According to reports from BlockBeats, MEXC has resolved a dispute involving a user who reported losing approximately $340,000 after an attacker allegedly retained API access following an account takeover. The exchange confirmed it reached agreement with the affected user and described the matter as fully resolved, though it has not publicly disclosed the settlement terms or confirmed whether the user received reimbursement. The user, identified as Shuang Fei, reported that 322,110 USDT and 9.13 million ONE were withdrawn from the account between 04:12 and 04:25 Beijing time on September 27.
As reported by BlockBeats, the incident began on September 25 when Shuang Fei received an unauthorized email at 03:10 Beijing time requesting changes to the account's linked email and removal of Google Authenticator. The request was approved 10 minutes later, with the user claiming the identification photograph and verification video submitted were not genuine materials. MEXC later detected risk and froze the account, restoring the original email address. The user regained control by removing the attacker's Google Authenticator and linking a new one at 03:45:07 on September 26.
According to BlockBeats, the user has raised technical questions about the reported API access. Shuang Fei questioned how the reported API could remain usable after the account freeze, asking 'Did this API become invalid at that time?' and whether it became active again after account restoration. MEXC documentation states that freezing an account disables trading and login functions and makes 'all API keys associated with your account' invalid. The user also asked for disclosure of the IP address used to create the API, its permissions, and which channel initiated the six withdrawals.
As reported by BlockBeats, the first reported outgoing transaction moved 1 USDT at 04:12:45 on September 27, approximately 27 minutes after the user's 24-hour withdrawal restriction ended. Five additional withdrawals followed within roughly 13 minutes, with the total transfers removing the reported $340,000 worth of cryptocurrency. No fresh login appeared in the account's login history during these withdrawals, according to the user's claims. Security monitoring service CertiK and Lookonchain reported the incident, with CertiK noting the allegation that an attacker-created API remained available.
According to BlockBeats, MEXC's API withdrawal policy provides context for the user's questions. In a 2023 announcement, the exchange stated that withdrawal whitelists would not be enabled by default for API withdrawals, allowing withdrawals to any address unless a whitelist was activated. The exchange advised API users to enable withdrawal whitelists and avoid disclosing API keys. Current documentation states that normal withdrawals may require verification, while separate security settings can permit withdrawals under specified conditions without repeated two-factor authentication.
