MEXC Blocked $38.6M in Suspect Funds as AI-Driven Attacks Surge

A Two-Month Window Into Platform-Level Crypto Security

Between July and August 2026, the broader crypto industry absorbed approximately $535 million in losses across 184 documented security incidents. Phishing, fraud, endpoint compromises, and supply-chain attacks collectively accounted for nearly half of those incidents. Against that backdrop, MEXC published its bimonthly security report on September 16, 2026, detailing how the exchange handled risk-related fund flows, account restrictions, and reserve obligations during the same period.

The report covers four operational areas: risk-fund interception, account risk management, the Futures Insurance Fund balance, and proof-of-reserve disclosures. Each category shows material movement compared with the prior reporting period – in some cases, by orders of magnitude.

215 Cases, Zero Failures: How MEXC Handled Incoming Fraud Funds

Every one of the 215 external reports involving stolen or fraud-related funds that reached MEXC during July and August was intercepted before those assets could be withdrawn or further moved. The total value covered by those interceptions reached 38,655,490 USDT. Forty-two of the 215 cases involved formal judicial freeze assistance, meaning MEXC coordinated directly with legal authorities to hold the funds under enforceable order.

The scale of the increase relative to the prior period is difficult to contextualize without reading it plainly: the number of successfully intercepted cases rose by approximately 2,971%, and the value of intercepted funds increased by approximately 12,646%. The exchange attributed part of its effectiveness to sharing suspicious wallet addresses with other industry participants and supporting cross-platform fund-flow tracing under established law-enforcement cooperation procedures. Whether the spike in case volume reflects improved reporting infrastructure, a higher rate of incoming fraud attempts, or both, the report does not specify.

A sharper threat is also shaping why interception capacity matters more now than it did two years ago. Attackers are increasingly using AI tools to auto-generate phishing content and assist in writing malware, which compresses the time between a campaign’s construction and its deployment. That efficiency gain on the attacker’s side places pressure on exchanges to identify and freeze suspect funds faster, since the window between a user being defrauded and the funds being laundered or withdrawn narrows as attack tooling improves.

For users who sent assets to wrong addresses rather than losing them to theft, MEXC manually processed 818 applications for misdirected asset recovery during the period, returning the equivalent of 602,225 USDT – a 75.31% increase from the prior reporting window. Manual processing of those applications suggests each case required individual review rather than automated resolution, which carries its own operational cost at scale.

Account Restrictions and the Geography of Risk Groups

MEXC identified and restricted 20,752 accounts tied to risk-related activity during July and August, up 118.03% from the previous period. Beyond individual accounts, the platform identified 5,288 distinct risk groups – clustered networks of accounts that appear coordinated – representing a 20.35% increase.

The regional breakdown of those groups points to three concentrations: the Commonwealth of Independent States produced 1,803 risk groups, Nigeria produced 1,099, and Indonesia produced 976. These are not necessarily the origin points of the fraud being conducted, but rather the registered or inferred locations of the accounts grouped under risk classification. The distinction matters because account registration geography does not always correspond to where the underlying operation is based or controlled. Still, the pattern suggests that cross-border account network monitoring remains a core part of MEXC’s detection methodology rather than a secondary tool.

The jump in restricted accounts – more than doubling in a single reporting period – raises a question the report does not answer directly: whether improved detection is surfacing activity that previously went unnoticed, or whether the volume of risk-related account creation on the platform is genuinely accelerating. Given that AI tools now lower the barrier to generating convincing fake identities and coordinated account structures, both explanations are plausible. The use of compromised infrastructure to target hardware wallet users illustrates how attackers increasingly layer multiple methods to reach crypto holders across platforms.

Futures Insurance Fund and Reserve Ratios

As of September 1, 2026, the MEXC Futures Insurance Fund held 791,696,422 USDT, a 5.44% increase from the prior reporting period. The fund functions as a buffer against negative balances that can emerge when liquidated positions close at worse-than-expected prices during volatile markets. When a liquidated position closes at a price better than the bankruptcy price, the surplus flows back into the fund rather than being distributed elsewhere. Users can monitor the real-time balance through MEXC’s Proof of Trust page. The fund’s existence also reduces the frequency of auto-deleveraging events, where profitable positions are forcibly reduced to cover losses – a mechanism most traders prefer not to encounter.

On proof of reserves, MEXC disclosed the following ratios for four major assets: Bitcoin at approximately 288%, with 12,312.75 BTC in total wallet assets against 4,282.20 BTC in user assets; Ethereum at approximately 113%, with 66,227.79 ETH held; USDT at approximately 115%, with roughly 1.940 billion USDT in wallets; and USDC at approximately 114%. All four ratios sit above the 100% threshold that indicates full backing of user holdings.

The BTC ratio of 288% stands out – holding nearly three times the amount of bitcoin owed to users is a significant overcollateralization. Whether that reflects conservative treasury management, custodial arrangements that require larger buffer holdings, or some other operational factor, the report does not elaborate. What it does confirm is that for every BTC a user has deposited, MEXC holds approximately 2.88 BTC in its wallets. At current prices, that gap between user claims and platform holdings represents a substantial absolute value, and any future shift in that ratio toward 100% would be worth watching closely.