MEXC user loses $340K after account recovery leaves attacker's API key active
- —322,110 USDT and 9,133,999 ONE, about $340,000, were withdrawn
- —Attacker used forged documents on Sept. 25 to change email and create an API key
- —Funds were drained via API 27 minutes after the 24-hour withdrawal limit was lifted
- —No new logins were recorded during the withdrawal; a formal claim has been filed
Why it matters: The case exposes a gap in MEXC's account-recovery process: API keys are not revoked by default, leaving users exposed even after the platform restores access.
Source: PANews