An OKX custody setup for long-term holders using allowlists and sub-accounts
If you buy and hold rather than trade daily, speed is rarely important to you. That gives you an advantage: you can switch on controls that a day trader might find annoying, and in exchange make life much harder for anyone who gets into your account. This guide reviews the custody features OKX offers that suit a patient holder, and how to arrange them so that a stolen password or a hijacked session cannot simply move your balance away. The exact options available to your account are described in the official help centre, so check them there as you go.
Separate holdings from everything else
Put the long-term holding in its own sub-account or keep it apart from any balance used for trading, bots or experiments. No API key should touch the holding account. When you need to trade, transfer only the amount required to the trading side. This separation means a mistake or compromise on the trading side is limited to what you placed there, and your main holding stays untouched until you deliberately move it.
Turn on the withdrawal allowlist
An allowlist restricts withdrawals to addresses you have already approved. For a long-term holder, this list might contain only one or two personal wallets. Add them carefully, copying each address from the wallet itself, and label them clearly. Where a waiting period applies to new addresses, keep it enabled. A delay of that kind is a minor inconvenience for you and a serious obstacle for someone trying to add their own address quickly.
Limit where the account can be used from
Review the list of trusted devices and remove every phone or computer you no longer use. Keep sign-in to a small number of devices that only you control. Use an authenticator app or a passkey for sign-in and withdrawals instead of SMS. Make sure security alerts go to an email you read every day, and set an anti-phishing code so genuine messages are easy to recognise.
Schedule a quarterly custody review
Every three months, open the security settings and confirm the allowlist still contains only your own addresses, the device list is short, and no API keys exist on the holding side. Check the login history for anything unusual. Write the date of the review in your notes. This short routine keeps the controls meaningful, because settings that are never checked slowly drift away from what you intended.
Risk boundary: OKX Independent Review
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Keep the long-term holding in its own sub-account with no API keys attached at all.
- Restrict withdrawals to an allowlist containing only your own verified personal wallets.
- Remove unused phones and computers from the trusted device list on the account.
- Repeat the custody review every three months and record the date in your notes.