Updated Rules checked 2026-10-22
Is MEXC safe? Start with the record. MEXC’s official explainer says there have been no public reports of an exchange wallet hack since it launched in 2018. What is on record are individual account incidents: in 2025, about USD 3.1 million belonging to one trader was frozen by risk controls and released after MEXC apologized; in September 2026, an attacker took over an account and moved about USD 340,000 using an API key that had never been deleted, and MEXC says it compensated the user in full. The latest proof of reserves is from October 2026, audited by Hacken: BTC 294%, USDT 122%, USDC 115%, ETH 111%.
On licensing, the contracting party in MEXC’s terms of use is MEXC (Comoros) Ltd, registered in the Union of the Comoros, but I couldn’t find any page on the official site that lists licenses or regulatory registrations by country. MEXC’s own article also states that it is not authorized in the UK or under the EU’s MiCA. Regulators including the UK FCA, the Dutch AFM, Dubai’s VARA and the Seychelles FSA have all issued warnings or penalties against MEXC.
No exchange is risk-free. This article only collects what can be traced to a source: the incident record, the reserve figures, regulators’ notices, and how to tell real sites and apps from fakes. Whether to use MEXC is your call.
Key points:
1. MEXC’s official explainer says there have been no public reports of an exchange wallet hack since its 2018 launch (that article checked 2026-10-08); in September 2026, about USD 340,000 was stolen from one account through a leftover API key, and MEXC says it compensated the user in full.
2. MEXC’s October 2026 proof of reserves (official graphic dated 2026-10-09, Hacken report dated 2026-10-12): BTC 294%, USDT 122%, USDC 115%, ETH 111%.
3. MEXC’s Guardian Fund currently holds 100 million USDT plus 2,000 BTC; MEXC states that this is a company commitment, not a statutory compensation scheme.
4. MEXC’s terms of use (updated 2026-10-13) exclude the US, the UK, Canada, Hong Kong, Singapore, Malaysia, Russia, Belarus and other regions; users in the Netherlands have been told to move their assets out by 2026-10-31.
5. MEXC states that its official site is mexc.com; on the App Store the developer is Onechain Technology Ltd, and on Google Play it is MEXC Ltd.
The information below was checked against official pages on 2026-10-22 (data check date) and is provided for reference.
Has MEXC ever been hacked? How MEXC handled it
For the platform’s wallets, MEXC’s safety explainer says there have been no public reports of a MEXC exchange wallet hack since its 2018 launch. Our exchange safety record had no such entry as of 2026-10-12, and when I searched again on 2026-10-22, I found none either. The two account incidents that drew the most attention are these:
| When | Incident | MEXC’s response | Source |
|---|---|---|---|
| From July 2025 | About USD 3.1 million belonging to one trader was frozen under risk-control rules | Apologized publicly and released the funds on 2025-10-31, and said it would set up a fast track for account issues | MEXC safety explainer, DL News |
| September 2026 | An account was taken over, and the attacker moved about USD 340,000 using an API key left on the account | MEXC’s CEO said the user was compensated in full | MEXC safety explainer |
Source: MEXC safety explainer (version checked 2026-10-08); dates of the freeze follow DL News’s report; checked 2026-10-22.
Going by these two incidents, the risk MEXC users are more likely to run into is at the account level rather than theft from the platform’s wallets. The key to the September 2026 case was the API key: MEXC’s withdrawal feature announcement of 2023-04-07 states that API withdrawals do not use the withdrawal whitelist by default and can go to any address. So delete API keys you no longer use, and turn on the withdrawal whitelist for the ones you still need.
Risk-control restrictions are the other common issue. MEXC’s July–August 2026 security report says that over those two months the platform restricted 20,752 accounts involved in risky activity and intercepted 215 inflows of stolen or scam funds from outside, about 38,655,490 USDT. Normal accounts can also end up under risk-control review; if yours is restricted, use MEXC’s official appeal channels. For what to do, see what to do if your exchange account is frozen.
How to read MEXC’s proof of reserves (PoR)
MEXC publishes its proof of reserves once a month, audited by the security firm Hacken. Here are the four reports from July to October 2026:
| Month (release date) | BTC | ETH | USDT | USDC | User BTC assets |
|---|---|---|---|---|---|
| July 2026 (released 07-15) | 281% | 114% | 119% | 115% | 4,439.51 BTC |
| August 2026 (released 08-14) | 288% | 113% | 115% | 114% | 4,282.20 BTC |
| September 2026 (snapshot 09-10, released 09-15) | 297% | 111% | 119% | 111% | 4,106.57 BTC |
| October 2026 (graphic 10-09, released 10-16) | 294% | 111% | 122% | 115% | Not stated in the official press release |
Source: MEXC’s monthly proof-of-reserves press releases; for the October report, see also the Hacken audit page (report dated 2026-10-12); checked 2026-10-22.
The reserve ratio is the platform’s holdings of a coin divided by users’ holdings of the same coin. Take USDT in September: the platform held 1,818,202,910.24 USDT and users held 1,526,526,878.38 USDT, a surplus of about 292 million, for a ratio of 119%. The BTC ratio rose from 281% to 297% mainly because users held less BTC. By MEXC’s published figures, the platform held 12,312.75 BTC in August (July–August security report) and 12,202.13 BTC in September, down 110.62 BTC; over the same period, user BTC fell from 4,282.20 to 4,106.57 BTC, down 175.63 BTC. Users’ coins fell faster than the platform’s, so the ratio went up. From July to September, user BTC fell by about 7.5% in total.
On method, MEXC states that Hacken’s monthly checks cover Proof of Liabilities, Proof of Ownership, the reserve calculation and Merkle tree verification. MEXC also publishes its custody wallet addresses, and the Merkle tree code is open source on GitHub. Whether zero-knowledge proofs (zk) are used is not officially stated. PoR is only a snapshot of these four coins at one point in time. It is not a full financial audit, and it shows no liabilities beyond these four coins.
How do you verify your own balance was included?
The steps in the English version of MEXC’s safety explainer are:
- Log in, open Wallets and go to Overview.
- In the Account section, select Proof of Reserves to open the “My Proof of Reserves” page.
- Tap Details, then Verify Now, and follow the screen to compare your record against the published Merkle root.
This checks whether your own balance was counted in total liabilities. It can’t show what other liabilities the platform has. A comparison of reserve ratios and methods across 13 exchanges is in our exchange proof of reserves comparison.
How big are the Guardian Fund and the futures insurance fund?
MEXC’s 2026-10-16 press release says the Guardian Fund currently holds 100 million USDT plus 2,000 BTC, with a goal of growing it to USD 500 million within two years. Its purpose is to protect users if MEXC’s own systems suffer a large-scale attack or vulnerability. MEXC’s safety explainer also states that it is a company commitment, not a statutory compensation scheme, that claims go through a manual eligibility review, and that the published coverage does not list trading losses or account theft. Measured against user assets in the September snapshot, 2,000 BTC is about 48.7% of user BTC, and 100 million USDT is about 6.6% of user USDT. This is only to give a sense of scale; it is not a payout cap.
The futures insurance fund covers the shortfall when a liquidated position’s losses exceed its margin. Its balance on 2026-09-01 was 791,696,422 USDT (MEXC security report), and you can check the live balance on MEXC’s Proof of Trust page. It covers shortfalls across the whole futures market, not individual losses. When you trade with leverage, a price move against you can get your position liquidated and you can lose your entire margin.
Where is MEXC registered or licensed?
The only thing MEXC’s official pages show is a company registration: MEXC’s terms of use (updated 2026-10-13) state that users contract with MEXC (Comoros) Ltd, a company registered in the Union of the Comoros, with an address in Mutsamudu, Anjouan. The official site does not list the countries where MEXC holds licenses or regulatory registrations; this is not officially stated. MEXC’s own safety explainer says it does not serve the US and is not authorized in the UK or under the EU’s MiCA.
Meanwhile, the notices regulators have issued about MEXC can all be found on the regulators’ own websites:
| Date | Regulator | Notice | Source |
|---|---|---|---|
| 2023-10-17 | Germany’s BaFin | Warned that MEXC was providing financial services on mexc.com without authorization | BaFin |
| 2023-03-31, 2024-11-28 | Japan’s FSA | Issued two warning letters to MEXC for operating without registration | FSA list |
| 2023-12-28 | India’s FIU-IND | Issued a non-registration notice to MEXC | MEXC restricted regions explainer |
| 2024-03-15 | Hong Kong SFC | Added to its alert list of suspicious virtual asset trading platforms | Hong Kong SFC |
| 2024-03-22 | UK FCA | Warning list: MEXC Global Ltd is not authorized | FCA |
| August 2025 | Philippine SEC | Named MEXC in an advisory | MEXC restricted regions explainer |
| September 2025 | Dutch AFM | Providing crypto-asset services without a MiCA license; MEXC is no longer on the business register and its location is unclear | AFM |
| 2026-05-26 | Seychelles FSA | Identified MX Global Ltd as the operator of the MEXC platform, without a VASP license, and began enforcement proceedings | Seychelles FSA |
| 2026-06-22 | Dubai’s VARA | Fined MX Global LTD and ordered it to stop unlicensed activity; VARA states that the company cooperated with the investigation and said it intends to apply for a license | VARA |
Source: the regulators’ original notices; the India and Philippines entries follow MEXC’s own restricted regions explainer; checked 2026-10-22.
MEXC’s safety explainer notes that none of these notices say MEXC lost or misused customer funds. But in regions where MEXC is not authorized, there is no local regulator to complain to if a dispute arises, and no compensation scheme. Rules differ by country, so go by your local regulator’s notices.
How do you confirm MEXC’s official site and app are real?
| Item | Official details | Source |
|---|---|---|
| Official website | mexc.com (MEXC recommends typing the address yourself rather than clicking through from search results) | MEXC anti-scam guide |
| App Store | Developer Onechain Technology Ltd, App ID 1605393003 | App Store |
| Google Play | Developer MEXC Ltd, package ID com.mexcpro.client | Google Play |
| Download page | The download page on MEXC’s official site | MEXC download |
| Official verification | App: home screen “More” → “Services” → “Official Verification Channel”; web: “Support” at the very bottom of the home page → “Official Verification Channel”. Enter the account ID to check it: green means official, red means it isn’t | MEXC official verification |
Source: MEXC anti-scam guide (2025-09-12) and the App Store and Google Play listing pages, checked 2026-10-22.
It’s normal for the iOS and Android developer names to differ. What matters is that both match the table above, and the safest route into either store is through the download page on MEXC’s official site. In a 2026-07-20 notice in its fraud prevention guide, MEXC warns that phishing sites and fake MEXC apps have recently appeared, and that MEXC staff will never ask users for their account password, SMS codes or Google Authenticator codes in any form.
The common impersonation tactics MEXC lists include: asking you to click a link because of an “account upgrade,” “migration,” “account clearance” or “triggered risk control”; posing as platform staff or as police, prosecutors or court officials and claiming your account holds dirty money that needs to be investigated; and running fake “arbitrage” groups on Telegram that trick you into sending ETH and then hand out fake MX. MEXC also states that it has never run investment groups where a “mentor” calls trades or “coaches” crypto trading. Check any suspicious email, phone number, URL or social media account through official verification first. If someone asks you to pay before you can withdraw, it’s a scam. The tactics are covered in crypto exchange scam types and fake exchange withdrawal scams.
Which MEXC account security settings should you turn on?
On the web, MEXC’s settings are under the “profile avatar” at the top right → “Security Center”; in the app, it’s the “profile avatar” at the top left → “Security Center”. Based on MEXC’s help articles, these are worth turning on first:
- Google Authenticator: you enter a code when withdrawing, and MEXC recommends turning on at least one form of two-step verification. MEXC also has a guide on turning off cloud sync.
- Passkeys: log in and withdraw with a fingerprint, face or screen lock; supported on iOS 16.0.0 and Android 9.0 or later, up to 10 passkeys (passkey guide).
- Anti-Phishing Code: 1 to 6 characters, no special characters. Once set, every official MEXC email shows this string; an email without it, or with the wrong one, may be phishing (Anti-Phishing Code guide).
- Withdrawal Whitelist and the whitelist security restriction: with the whitelist on, you can only withdraw to whitelisted addresses. Turn on the security restriction as well, and newly added addresses have to wait 24 hours before you can withdraw to them; if you turn the restriction off, the account also has to wait 24 hours (withdrawal settings).
- Withdrawal protection: choose a lock period during which all on-chain withdrawals are rejected automatically. You can only end it early if you turned on “Early Unlock” when setting it up.
- Quick withdrawal: withdrawals below a set amount skip two-step verification. It’s convenient but removes one safeguard, and a custom limit takes 24 hours to take effect.
- API keys: delete the ones you no longer use; API withdrawals bypass the whitelist by default (see the 2023 announcement above).
Also, after you unlink Google Authenticator, withdrawals and fund transfers are blocked for 24 hours, and after you change your linked email, withdrawals and fiat withdrawals are blocked for 24 hours. This waiting period gives you time to notice changes you didn’t make. For a comparison of each exchange’s settings, see exchange account security settings; for withdrawal steps and why withdrawals get stuck, see how to deposit and withdraw on MEXC.
Assets on an exchange are held in the exchange’s custody. For long-term holdings, you can consider keeping them in your own wallet; see the crypto wallet guide for how.
Where can’t you use MEXC?
Under item 1 of “PROHIBITED JURISDICTION” in MEXC’s terms of use (updated 2026-10-13), the regions where MEXC provides no services and accepts no registrations are: North Korea, Cuba, Sudan, Iran, mainland China, Singapore, Malaysia, the United States, the United Kingdom, Hong Kong, Kazakhstan, Russia, Russian-controlled regions of Ukraine (currently including Crimea, Donetsk, Luhansk, Zaporizhzhia, Kherson and Sevastopol), Belarus, Canada, and countries under comprehensive EU or US OFAC sanctions or on the FATF blacklist. The terms state that the list is not exhaustive and may change at any time.
- Russia and Belarus: in a 2026-10-20 announcement, MEXC said it is ending service for users in both countries and will notify each user individually of the deadlines for closing positions and withdrawing.
- The Netherlands: MEXC is exiting, users have been told to move their assets out by 2026-10-31, and final offboarding is set for 2026-11-16 (MEXC restricted regions explainer).
- App availability: MEXC’s app supported regions page (updated 2026-08-26) does not list Japan, South Korea, India, Indonesia, the Philippines, Malaysia, mainland China or the UK.
Read the terms’ list and each country’s regulation separately: Japan, India and the Philippines are not on the terms’ list, yet all three have taken action against MEXC. For restricted regions across 13 exchanges, see exchange restricted countries.
FAQ
Is it safe to keep money on MEXC?
No exchange can guarantee your assets are safe; what you can check is the record. According to MEXC, there have been no public reports of an exchange wallet hack since 2018, and in its October 2026 proof of reserves, the BTC, USDT, USDC and ETH reserve ratios were all above 100%. But MEXC is not authorized in the UK or under the EU’s MiCA, and the Guardian Fund is only a company commitment. Assets on an exchange are held in the exchange’s custody, so if you hold a large amount for the long term, you can consider moving it to your own wallet.
Could MEXC go bust?
No data can guarantee that an exchange won’t fail. A proof of reserves only shows that, at the moment of the snapshot, the platform’s holdings of BTC, ETH, USDT and USDC exceeded users’ holdings. In the September 2026 snapshot, for example, user BTC was 4,106.57 BTC and platform BTC was 12,202.13 BTC. It is not a full financial audit, it shows no other liabilities, and it says nothing about what happens later.
Is MEXC a scam?
MEXC is an exchange that has operated since 2018 and publishes a monthly proof of reserves audited by Hacken. Most of the “MEXC scam” stories online involve fake websites, fake apps, fake support agents or fake investment groups using MEXC’s name. MEXC states that its staff will never message you privately to ask for a transfer or a verification code, and you can check suspicious accounts through the official verification channel. On the other hand, regulators in several countries have issued warnings or penalties against MEXC for operating without a license. That is a separate matter from scams, but it is still a risk you should know about before using the exchange.
Has MEXC been hacked?
According to MEXC’s official explainer, there have been no public reports of an exchange wallet hack since its 2018 launch, and I found none when I searched on 2026-10-22. There has been an individual account theft: in September 2026, about USD 340,000 was moved out of one account through a leftover API key, and MEXC says it compensated the user in full.
What should I do if my MEXC withdrawal is stuck?
First check whether it’s one of the security waiting periods MEXC states officially: withdrawals are blocked for 24 hours after you unlink Google Authenticator or change your linked email, and new addresses under the whitelist security restriction also wait 24 hours. These lift automatically when the time is up. If it’s a risk-control restriction, use MEXC’s official appeal process or live chat support. Anyone who asks you to pay an “unfreezing fee” or a “deposit” before you can withdraw is running a scam.
How often does MEXC publish its proof of reserves?
MEXC publishes it once a month, audited by Hacken. The latest is October 2026 (released 2026-10-16): BTC 294%, USDT 122%, USDC 115%, ETH 111%. The previous report, for September, had a snapshot date of 2026-09-10.
Does MEXC have a license?
MEXC’s official site does not list licenses by country. What can be confirmed officially is the contracting party named in the terms of use, MEXC (Comoros) Ltd, a company registered in the Union of the Comoros. MEXC itself states that it is not authorized in the UK or under the EU’s MiCA. On 2026-05-26, the Seychelles FSA identified MX Global Ltd as MEXC’s operator, holding no VASP license, and on 2026-06-22, Dubai’s VARA fined the same company.
How do you spot a fake MEXC app?
Check the developer name: on the App Store, the MEXC app’s developer is Onechain Technology Ltd (App ID 1605393003); on Google Play, it’s MEXC Ltd (package ID com.mexcpro.client). The safest approach is to enter the store from the download page on mexc.com, and not to install files or links that other people send you.
MEXC’s fees, rebates and products are covered in our MEXC review; to open an account or check the referral code, see MEXC referral code; for identity verification steps, see the MEXC KYC guide. Hacks, withdrawal halts and regulatory records for each exchange are collected in our exchange safety record. To compare MEXC with other exchanges, see Binance vs MEXC and Bitget vs MEXC.