MEXC Claims to Have Investigated User API Theft Withdrawal Incident

MEXC stated that it has completed a preliminary investigation into the allegations of approximately $340,000 in user assets being stolen and has proposed a plan, establishing a special team to follow up on accounts and subsequent handling, with future communications to be conducted one-on-one via registered email.

Users reported that on September 25, attackers used forged materials to reset security items in about 10 minutes, changing the email, unlinking Google verification, and controlling the account for about 7.5 hours, during which they changed the password, bound a new authenticator, and created an API. After a review, the platform froze the account, reverted the email, and assisted in restoring login, but did not revoke the API.

After changing the password and binding a new authenticator as required, users entered a 24-hour withdrawal restriction. About 27 minutes after the restriction was lifted on September 27, the account was used to withdraw 322,110 USDT and 9,133,999 ONE, totaling approximately $340,000, completed in multiple transactions, with no new login records during this period. Users pointed out that the help center stated that the API should become invalid after freezing the account, and that API withdrawals do not require Google or email verification.

The affected party has formally filed a claim and attempted to report to the police, requesting the preservation of logs, a written explanation of the freezing process, and the return of assets, while reminding others to check their API management pages. Other users reported receiving similar emails about "resetting security settings." Some reports mentioned that forged materials and facial verification were bypassed, but the platform responded that it had not confirmed the technical paths one by one.

The community noted gaps in the recovery process: passwords and two-factor authentication were reset, while the withdrawal permission key remained in the hands of the attackers, allowing for automatic withdrawals once the cooling period ended.

In market mechanisms, what is sold is customer service recovery and frozen accounts, while what is bought is the complete recovery of permissions. Funds flowed from user accounts through residual APIs to the blockchain; the beneficiaries are those who still hold the withdrawal permission keys, while the pressured party is the users who believed that changing the password would cut off all access. The incident was driven by residual permissions after account takeover, rather than a breach of the hot wallet.

Source: Public Information