An X user says their MEXC account was hacked, losing approximately $340,000, and is questioning the crypto exchange for failing to revoke the attacker’s API access, which resulted in all their assets being drained.

X user @shuangfei8 reported that their MEXC account was hacked, resulting in losses of approximately $340,000. On the early morning of September 25, attackers forged identity documents to successfully apply for resetting security settings—including changing the bound email and unlinking Google Authenticator—with the request approved in just 10 minutes. The attackers controlled the account for around 7.5 hours, during which they reset the password, linked Google Authenticator, and created an API. After MEXC’s review flagged the risk, the exchange froze the account and reverted the email to its original address, but failed to revoke the newly created API. Following the user’s required password change and Google Authenticator re-link, a 24-hour withdrawal limit was imposed. Between 04:12 and 04:25 Beijing time on September 27, roughly 27 minutes after the limit was lifted, 322,110 USDT and 9,133,999 ONE—totaling about $340,000—were withdrawn from the account, with no new login activity during the withdrawal process. The user noted that MEXC’s help center states linked APIs should be invalidated after account freezing, a measure that did not take effect in this case; additionally, API withdrawals do not require Google or email verification. They have filed a formal claim with MEXC and attempted to report the incident to police, demanding the platform preserve logs, provide written responses to relevant questions, and return their assets. The user also urged other users to check for abnormal keys on their API management pages. In response, MEXC officials stated they have completed an initial investigation and provided corresponding solutions. To better protect accounts and personal information, the exchange will conduct one-on-one communications via email moving forward, sharing processing updates and required information. Users are advised to monitor their registered email and official channel communications.