MEXC: leftover attacker API key drains ~$340k after freeze restore
13M ONE (~$340k) leaving the account after an earlier takeover. Support had frozen the account and helped restore email and authenticator, but an API key the attacker created stayed live.
Withdrawals ran shortly after a security hold expired. CEO Vugar Usi Zade said the leftover key caused the transfer and that MEXC fully compensated the user. Single-account ops failure. The rest of the exchange was not reported emptied.
Research snapshot from CryptoTimes and related public notes.
369 take
Incident response that restores login without revoking every attacker-introduced credential leaves a back door.
Pulse lesson for any custodial or account-linked surface: freeze means kill sessions, API keys, and withdrawal rights together, then re-issue only what the real owner creates.
Sources