A MEXC user says attackers drained roughly 340,000 USD from the account just 27 minutes after a 24-hour security lock expired — and the exchange’s own documentation about frozen accounts may hold the key to what went wrong.
By Amir Hassan | September 28, 2026
MEXC says it has resolved the dispute and reached an agreement with the affected user, describing the matter as “fully resolved” without disclosing the terms. For anyone who keeps funds on an exchange, the case is a sobering anatomy lesson in how account recovery, API keys and withdrawal locks interact — and how a single forgotten credential can undo everything a security team gets right.
How the Takeover Began
The incident began early on Sep. 25, when the user — who identified himself as Shuang Fei — received an email saying someone had applied to change the account’s linked email address and remove its Google Authenticator. The request arrived at 03:10 Beijing time and was approved 10 minutes later. The user says the application was unauthorized and that the identification photo and verification video submitted with it were not genuine materials he had provided.
Once the attacker controlled the account, the password was reset and a new Google Authenticator was linked. Login records shared by the user showed access from an IP address associated with Jakarta, Indonesia. At 05:05:42, an API key was created on the account — a detail the user says MEXC only disclosed after the funds had already left.
The Recovery That Missed the API Key
MEXC froze the account at approximately 10:55 on Sep. 25 after its review detected suspicious activity. The user then spent the following day regaining control: he removed the attacker’s Google Authenticator, changed the password and linked a new authenticator, finishing at 03:45:07 on Sep. 26.
Here is where the story turns technical. MEXC’s own account guide states that freezing an account disables trading and login functions and makes “all API keys associated with your account” invalid. The user has publicly asked how the API created during the takeover could later have been used if it had become invalid during the freeze. MEXC has not publicly answered that question.
For non-technical readers: an API key is like a spare house key that software uses to enter your account without logging in through the front door. If the locks are changed but the spare key still works, it does not matter how strong the front door is. Security firms have warned for years that forgotten API keys are among the most common ways recovered accounts get drained a second time.
27 Minutes After the Lock Expired
MEXC documentation confirms that crypto and fiat withdrawals are blocked for 24 hours after certain security changes, including modifications to a linked email or authenticator. That lock expired, and at 04:12:45 on Sep. 27 — roughly 27 minutes later — the first outgoing transaction moved 1 USDT, a common test transaction. Five more withdrawals followed within about 13 minutes, eventually removing 322,110 USDT and 9,133,999 ONE, which the user valued at approximately 340,000 USD.
Notably, the user says no fresh login appeared in the account’s login history during those withdrawals — consistent with the theory that an API key, not a password login, initiated them. Security monitoring service CertiK subsequently reported the user’s account of the incident, amplifying the allegations across social media on Sep. 28.
What MEXC Has and Has Not Said
MEXC customer support said the exchange had contacted the user and “successfully reached an agreement,” describing the matter as fully resolved while citing user privacy for withholding terms. The exchange has not publicly said whether the user was reimbursed, whether an API key initiated the withdrawals, or what happened to the reported stolen assets.
- ~340,000 USD — total value the user says was withdrawn (322,110 USDT plus 9.13 million ONE)
- 13 minutes — window in which nearly all the funds left the account
- 27 minutes — gap between the 24-hour withdrawal lock expiring and the first test transaction
- Unanswered — whether the API key survived the account freeze despite MEXC’s documentation
What This Means For You
Three practical lessons stand out. First, after any account compromise, audit and revoke every API key — not just passwords and two-factor settings. Second, understand that a 24-hour withdrawal lock is a cooldown, not a cure; attackers who leave credentials behind simply wait it out. Third, exchanges do not publish post-mortems unless pressured, so your own logs and screenshots may be the only record of what happened. Self-custody removes exchange risk entirely, but for those who trade on exchanges, treating API keys like house keys — counted, labeled and changed after any incident — is now baseline hygiene.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
ONE forgotten API key undid a 24 hour security lock and 340k was gone in 13 minutes. deleting my unused keys tonight, no joke
same energy as the mt gox era. 2FA on withdrawals plus zero dormant API keys, thats the whole checklist
checklist plus a dedicated email for exchange accounts only. the 3am approval went through because the recovery email was the same one getting swapped
27 minutes after the security lock expired, 13 minutes to drain the account. the lock protected nothing, just delayed the inevitable
Email change approved at 3am in 10 minutes with a submitted verification video. That approval process is the real vulnerability, not the API key
exactly. once the email and 2fa got swapped the api key was just the getaway car
my bank takes two days to approve a new device and mexc cleared a 3am email swap in 10 minutes with a video attached. unreal
the 10 minute 3am email swap with a verification video attached is the part that should end careers. the api key just drove the car
mexc calls it fully resolved without naming the terms. pay the guy to be quiet and the docs page still says locks expire in 24h
settled within days of it going public too, funny how that works. cold storage withdrawals every friday now, zero excuses
if the settlement came with an nda then the docs page staying up is the tell. reputation patch, not a security fix
settlement terms sealed while the docs page still advertises the 24h lock expiry. nothing got fixed, one guy got paid
btc withdrawals back first because its the cheapest pipeline to audit. judging them on how the eth and usdt reopen goes this week
10 minute email swap approval at 3am is the scandal, the api key was just the getaway car. watch how the eth and usdt withdrawal reopen goes before trusting the fix
13 minutes to move 340k means withdrawal addresses were pre whitelisted too. the api key alone doesnt explain that speed, the allowlist did
13 minutes to drain 340k and the fix is still rotate api keys every quarter. cheapest security upgrade in finance and almost nobody does it
quarterly key rotation costs nothing and would have stopped 340k. cheapest insurance in crypto and nobody buys it
rotation wouldnt even be needed if exchanges force scoped api keys with no withdrawal rights by default. the default is the bug
default no withdrawal rights should be law at this point. binance forces scope selection on api keys, mexc treating it as opt in is negligence
opt in security is not security. every exchange defaults to whatever config maximizes their api volume and calls it user choice
a 24 hour lock that expires while a dormant api key still has withdrawal rights is not a lock, its a timer
a timer with a dormant api key holding withdrawal rights the whole time lol. brutal way to learn it
the key held withdrawal rights through the whole 24h freeze too. they locked the front door and left the window open
front door and window analogy is exactly it. a freeze should reset every credential, not expire on a timer with dormant keys still live
mexc docs literally documented that the 24 hour lock expires into a normal account state. the recovery flow ended right where the attacker needed it to