MEXC Resolves $340,000 Dispute After User Account Breach

The incident began on September 25 when the user’s account was compromised via an unauthorized security reset, allowing an attacker to change the linked email and bypass two-factor authentication. Although MEXC eventually froze the account and restored control to the owner, the user claims a malicious API key remained active throughout the recovery. When a 24-hour security lock on withdrawals expired on September 27, 322,110 USDT and 9.13 million ONE were siphoned from the account in under 15 minutes.

Questions persist regarding MEXC’s security protocols, specifically why an API key created by the attacker was not invalidated when the account was frozen. MEXC documentation suggests that freezing an account should disable all associated API keys, yet the user noted that no new login activity appeared in the logs during the final theft. The exchange has cited user privacy in its refusal to confirm whether the victim received full reimbursement or to explain how the API remained operational despite the security intervention. This case follows previous scrutiny of the exchange's account controls, including a high-profile dispute involving $3.15 million in frozen funds during 2025.