MEXC user: API not revoked after account was hacked, approximately 340,000 USD was transferred away

A MEXC user posted on X that their account was compromised after someone reset the security items. MEXC has confirmed the account was hacked, frozen the account, and assisted in recovery, but did not revoke the API left by the attacker. From 04:12 to 04:25 on September 27, 2026 (Beijing time), the account transferred out 322,110 USDT and 9,133,999 ONE, totaling approximately $340,000, about 27 minutes after the 24-hour transfer limit was lifted.

The user stated that at 03:10 on September 25, they received a reset security item email that was not submitted by them, and about 10 minutes later, the request was approved. Subsequently, the account was logged in from an IP in Jakarta, Indonesia, bound to Google verification, and at 05:05, an API was created, approximately 83 seconds after logging in. At 10:55 that day, MEXC froze the account after a risk review and reverted to the original email. Customer service responded in writing that the review materials met the requirements, so the binding change was approved, and after the risk review, the account was urgently frozen and reverted to the initial email. The user changed their password and Google verification on September 26 but stated that the API was not revoked, and there were no related records in the security operation history.

The user also claimed that there were no new login records in the login history when the assets were transferred out. They have submitted a formal claim to MEXC and attempted to report to the police, with the ticket number M2026092712031, requesting the platform to preserve logs, provide a written explanation of the review and API situation, and return the aforementioned assets. MEXC customer service stated that it is currently unable to confirm whether these transfers were initiated via APP, WEB, or API, and the issue has been forwarded to the relevant department.