MEXC account hacked: How did a user lose $340,000?

MEXC 回应账户被盗争议：称已与用户达成和解，但 API 密钥失效逻辑存疑

MEXC 宣布已解决一起涉及用户的纠纷。该用户报告称，在账户被接管后，攻击者保留了 API 访问权限，导致其损失约 34 万美元。MEXC 表示已与受影响用户达成协议，并认为此事已完全解决。

然而，用户指出，在账户恢复程序完成后，有 322,110 USDT 和 913 万 ONE 代币被提走。根据 MEXC 的文档规定，冻结账户会使关联的 API 密钥失效，这引发了外界对此次事件中 API 状态及资金流出机制的质疑。

事件经过与关键时间点

据报道，第一笔提币操作发生在 9 月 27 日，距离 24 小时安全锁定解除仅过去 27 分钟。截至目前，MEXC 尚未公开披露和解条款，也未确认用户是否获得了赔偿。

受影响用户 Shuang Fei 表示，北京时间 9 月 27 日 04:12 至 04:25 期间，其账户内的 322,110 USDT 和 9,133,999 ONE 被提走。随后，MEXC 客服联系用户并表示“已成功达成协议”，将此事描述为“完全解决”，但出于隐私保护原因，未透露具体细节。

黑客入侵与账户恢复过程

According to user Shuang Fei, the MEXC account breach began in the early morning of September 25. At that time, he received an email claiming that someone had requested to change the mailbox bound to his account and remove Google Authenticator.

Users stated that the request arrived at 03:10 Beijing time and was approved 10 minutes later. Shuang Fei emphasized that the application was unauthorized and that the ID photo and verification video submitted were not authentic materials provided by the account holder. According to screenshots shared by users, MEXC initially believed that the materials met the requirements, but detected the risk during subsequent reviews, and immediately froze the account and restored the original email address.

MEXC's current security reset documentation states that users may need to provide account information, identification documents, and video of their handheld ID when resetting security verification. Once the attacker took control of the account, Shuang Fei said the password was reset and a new Google Authenticator was bound. The login history provided by the user shows that the login IP address is located in Jakarta, Indonesia.

According to user account records, the API key was created at 05:05:42. Shuang Fei said that MEXC disclosed the existence of the API only after the funds had been transferred out.

API validity dispute during account freeze

Users stated that MEXC froze the account at approximately 10:55 on September 25. The next day, Shuang Fei regained control of the account by removing the attacker's Google Authenticator, changing the password, and binding to a new Authenticator. The final modification was completed at 03:45:07 on September 26.

MEXC 的文档确认，在某些安全变更（如修改绑定邮箱或 Google 身份验证器）后，加密货币和法币提币将被阻止 24 小时。另一份指南指出，冻结账户会禁用交易和登录功能，并使“所有关联的 API 密钥”失效。

用户对此提出疑问：如果该 API 在账户冻结期间已失效，它是如何被再次使用的？Shuang Fei 问道：“这个 API 当时失效了吗？”他还质疑在账户恢复后，该 API 是否重新激活。MEXC 尚未公开回答这些技术问题。

资金迅速流失与安全漏洞

9 月 27 日 04:12:45，即用户 24 小时提币限制结束后的约 27 分钟，第一笔报出的转出交易移动了 1 USDT。据 Shuang Fei 称，随后在约 13 分钟内又发生了五笔提币，最终转走了 322,110 USDT 和 9,133,999 ONE，用户估值约为 34 万美元。

用户声称，在这些提币过程中，账户登录历史中没有出现新的登录活动。安全监控机构 CertiK 随后报道了该事件，包括攻击者创建的 API 保持可用并与提币相关联的指控，但未独立证实攻击方法。Lookonchain 也报道了相关声明，并指出在提币期间账户没有新的登录活动。

MEXC API 政策背景

MEXC's API withdrawal policy provides further background for users 'questions. In an announcement in 2023, the exchange stated that it would not enable the API withdrawal whitelist by default. Unless the whitelist is activated, it will allow withdrawal of coins to any address. The exchange recommends that API users enable whitelists for coin withdrawals and avoid leaking API keys.

Current withdrawal documents state that normal withdrawals may require verification by email, mobile phone or Google Authenticator, while separate security settings can allow withdrawals without repeated two-factor authentication under certain conditions.

Shuang Fei said that the API created by the attacker was not displayed in the history of security operations visible to the user, and no notification was received because the account mailbox had been changed when the API was created. Users asked MEXC to disclose the IP address used to create the API, its permissions, whether the API expired during the account freeze, and which channel initiated the six withdrawals.

Past Disputes and Current Responses

This incident follows an early review of MEXC account controls. In 2025, MEXC returned the funds in a $3.15 million dispute involving trader The White Whale. Since then, MEXC has promoted several user protection measures, including a $500 million Guardian Fund expansion plan planned to be announced in May 2026.

MEXC's public response to the current case is still limited. The customer service stated that the dispute had been resolved and no further details would be disclosed due to user privacy reasons.