How to View OKX Login Logs and Detect Suspicious Activity

The login log is the most direct way to determine whether your account has been accessed by someone else. The path is fixed: Go to "Security Center" and find "Login Logs" or "Device Management", then check the login time, IP location, and device model. If any of these three do not match your activity, it is a suspicious signal.

OKX Exchange
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！

Register Now App Download

1. Access the Login Logs page

What to do: Find the login history entry and get a record of recent account logins.

How to do it:

• Log in to the OKX app or website.

• App: Tap "Profile" → "Security Center" → "Login Logs" or "Device Management".

• Web: Click your avatar in the top right corner → "Security Center", then find "Login Logs" or "Login & Device Management" in the list.

Completion criteria: You have entered the login logs page and can see a list of past login events sorted by time.

Prerequisites: You are already logged into your account.

Common failure causes:

• The entry name may vary slightly across versions. If you cannot find "Login Logs", try "Device Management" or "Security Records" — they usually contain the same data.

The login log details include: login time, IP location (city/country), device model (e.g., "iPhone 15 Pro" or "Chrome/Windows"), and operating system type.

2. Check each login record and identify anomalies

What to do: Compare each record in the list with your actual activity to find logins that do not belong to you.

How to do it: Examine every entry using these three dimensions:

• Login time: Were you using the account at that time? If you were asleep or not actively on the app/site, it is suspicious.

• IP location: Is it in your city or usual region? If the address shows a foreign country while you are at home, your account may have been compromised.

• Device model: Is it a device you normally use? If you use an iPhone and the record shows a different brand, that is a clear red flag.

Completion criteria: You have confirmed that all records belong to you, or you have identified at least one suspicious record that needs action.

Common failure causes:

• Mistaking system login records generated by API trading as anomalies — some quantitative trading or API integrations create separate login sessions. These are usually normal; you can verify by checking the time and the originating IP.

OKX supports viewing an operation log summary for the last 72 hours, including IP location and device information. For a more complete login history, you can expand it further from the "Security Center".

OKX Exchange
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！

Register Now App Download

3. Handle suspicious login records

What to do: Immediately block access after discovering a suspicious login.

How to do it:

• Step 1: Force logout the suspicious device

  • Find the device in "Device Management", tap "Log Out" or "Revoke Authorization". The device will be forcibly disconnected.

• Step 2: Change your login password

  • Go to "Security Settings" immediately and change your password without delay.

• Step 3: Check if security settings have been tampered with

  • Verify that Google Authenticator (2FA) is still bound and has not been replaced.

  • Check "API Management" for any newly created API keys that you did not authorize.

  • Check the "Withdrawal Address Book" for any addresses added by someone else.

• Extreme case: Activate temporary account freeze

  • If you are concerned about your assets, go to "Security Center" → "Account Protection" and click "Temporarily Freeze Account". While frozen, withdrawals, trading, and security setting changes are impossible.

• Contact customer support if you cannot handle it yourself

  • If you cannot log in or verification fails, use the online chat at the bottom right of okx.com. Type "urgent account freeze" to request a manual forced freeze.

Completion criteria: The suspicious device has been removed, the password has been updated, and all security settings have been verified one by one.

Prerequisites: You are still able to log into your account normally, or at least have a way to contact customer support.

Risk warning:

• Login logs are sensitive personal information. If you find an unusual login, first check whether the IP might be from your own VPN or proxy — some VPNs make the login IP appear as an overseas address, creating a "false anomaly".

• If you confirm a compromise, you need to change the password and reset Google Authenticator (2FA). If the hacker has already changed your phone number and email, self-recovery is impossible. You must contact customer support and submit a photo of yourself holding your ID card along with relevant materials for recovery.

Next steps: Go to your OKX "Security Center" now and check the login logs — focus on the last 3 days. Look for any IP locations that are not in your usual city. If you find an anomaly, immediately execute the four-piece emergency kit: force logout the device, change password, check 2FA, and review API keys. After changing the password, withdrawals will be restricted for 24 hours. This is a normal security protection period, do not panic.