X user claims MEXC account was hacked, losing approximately $340,000, and questions why the platform did not revoke the attacker's API, resulting in assets being drained.
BlockBeats news, September 28: X user @shuangfei8 posted that their MEXC account was hacked, resulting in a loss of approximately $340,000. In the early hours of September 25, the attacker successfully applied to reset security settings (change linked email, unbind Google Authenticator) using forged documents, which were approved within 10 minutes. They then controlled the account for about 7.5 hours, during which they reset the password, bound Google Authenticator, and created an API. After a review by MEXC identified the risk, the account was frozen and the email was changed back to the original, but the API was not revoked. After the individual changed the password and re-bound Google Authenticator as required, a 24-hour withdrawal restriction was imposed. On September 27, from 04:12 to 04:25 (Beijing time), just about 27 minutes after the restriction was lifted, 322,110 USDT and 9,133,999 ONE were withdrawn from the account, totaling approximately $340,000, with no new login records during the withdrawal period.
The individual stated that MEXC's help center specifies that associated APIs should be invalidated after an account is frozen, but this did not take effect in practice; API withdrawals do not require Google or email verification. They have formally filed a claim with MEXC and attempted to report to the police, demanding that the platform preserve logs, provide written answers to relevant questions, and return the assets, while also reminding other users to check the API management page for any abnormal keys.
In response, MEXC officially replied: A preliminary investigation has been completed and corresponding solutions provided. To better protect the account and personal information, follow-up will be conducted via one-on-one email communication, with updates on the handling progress and required information. Users are advised to monitor their registered email and official channel emails.
