Guardian

Security

Read

Apple

when

MEXC has said it resolved a dispute involving a user who reported losing roughly $340,000 after an attacker allegedly retained API access following an account takeover.
<div id="cn-block-summary-block_ce0ea81da309e7b57b6318b7bef9ab6b" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">Summary
 </div>
 <div class="cn-block-summary__content">
 <ul>
 <li>MEXC says it reached agreement with the affected user and considers the matter fully resolved.</li>
 <li>The user says 322,110 USDT and 9.13 million ONE were withdrawn after account recovery procedures.</li>
 <li>MEXC documentation says frozen accounts invalidate associated API keys, raising questions about the reported API.</li>
 <li>The reported withdrawals began 27 minutes after a 24-hour security lock expired on September 27.</li>
 <li>MEXC has not publicly disclosed the settlement terms or confirmed whether the user received reimbursement.</li>
 </ul>
 </div>
</div>
Shuang Fei, the affected user, <a href="https://x.com/shuangfei8/status/2104375964918837434?s=20" rel="noopener noreferrer nofollow">said</a> 322,110 USDT and 9,133,999 ONE were withdrawn from the account between 04:12 and 04:25 Beijing time on September 27.
MEXC customer support later <a href="https://x.com/MEXC_CST/status/2104520212439875865?s=20" rel="noopener noreferrer nofollow">said</a> the exchange had contacted the user and “successfully reached an agreement.” It described the matter as “fully resolved,” but did not disclose the terms, citing user privacy.
You might also like: <a href="https://crypto.news/mexc-visa-crypto-card-usdt-cashback-apple-pay-support/" rel="noopener noreferrer nofollow"> MEXC launches Visa crypto card with USDT cashback and Apple Pay support </a>
The exchange has not publicly stated whether the user was reimbursed, whether an API key initiated the withdrawals, or what happened to the reported stolen assets.
<h2 class="wp-block-heading" id="strong-mexc-account-hack-began-with-a-security-reset-strong">MEXC account hack began with a security reset</h2>
The reported incident began early on September 25 when Shuang Fei received an email stating that an application had been made to change the account’s linked email and remove Google Authenticator.
According to the user’s account, the request arrived at 03:10 Beijing time and was approved 10 minutes later. Shuang Fei said the application was unauthorized and claimed the identification photograph and verification video submitted with it were not genuine materials provided by the account holder.
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 大家好，我是MEXC被盗事件的当事人，以下是被盗事件经过 MEXC 确认我的账户被盗、冻结了账户、帮我找回——却漏掉了攻击者留下的 API。24 小时提币限制解除 27 分钟后，34 万美元资产被提空。 1/ 先说结果 2026 年 9 月 27 日 04:12–04:25（北京时间，下同），我的 MEXC 账户被提走 322,110 USDT 和… <a href="https://t.co/e9xL5cAZs8" rel="noopener noreferrer nofollow">pic.twitter.com/e9xL5cAZs8</a>— shuang fei (@shuangfei8) <a href="https://x.com/shuangfei8/status/2104375964918837434?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 28, 2026</a>
 </blockquote>
 </div>
</figure>
MEXC later told the user that the materials had initially met its requirements, according to screenshots shared in the thread. During a subsequent review, the exchange detected risk, froze the account and restored the original email address, the user said.
MEXC’s current security reset documentation <a href="https://www.mexc.com/support/account" rel="noopener noreferrer nofollow">states</a> that users may be asked to provide account information, identity documents and a video holding their identification when resetting security verification.
Once the attacker controlled the account, Shuang Fei said the password was reset and a new Google Authenticator was linked. Login records shared by the user showed access from an IP address associated with Jakarta, Indonesia.
At 05:05:42, an API was created, according to the user’s account. Shuang Fei said MEXC only disclosed the existence of that API after the funds had already left the account.
<h2 class="wp-block-heading" id="strong-account-recovery-did-not-address-the-reported-api-strong">Account recovery did not address the reported API</h2>
MEXC froze the account at approximately 10:55 on September 25 after its review detected suspicious activity, the user said.
Shuang Fei regained control over the following day by removing the attacker’s Google Authenticator, changing the password and linking a new authenticator. The final change was completed at 03:45:07 on September 26.
MEXC documentation <a href="https://www.mexc.com/en-GB/learn/article/mexc-account-frozen-withdrawal-limits-how-to-fix-restricted-account-issues/1" rel="noopener noreferrer nofollow">confirms</a> that cryptocurrency and fiat withdrawals are blocked for 24 hours after certain security changes, including modifications to a linked email or Google Authenticator.
A separate MEXC account guide <a href="https://www.mexc.co/learn/article/mexc-account-problems-solved-login-issues-kyc-withdrawal-support-guide/1" rel="noopener noreferrer nofollow">states</a> that freezing an account disables trading and login functions and makes “all API keys associated with your account” invalid.
The user has questioned how the reported API could later have been used if it had become invalid during the account freeze.
“Did this API become invalid at that time?” Shuang Fei asked. The user separately questioned whether it became active again after the account was restored.
MEXC has not publicly answered those technical questions.
<h2 class="wp-block-heading" id="strong-340k-left-shortly-after-the-withdrawal-lock-expired-strong">$340K left shortly after the withdrawal lock expired</h2>
At 04:12:45 on September 27, roughly 27 minutes after the user’s 24-hour withdrawal restriction ended, the first reported outgoing transaction moved 1 USDT.
Five more withdrawals followed within roughly 13 minutes, according to Shuang Fei. The transfers eventually removed 322,110 USDT and 9,133,999 ONE, which the user valued at approximately $340,000.
No fresh login appeared in the account’s login history during those withdrawals, the user claimed.
Security monitoring service CertiK subsequently <a href="https://skynet.certik.com/pulse" rel="noopener noreferrer nofollow">reported</a> the user’s account of the incident, including the allegation that an attacker-created API remained available and was connected to the withdrawals. CertiK did not independently establish the attack method in its brief notice.
Lookonchain likewise <a href="https://lookonchain.com/feeds/74487" rel="noopener noreferrer nofollow">reported</a> the claims and noted that the account showed no new login activity during the withdrawal period.
MEXC completed an initial investigation and offered what it called corresponding solutions, according to an earlier public response reported by BlockBeats. The exchange later said an agreement had been reached with the user.
<h2 class="wp-block-heading" id="strong-mexc-api-rules-allowed-withdrawals-without-a-default-whitelist-strong">MEXC API rules allowed withdrawals without a default whitelist</h2>
MEXC’s API withdrawal policy provides further context for the user’s questions. In a 2023 announcement, the exchange <a href="https://www.mexc.com/announcements/article/mexc-withdrawal-feature-optimization-17327472571161" rel="noopener noreferrer nofollow">said</a> withdrawal whitelists would not be enabled by default for API withdrawals, allowing withdrawals to any address unless a whitelist was activated.
The exchange advised API users to enable withdrawal whitelists and avoid disclosing API keys.
Current withdrawal documentation <a href="https://www.mexc.com/support/article/how-to-set-withdrawal-settings-253549374230474752" rel="noopener noreferrer nofollow">states</a> that normal withdrawals may require email, mobile or Google Authenticator verification, while separate security settings can permit withdrawals under specified conditions without repeated two-factor authentication.
Shuang Fei said the attacker-created API was not visible in the security-operation history available to the user and claimed no notification was received because the account email had already been changed when the API was created.
The user asked MEXC to disclose the IP address used to create the API, its permissions, whether it became invalid while the account was frozen, and which channel initiated the six withdrawals.
The episode follows earlier scrutiny of MEXC’s account controls. In 2025, the exchange returned funds after a separate <a href="https://crypto.news/the-white-whale-steps-in-to-help-mexc-revamp-business/" rel="noopener noreferrer nofollow">MEXC $3.15 million frozen-funds dispute</a> involving trader The White Whale.
MEXC has since promoted several user-protection measures, including a planned <a href="https://crypto.news/mexc-commits-to-500m-guardian-fund-expansion-acquires-1000-btc-to-strengthen-user-protection/" rel="noopener noreferrer nofollow">$500 million Guardian Fund expansion</a> announced in May 2026.
For the current case, MEXC’s public response remains limited. Customer support said the dispute has been resolved and that further details will not be disclosed because of user privacy.
Read more: <a href="https://crypto.news/the-uks-crypto-licensing-window-opens-wednesday-the-hard-part-starts-now/" rel="noopener noreferrer nofollow"> The UK’s crypto licensing window opens Wednesday. The hard part starts now </a>

MEXC account hack: How did a user lose $340K?

Table of Contents

crypto.news

Other articles published on Sep 28, 2026

Join our free newsletter for daily crypto updates!