26 days after the theft, DEXX founder tells the cause and latest progress

Original title: "Exclusive interview with DEXX founder: We are entirely responsible for the theft, and the entrance to the compensation platform will be launched soon"

Original author: Fu Ruhe, Odaily Planet Daily

On November 16, a major security incident broke out on the trading platform DEXX. Hackers exploited the platform's technical loopholes and stole more than $21 million in user funds, with nearly 1,000 victims. This incident not only caused serious economic losses to users, but also had a profound impact on the industry's trust mechanism, and quickly became a hot topic in the field of Web3 security.

After the incident, the DEXX project party failed to disclose the specific cause of the theft for nearly a month. To make matters worse, the platform founder and users publicly disputed on social media, and the conflict between the two sides continued to escalate.

Recently, Roy, the founder of the DEXX platform, accepted an interview with Odaily Planet Daily for the first time, and gave detailed answers to the causes of the security incident, the compensation plan for the victims, and the future improvement direction of the platform, trying to respond to the various questions of the victims and the market. (Odaily Note: The following reply is only the views of DEXX and does not represent the position of Odaily Planet Daily.)

The following is the transcript of the interview

Odaily Planet Daily: Can you explain the reason for the theft of DEXX this time? Is it related to the platform's private key management solution?

Roy:The main reason for the theft this time is our team's mistakes in security management, not the problem of the private key management solution itself.

We use the mainstream trading and custody solutions in the market, which are consistent with many leading platforms (such as BananaGun, Unibot, etc.). This solution has advantages in terms of transaction speed and limit order experience, but it requires extremely high security management from the team. Our mistakes led to the leakage of private keys, and the responsibility lies entirely with us.

Although users reported that private keys were uniformly stored on the server and lacked encryption, this was a misunderstanding of technical details. In fact, the logic of this solution is to independently generate wallet addresses and is widely used on mainstream platforms in the market. The problem is not the solution itself, but the mistakes made by our team in implementation and management.

Odaily Planet Daily: On social media, many victims believe that the assets were stolen by the DEXX platform. How do you prove your innocence?

Roy: I have explained many times that if we really have improper behavior:

· Security agencies such as SlowMist will not cooperate with us.

· Investment institutions will not continue to connect funds.

· Law enforcement agencies will take action against us directly instead of assisting in hunting down hackers.

In fact, my team and I have no reason to destroy our future for more than 20 million US dollars. During the peak of our business, our daily revenue can reach 300,000 to 400,000 US dollars, and the platform valuation before the incident reached 60 million US dollars.If we really need funds, we can get them in a more reasonable way, such as issuing platform coins or attracting institutional investment.

Odaily Planet Daily: How is the investigation of the stolen case going? What difficulties does the platform encounter in handling the incident?

Roy: The suspect has been locked in the country, but the investigation process is very complicated and involves a lot of time and resource costs. Law enforcement agencies have been involved since the early stages. To ensure the smooth progress of the investigation, we did not disclose details to the public in the early stages of the case, and only released some information on December 6. Early disclosure may affect the progress of law enforcement or "alarm the snake", so information disclosure needs to be cautious.

For our team, the handling of the incident requires not only cooperation with law enforcement agencies, but also high technical and management costs. In addition, due to the complex technical details involved in the case and the interests of investment institutions, we still need to further confirm which information can be made public.

Odaily Planet Daily: DEXX officially announced the compensation plan on December 6, including compensation for investment and financing or compensation for self-employed income, but the victims are not satisfied. What do you think about this issue?

Roy:The original intention of the compensation plan was designed based on the worst case scenario. Although we knew at the time that the worst case scenario was unlikely to happen, in order to give victims a psychological expectation of the most basic protection, we chose to announce the most conservative plan first. The actual implementation of the plan will be adjusted according to the investment of institutional funds.

At present, the docking of institutional funds has been basically negotiated, but it has not yet been finalized. Since details such as the investment amount and institutional valuation have not yet been finalized, we are temporarily unable to disclose it to the public. Disclosure in advance may cause market misunderstandings or affect the cooperation intentions of institutions. Therefore, we hope to wait until the funds are fully implemented before explaining and updating the plan to users through a formal announcement.

Odaily Planet Daily: Victims reported that the project party had repeated in determining the compensation plan. For example, on November 28, it promised to determine the plan within 48 hours, but it was not announced until December 6. How do you explain this?

Roy: First of all, we admit that there is indeed a delay in the release of the plan, but the reason is mainly due to some uncontrollable external factors and the limitations of objective conditions.

In negotiations at the institutional level, the project party is in a weak position. We hope to cooperate with more powerful and reputable institutions to strive for the best interests of users, but this means repeatedly evaluating conditions and delaying the final confirmation of the plan.

In addition, during the hacker hunt, some details involve sensitive information about the cooperation between law enforcement agencies and security companies. Excessive disclosure may cause misunderstandings and even damage the reputation of the parties involved. Therefore, we choose not to announce it to the public for the time being.

Although the decision to delay was made out of prudence, we were unable to communicate the specific reasons to users in a timely manner, which led to misunderstandings, and we are deeply sorry for this.

Odaily Planet Daily: On December 6, DEXX officially announced that it would determine the implementation of the plan within 7 working days. Now that the time is almost up, can the platform confirm the specific compensation plan?

Roy:Our current plan is to first launch a compensation platform entrance within the deadline. The specific process is as follows:

· User confirmation of the amount of loss:The amount of loss counted by the third-party agency may be inaccurate or incomplete, so we need users to verify and confirm whether the amount of loss is correct through the platform entrance. Once the user confirms the amount and clicks "Confirm", the final debt record is formed.

· Compensation according to claims:The confirmed claims records will be used as the basis for compensation. When the institutional funds are in place, we will make compensation as soon as possible according to the user's claim ratio.

· Clarify the debt structure and compensation plan:The "7 working days" we proposed means first confirming whether the debt structure is correct, and then the user checks and agrees on the amount of the claim. After this step is completed, the final claim is determined.

At present, a specific compensation plan has been formulated, but it has not yet been announced to the public due to factors such as institutional funds. The overall process is carried out in stages. After the institutional funds are in place, we will handle the claims compensation matters in echelons. If the user has any questions after confirming the amount, we will also verify and handle it based on the records.

Odaily Planet Daily: The victim mentioned that the platform lost contact in the days before December 6. Why didn't you come forward in time to maintain close communication?

Roy:In fact, there is no so-called "lost contact". The reason why many people feel this way is that we may not respond to their questions within 1 to 2 days, and users therefore think that we no longer respond. In fact, the pressure and uncertainty we faced at the time were very great, but we always worked hard to deal with the problems behind the scenes. It can be divided into three stages to illustrate our main work during this period:

· Tracking hackers:In the first week, we focused on cooperating with security agencies and law enforcement agencies to track the whereabouts of hackers. This was the link with the largest investment and the highest cost in the early stage.

· Security upgrade and compensation plan development:In the second week, we fully upgraded the platform's security measures, and at the same time developed product functions related to compensation to provide users with a compensation entry.

· Institutional docking:By the third week, we shifted our focus to negotiations and communication with institutions. The work at this stage is particularly complex and requires handling a lot of details.

Although our customer service team occasionally replies to messages in the group, due to the large number of affected users and the large number of questions, we cannot reply to every user immediately.

In addition, there are also great restrictions on the release of announcements. Every time we issue an announcement, we need to confirm with 2 to 3 security agencies or law enforcement agencies whether the content can be made public. If some information is disclosed, it will affect the law enforcement agency's tracking of suspects. For example, law enforcement agencies locked on some suspects in the early stage, but after in-depth investigation, they found that the direction was wrong and needed to be confirmed repeatedly. These repeated verifications took up a lot of our time and energy.

Users may not be able to intuitively feel our efforts, but behind the scenes, we have indeed put in a huge amount of work. Whether it is tracking hackers, communicating with institutions, or developing compensation plans, we have been pushing forward. It's just that due to the restrictions of law enforcement agencies and the need to protect the case investigation, we are unable to announce all the progress immediately.

In general, we have not lost contact, but while facing pressure from many aspects, we have worked hard to solve the problem for the victims and push the situation in a positive direction.

Odaily Planet Daily: Just because of this incident, many people's trust in DEXX's security capabilities and brand has dropped precipitously. If, one day in the future, DEXX is online again, how do you think you should gain users' trust and let them use it again?

Roy:The core of user trust is not only security technology, but also the support and guarantee behind the platform. To this end, we plan to start from the following aspects:

· Compensation transparency and fairness: The platform will launch an online verification portal, and users need to confirm the amount of damage to ensure the accuracy of the data. After confirmation, the system will generate a record of claims and pay compensation in stages after the institutional funds are in place. The entire compensation plan will be based on the principle of openness and transparency, and the progress of compensation will be updated in real time.

· Comprehensive security upgrade: Hire a number of top security auditing agencies to conduct in-depth security assessments on the platform. Publicize the upgraded security mechanism and disclose technical details and improvement plans to users. Establish a complete technical support and problem handling system to ensure the stability and security of the platform's operation.

· Rebuild brand credibility: Introduce a number of world-renowned exchanges and financial institutions as endorsements to enhance users' trust in the platform. Through a strong lineup of partners, let users clearly perceive the future security of the platform.

· Optimize user emotion management: Establish an efficient user communication mechanism and respond to feedback in a timely manner. Strengthen public relations capabilities, formulate clear crisis response strategies, and make users feel valued and understood emotionally.

· Strengthen trust: We realize that 99% of users do not understand technology. What they need is not complicated explanations of security technology, but a real sense of trust. Through multi-party endorsements and practical actions, let users believe that the future of the platform is worthy of trust.

Original link