On-Chain Fund Source Risks Behind OKX’s Risk Control Strategy

Recently, the CEO of OKX responded to a user post about a situation where a “gambling platform directly transferred funds to an exchange, causing the deposit to trigger a review.” According to his public statement, deposits to OKX from high-risk addresses may trigger stricter anti-money laundering (AML) and risk reviews. Depending on the specific circumstances, the review may last 15 days or even longer, during which certain account functions and funds may be restricted. For accounts confirmed to be involved in high-risk or illegal activities, the platform may also terminate its services.

OKX also reminded users that funds obtained through channels such as guaranteed transactions in Telegram groups, Huiwang, and its variants may carry a higher risk in terms of their source of funds.

The signal conveyed by this response is clear: exchanges are no longer concerned only with “who the user is,” but also with “where the money comes from and what it has been through.”

For exchanges, payment institutions, OTC brokers, custodians, and other crypto asset service providers, risk identification is moving from the account level to before funds enter the business system. In other words, a user completing KYC does not mean that every fund entering their account is inherently trustworthy; an address not directly matching a blacklist does not mean that it has no risk exposure.

Why Do Gambling Funds Trigger Stricter Reviews?

Gambling platforms are not necessarily synonymous with illicit funds, but the gambling business has long been regarded by anti-money laundering authorities as a high-priority risk area. As early as 2008, FATF published risk-based approach guidance for casinos, explicitly including casinos and online casinos within the scope of relevant risk discussions. FATF’s subsequent research on the casino and gambling industry has also pointed out issues such as its cash-intensive nature, insufficient regulatory coverage, weak management of VIPs and intermediaries, and inadequate risk identification in online gambling.

The United Nations Office on Drugs and Crime (UNODC) has also pointed out that casinos, gambling intermediaries, and cryptocurrencies in East and Southeast Asia have become important components of underground banking, money laundering, and cyber fraud infrastructure. A typical money laundering method is to create a “legitimate appearance” for the source of funds through gambling transactions: illicit funds first enter a gambling account, then a record is created through small bets, internal transfers, or other transaction activities, after which the funds are withdrawn in the form of so-called gambling winnings.

For a user making a deposit, they may think:

“I’m just depositing my own money into an exchange.”

But for the exchange’s risk control system, it needs to further determine:

After all, for exchanges, payment institutions, and other crypto asset service providers that subsequently receive these funds, the risks associated with the upstream source of funds may enter their own business systems as the funds are transferred.

The Challenge: High-Risk Networks Migrate

OKX’s statement this time that “funds obtained through channels such as guaranteed transactions in Telegram groups, Huiwang, and its variants may carry a higher risk in terms of their source of funds” shows that on-chain risk control is not dealing with a static list, but with a fund network that continuously migrates and adapts.

High-risk fund networks do not stop operating simply because a name has been identified. They have a strong ability to migrate and adapt. Once a platform or guaranteed transaction channel is identified and shut down, the operators involved may:

• Change their names;
• Change Telegram groups or other communication channels;
• Change deposit and withdrawal addresses;
• Change the operating entity;
• Move funds to a new platform.

Based on more than eight years of on-chain data mining, threat intelligence accumulation, and security research by the SlowMist security team, MistTrack has identified and labeled dozens of variants related to Huiwang guaranteed transactions, including Potato Guarantee, Seven-Day Guarantee, Fulilai Guarantee, Jinbei Guarantee, New Coin Guarantee, and others. At the same time, MistTrack also covers deposit and withdrawal addresses and fund flows associated with hundreds of gambling and sports betting platforms, including BC.Game, Stake, Rollbit, BetFury, GoFun Entertainment City, and UTown.

How Does MistTrack Help Organizations Identify Source-of-Funds Risks?

In the past, AML/KYT work often started with blacklist screening: checking whether a target address matched sanctions, stolen funds, darknet, mixers, or other known high-risk labels. Such screening remains necessary, but with the rapid development of stablecoins, non-custodial wallets, P2P, OTC, cross-chain bridges, and DEXs, relying solely on a single address or direct transaction relationships has become insufficient to fully explain fund risks.

In actual risk control scenarios, checking only the final deposit address may fail to reveal the original source of risk; tracking only one-hop direct transactions may also make it impossible to identify the propagation of risky funds across multiple intermediate nodes. Conversely, if amount, proportion, and path attenuation are not taken into account, simply classifying an address as high risk because it has previously interacted with risky funds can easily lead to false positives and the wrongful flagging of legitimate users.

Therefore, the actual risk control process needs to answer at least four questions:

1. Does the address itself pose a risk?
2. Is there direct or indirect risk exposure?
3. How did the risky funds flow in?
4. Is the risk still ongoing?

For scenarios such as high-risk fund deposits, P2P transfers, OTC deposits and withdrawals, and cross-chain fund transfers, MistTrack provides a comprehensive set of AML/KYT capabilities covering address screening, risk exposure analysis, fund tracing, and continuous monitoring. Currently, MistTrack’s analytical capabilities cover 19 major blockchains, 100+ tokens, and 18 stablecoins, with more than 500 million entity address labels, 10,000+ entities, and 500,000+ threat intelligence records accumulated across 25 risk types, providing underlying support for on-chain risk identification and fund analysis.

1. Risk Screening: Extending from Address Labels to Entities and Behaviors

MistTrack assesses wallet risks based on data such as the entity associated with an address, historical transaction behavior, and SlowMist threat intelligence. It currently covers various risk types, including sanctions, illicit assets, terrorist financing, mixing services, high-risk exchanges, darknet, illicit services or platforms, and gambling.

The value of this type of analysis lies not only in determining whether an address “matches a certain label,” but also in combining the address’s entity attribution, transaction activity, and threat intelligence to provide a more complete risk context for subsequent manual review.

2. Direct and Indirect Risk Analysis: Distinguishing Actual Exposure

For addresses associated with high-risk entities, MistTrack can further distinguish between Direct and Indirect risk exposure and, by considering factors such as risk hops, associated amounts, and proportions, help risk control teams assess the actual level of risk.

In multi-hop fund analysis, MistTrack supports a risk assessment mechanism based on Pro-Rata Haircut, measuring the risk impact along different paths based on the amount and contribution ratio of associated funds. According to business strategies, users can also choose different risk attenuation modes, such as reducing the risk contribution with each additional hop, or using a non-attenuation mode for stricter analysis.

The core of this mechanism is not simply to expand the scope of risk propagation, but to enable risk control teams to answer a more operationally valuable question: How significant is the actual impact of risky funds on the current address?

3. Fund Flow Tracing: Explaining Where the Risk Comes From and Where It Goes

Through transaction graph and fund flow analysis, risk control teams can see where risky funds entered from, which addresses they passed through, and where they ultimately flowed. For key risk paths, the system can display associated addresses, propagation levels, associated amounts, and risk entities, while highlighting relevant paths in the graph to help investigators trace the results back to supporting evidence.

This capability is particularly applicable to scenarios such as gambling funds, suspected underground banking, OTC settlement, cross-chain transfers, and P2P transactions involving non-custodial wallets. It transforms “why this address was classified as high risk” into fund relationships that can be reviewed, explained, and documented.

4. Continuous Transaction Monitoring: Preventing Risk Assessments from Remaining Fixed at a Single Point in Time

The risk of an address does not remain permanently unchanged after a single query. An address may show no obvious risk today but could subsequently develop new high-risk transaction relationships; a seemingly low-risk wallet may also change its risk status by continuously receiving funds from high-risk networks.

MistTrack supports address monitoring and risk transaction alerts. When a monitored address conducts a risk transaction that meets specified conditions, the system can promptly alert the risk control team for further investigation and handling. For exchanges, payment institutions, OTC firms, and custodial service providers, this means that risk control can move from post-event investigation to continuous identification during the transaction process.

Only by Moving Risk Identification Upstream Can Business Exposure Be Truly Reduced

It is not just about having risk assessments, but also about ensuring that risk assessments can be translated into effective risk mitigation measures. For virtual asset businesses, the next stage of competitiveness is no longer simply whether KYT has been deployed, but whether they can answer the following questions in real business scenarios:

• Where do the funds come from?
• Which entities and addresses have the funds passed through?
• Is the risk directly associated, or is it indirectly exposed through a multi-hop path?
• What is the amount and proportion of risky funds in the current transaction?
• Is the risk still ongoing, and does it require enhanced due diligence, manual review, transaction restrictions, or further reporting?

Based on eight years of accumulated experience in on-chain security and threat intelligence, MistTrack has served more than 500 institutional clients, including cryptocurrency exchanges, crypto funds, DeFi platforms, cross-chain bridges, and cross-border payment platforms. It has also received the Gold Award in the FinTech (RegTech: Regulatory and Risk Management) category at the Hong Kong ICT Awards (HKICT Awards).

If you are looking into how to apply on-chain risk identification capabilities to your business scenarios, please feel free to contact us for further information.

Website: https://misttrack.io/
Email: support@misttrack.io
Form: https://kyt.slowmist.com/cn/get-started.html

About SlowMist

SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.

SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.