By Jonathan Brockmeier, Global Chief Compliance Officer, OKX & Sandra Ro, CEO, Global Blockchain Business Council

The Coldcard exploit has pushed customers to reconsider how and where they hold digital assets. The firmware flaw had drained more than $115 million in bitcoin across thousands of addresses as of August 16, with new waves still surfacing. Exchanges have since seen record inflows as customers weigh the burden of self-custody against the risk of getting it wrong alone. It’s a reminder of how fast confidence shifts when protection fails, and how much is now at stake for any firm holding customer assets.

That is why customer protection is becoming the industry’s defining priority. The cost of getting protection wrong is measured not just in funds lost to a single scam, but in the customers and credibility a firm never wins back.

The uncomfortable part is that rulemaking can’t keep pace on its own, and criminals iterate faster than any regulator can legislate. While regulations set the floor and provide accountability, the firms doing the most to protect customers are building beyond those baseline requirements. That evolution — from compliance as a response to compliance as a proactive function — is a sign of an industry becoming more mature.

Numbers make the abstraction concrete: in the first half of 2026, OKX protected $1.1 billion in assets for more than half a million users, while preventing $26.3 million in scam-related losses. These are moments in which a real account was about to be drained and wasn’t. Together, they show why customer protection belongs alongside risk assessment and verification as a core and daily compliance function, not an occasional intervention.

Beyond the Rulebook

Stopping theft means solving two different problems. The first is keeping bad actors out of accounts that aren’t theirs. The starting principle: security can’t rest on one password, device, or verification step. If a credential is compromised, other checks should still stop an attacker from taking control or moving funds. In practice, that means layered authentication — for example, biometrics and hardware-backed passkeys — along with a requirement for fresh verification before sensitive actions, such as withdrawals or address changes, even mid-session. This prevents an already-open session from being used to bypass security controls. Friction should scale with risk: routine activity flows through, while a high-risk request can trigger a freeze or a live check.

The second problem, socially engineered scams, is harder because the customer is the one giving the instruction. In most of these schemes, the victim authorizes the transfer themselves, fully convinced it’s legitimate. To the system, that first looks like an ordinary payment. Blocklists of known-bad addresses help, but they never catch the wallet spun up an hour before the theft. What works better is tracing the relationships between wallets: graph-based analysis, paired with intelligence from partners like Chainalysis and Elliptic, that surfaces coordinated activity invisible when you look at one address alone. When risk is high, the intervention that matters most is often the simplest: a deliberate pause. Scammers run on manufactured urgency, and a cooling-off period gives a pressured customer the one thing the scammer is trying to deny them: time to reconsider.

This works because compliance, engineering, security, and support are pointed at the same outcome rather than assembled as features bolted on after the fact. That coordination is also what lets the system keep learning: confirmed scam cases and customer reports feed back into detection models, so each attempt that succeeds today makes the next one easier to catch.

Leading, Not Waiting

The point reaches past any single platform. Across the industry, the firms earning durable trust are distinguished less by their technology than by their posture: they treat customer protection as something they own, not something they wait to be told to do. The tools bad actors use will keep evolving; the deepfake calls that work today will look primitive in two years. Protections have to hold and innovation in fraud prevention needs to continue.

This should be the standard the industry works to make ordinary rather than exceptional, by continuously interacting with regulators around the world to raise the bar and build truly resilient systems. The return compounds past any single firm: every customer protected is a customer who stays and tells a different story, and an industry’s reputation is only the sum of those stories. Regulation will make sure everyone plays by the same rules. The firms that define the next decade will be the ones already building above them.