Senior Fraud Risk Manager

Who We Are

At OKX, we believe the future will be reshaped by crypto and blockchain technology. We operate a leading global crypto platform and build products and services designed to expand access to the digital-asset ecosystem.

Across our global organization, we value ownership, sound judgment, collaboration, innovation, and the ability to operate effectively in a fast-moving and continuously evolving environment.

Recruiting should insert the current approved OKX corporate “Who We Are” language when the position is posted.

About the Team

The Fraud Investigations Team (FIT) is a First Line of Defense function within OKX’s Risk organization responsible for identifying, assessing, investigating, and helping manage significant internal and external fraud risks affecting the company, its customers, personnel, and operations.

FIT conducts and supports complex investigations involving digital assets, internal and external fraud, employee misconduct, insider threats, unauthorized access or misuse of information, vendor and third-party misconduct, account compromise, social engineering, collusion, conflicts of interest, and other significant fraud-related matters.

The team works closely with Legal, HR, Information Security,Engineering, Physical Security, Compliance, Finance, Operations, and other functions across OKX.

About the Opportunity

We are looking for an experienced Senior Analyst, Blockchain Investigations & Fraud Intelligence to join FIT.

This is first and foremost a blockchain investigations role requiring significant hands-on expertise tracing digital assets across complex blockchain ecosystems. The successful candidate must be capable of independently conducting sophisticated on-chain investigations, developing and testing attribution hypotheses, identifying relationships among wallets and entities, following assets through multiple chains and protocols, and translating highly technical blockchain activity into clear investigative findings.

Blockchain analysis is a specialized investigative discipline. Accordingly, we are seeking someone who understands not only how to operate commercial tracing platforms, but also the underlying blockchain architecture, transactional mechanics, attribution methodologies, clustering techniques, tracing limitations, and evidentiary considerations necessary to reach reliable conclusions.

The role extends beyond on-chain analysis. The Senior Analyst will combine blockchain intelligence with enterprise data, system logs, transactional records, open-source information, and other evidence to support complex fraud and insider-risk investigations.

The position will also provide analytical support to the Global Physical Security Team (PST) on selected protective-intelligence and threat-assessment matters.

The Senior Analyst will directly manage one Analyst and will be expected to serve as a subject-matter resource for blockchain investigations and analytical methodology across FIT.

What You’ll Be Doing

Blockchain Investigations & Digital-Asset Intelligence

Lead and conduct complex blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems.

Trace the origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets , including activity spanning multiple intermediaries and blockchain environments.

Conduct investigations using tools such as Chainalysis Reactor , TRM Labs, Elliptic, or comparable blockchain intelligence platforms , while understanding the methodologies and limitations underlying platform-generated attribution.

Analyze activity involving centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems .

Trace assets across multiple chains and cross-chain transactions , identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible.

Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators.

Understand and appropriately apply wallet-clustering and attribution methodologies , including the limitations and potential for false attribution associated with particular heuristics.

Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution.

Corroborate on-chain findings, where appropriate, with internal account records, KYC / KYB information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence .

Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities.

Reconstruct complex transaction flows and create clear fund-flow diagrams, transaction maps, timelines, and visualizations that allow investigators and nontechnical stakeholders to understand the movement of assets.

Analyze blockchain activity associated with suspected fraud , theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct .

Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads.

Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings.

Distinguish between confirmed attribution , vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis .

Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct.

Maintain current knowledge of emerging blockchain technologies, protocols, tracing methodologies, obfuscation techniques, fraud typologies, and developments affecting blockchain attribution or investigations .

Fraud Investigations & Investigative Intelligence

Conduct and support investigations involving internal and external fraud , employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks .

Combine blockchain findings with off-chain evidence to develop a comprehensive investigative picture rather than treating blockchain activity in isolation .

Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis.

Conduct timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities.

Support investigations involving account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse , particularly where a digital-asset, employee, vendor, or enterprise nexus exists.

Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct.

Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up.

Enterprise Data & Insider-Risk Analytics

Analyze appropriately authorized information including system and access logs, authentication records, audit tr