A user reported that their MEXC account had 322,110 USDT and 9,133,999 ONE withdrawn on September 27, totaling approximately $340,000. They indicated that on September 25, an attacker used forged materials to change the email and reset security items, briefly gaining control to create an API key.

The platform later confirmed the theft, froze the account, and assisted in recovery. The user changed their password and Google Authenticator as required, but the API was not revoked. About 27 minutes after the 24-hour withdrawal limit was lifted, assets were drained via the API, with no new login records during that time.

The user questioned the review, freezing procedures, and risk control, demanding log preservation, a written response, and asset return. They have filed a formal claim and attempted to report to the police. The help center's guidelines were cited: APIs associated with frozen accounts should become invalid; API withdrawals do not require Google or email verification.

The control window was noted to be approximately 7.5 hours, and the security item reset was approved in about 10 minutes. Withdrawals were made in multiple transactions. Another user reported receiving similar emails about resetting security settings, and the community advised checking the API management page for unfamiliar keys immediately.

Some English reports mentioned that forged documents and facial verification were bypassed, while the platform's public response only stated that a preliminary investigation was completed, a solution was provided, and a dedicated person would follow up, communicating through the registered email without acknowledging the API was not revoked in the public post.

In market mechanisms, what is sold is account recovery services, while what is bought is whether withdrawal permissions have been reset. Funds flowed from the spot balance through residual keys to on-chain addresses; the beneficiary is the party still holding the withdrawal API, while the pressured party is the user who thought the channel was closed after completing the customer service checklist. The incident was driven by residual permissions, not new login sessions.

Source: Public Information