OANDA Japan Accelerates MT4 Retirement, Citing Security Breaches and Legacy Vulnerabilities

The decision comes after unauthorized access involving Onamae.com Desktop Cloud, a virtual private server (VPS) operated by GMO Internet Group. This incident exposed up to 26,739 servers used by retail traders across multiple brokerages, including OANDA.

In response to the breach, OANDA issued urgent security alerts, implemented transaction restrictions on affected accounts, and advised clients to change passwords and enable two-factor authentication.

The broker had originally announced MT4 retirement in March but has now moved the termination date forward by two weeks due to mounting cyber risks within external VPS environments.

Platform Security Concerns

OANDA explicitly stated in its client notice that it has become increasingly difficult to meet current security requirements on MT4. The platform's age and the cessation of official support and system maintenance by MetaQuotes were cited as primary concerns.

Migration Process

For customers holding positions on the MT4 Tokyo server, remaining positions and balances will automatically transfer into MT5 Standard Plan accounts between November 14-15.

Customers are required to create an MT5 account in advance, though OANDA will create one if necessary. Balance-only customers must move funds before the shutdown, with a transfer fallback for remaining balances.

NY-server customers can continue trading through fxTrade or TradingView after MT4 access ends. However, OANDA warns that MT4 EAs, indicators, and templates cannot be used on MT5, meaning trading setups won't automatically transfer.

Enhanced Security Measures

OANDA Japan made Google Authenticator OTP-based multi-factor authentication mandatory for MT5 login starting October 31, following the October 29 announcement linked to the hosting-service incident.

The broker emphasized that customers using external VPS services must secure those environments themselves, as OANDA's security measures do not extend to third-party servers.

This accelerated retirement reflects broader industry concerns about legacy trading platforms' security vulnerabilities as cyber threats continue to evolve.