets.

The difference between managed and self-hosted accounts

Custodial account : In the traditional financial field, centralized financial institutions have complete control over user assets, and users must apply to institutions to redeem funds. For example, the address assigned to users by centralized exchanges is only used for top-up, and users do not have operation permissions. All transactions, transfers, and withdrawals must be approved by the platform.

This means that the platform's risk control level will greatly affect the security of user assets.

Self-custodial account : A self-custodial account is a solution that uses a decentralized wallet solution, where users have full control over the ownership of their assets. After users generate a mnemonic or private key in a trusted environment, they can transfer assets in the address without anyone's permission.

Whether the user exclusively controls the private key or mnemonic phrase of the address is the key feature that distinguishes custody from self-custody.

The difference between DEXX theft and exchange theft

Exchange account thefts usually fall into two situations: the user's platform custodial account control permissions are exposed, resulting in illegal transfer of assets, or the platform itself is hacked, the assets in the hot wallet are directly transferred out, or even the private key and mnemonic phrase of the cold wallet are stolen.

DEXX adopts a similar centralized account architecture, allowing users to create addresses on the platform and share address operation permissions with users. However, unlike CEX, the former does not pool users’ escrow funds into several centralized addresses for security management - such as cold and hot wallet isolation, multi-signature management, etc., which also creates conditions for the occurrence of single point failures.

How should users avoid custody risks?

Security and convenience trade-off: Although traditional on-chain transactions are cumbersome, bypassing these steps in pursuit of trading opportunities will increase risk. Therefore, it is recommended that users adopt custodial services appropriately based on a full understanding of the risks and limit risk exposure to an acceptable range.
Don’t trust blindly: Don’t easily give your address permissions to others or tools. In daily use, you should manage your permissions and avoid using suspicious applications or clicking on unknown links.
Learn Web3 anti-fraud knowledge: Understanding common fraud methods can help investors avoid most potential risks. Bitrace has compiled a Web3 anti-fraud manual to help ordinary investors improve their security awareness. You can visit this link to get it: https://bitrace.io/en/blog

Conclusion

The DEXX incident shows that while enjoying the convenience brought by blockchain technology, one must always remain vigilant. By understanding the risks of custodial wallets and taking corresponding preventive measures, investors will be able to better protect their digital assets.