MEXC has confirmed that an API key left on a compromised account enabled an attacker to transfer roughly $340,000 before the incident was fully contained, and said it has fully compensated the affected user, @shuangfei8. Vugar Usi Zade, MEXC's chief executive, said customer service quickly identified the compromise, froze the account and helped restore the user's original email and authenticator. The user reported that 322,110 USDT and 9,133,999 ONE were withdrawn in six transactions over 13 minutes on September 26, 27 minutes after a 24-hour security hold expired. He said the attacker created the API key during an earlier breach and that it was neither revoked nor visible in his accessible security history when MEXC restored the account. Zade said the investigation remains under way, but MEXC concluded the user should not bear the loss. The exchange has not explained why the emergency response did not revoke the attacker's other account changes, whether the key remained valid during its risk-control freeze, or why the key's creation was absent from the user's visible history.