MEXC — Unrevoked attacker API key drains recovered user account

Sep 24, 2026 at 19:10 UTC (Sep 25, 03:10 Beijing time) a security-settings reset email the user had not requested was approved about ten minutes later. The attacker then logged in from a Jakarta IP address, bound a Google Authenticator and created a withdrawal-enabled API key at 21:05:42 UTC, 83 seconds after the login. On Sep 25 at 02:55 UTC MEXC's risk review froze the account and restored the original email, but the API key was left active. The user changed the password and authenticator on Sep 26, which triggered a 24-hour withdrawal hold. Twenty-seven minutes after the hold expired, between 20:12:45 and 20:25:49 UTC on Sep 26, six withdrawals through the still-active API key took 322,110 USDT and 9,133,999 ONE (about $340,000). The user went public on Sep 28 with a long X thread. One outlet (TechFlow) claimed the attacker passed identity checks with a deepfake video; MEXC did not confirm this. MEXC confirmed the API-key path, announced full compensation on Sep 28-29, and later said the matter was resolved. Destination addresses and any onward movement are not public.