MEXC User Alleges $340,000 Loss After Attacker API Was Not Revoked
The user says 322,110 USDT and 9,133,999 ONE were withdrawn 27 minutes after a 24-hour withdrawal restriction ended.
A MEXC user alleges an attacker withdrew about $340,000 in digital assets through an API key that remained active after the exchange helped restore access to the account.
The user said 322,110 Tether (USDT) and 9,133,999 Harmony (ONE) were taken Sept. 27. The user said the attacker had gained temporary control two days earlier by using forged materials to change the account’s email address, reset security settings and create an API key.
MEXC later confirmed the theft, froze the account and assisted with restoring access, according to the user. The user said they changed the password and Google Authenticator credentials as requested, but the attacker-created API key was not revoked.
The assets were withdrawn through the API about 27 minutes after a 24-hour withdrawal restriction expired, the user said. No new login record appeared during the period, according to the user’s account.
The user has requested that MEXC preserve logs, provide written answers about the account review and freeze process, and return the assets. The user also said a formal claim was submitted and that they had attempted to report the incident to police.
