Is MEXC Safe in 2026? Licences, Reserves, and Regulator Warnings

The short answer

MEXC is not a scam platform, but it is not a fully licensed tier-one exchange either. It has two genuine strengths: a very wide token list at competitive fees, and monthly proof-of-reserves snapshots audited by a third party. It also has one unavoidable weakness: no licence from any tier-one jurisdiction, plus warnings, fines, and alert-list entries from several regulators.

The fair conclusion: MEXC works as a small, diversified trading venue — it is a poor place to custody your entire portfolio long term. Below are the verifiable facts, one by one.

The screenshot above is the Dubai Virtual Assets Regulatory Authority (VARA) notice dated June 22, 2026, finding that MX Global Ltd, which operates MEXC, provided virtual asset broker-dealer and exchange services to customers in Dubai without a VARA licence between 2022 and April 2026, and onboarded users without meeting KYC obligations.

1. Licence check: no tier-one authorisation

The direct way to judge whether an exchange is compliant is to look for local licences, not announcements. MEXC's current position:

• Not registered with the U.S. SEC;
• Not authorised by the UK FCA — and the UK is listed as a prohibited jurisdiction in its user agreement;
• Not on ESMA's MiCA register of authorised crypto-asset service providers;
• Singapore is explicitly listed as a prohibited jurisdiction in its user agreement.

In practical terms, if a dispute arises, there is no obvious regulator with jurisdiction to complain to or recover through. That matters far more than a fee difference.

2. Regulatory actions already on the public record

One distinction matters: being on a warning list is not the same as the platform collapsing. The former means it lacks local authorisation; the latter is an asset-safety event. Keeping the two separate is how you reach an accurate judgement.

3. Proof of reserves: genuinely transparent

MEXC publishes a monthly Merkle-tree proof-of-reserves snapshot audited by the blockchain security firm Hacken; users can verify that their own balance is included. The August 10, 2026 snapshot reported reserve ratios of 288% for BTC, 115% for USDT, 114% for USDC, and 113% for ETH.

A ratio above 100% means the platform holds more of that asset than users collectively own — a genuine plus. But understand the limits: proof of reserves proves asset coverage at a point in time. It does not prove the full liability side, nor key management or internal controls. It reduces solvency worry; it is not a guarantee that nothing will go wrong.

4. The September 2026 API key incident

On September 28–29, 2026, MEXC publicly acknowledged an incident in which roughly $340,000 was drained from a user's account through an API key even after the account had been flagged as compromised and frozen. MEXC subsequently reimbursed the user.

The lesson is not the amount but the process: freezing an account does not invalidate API keys. If you suspect your account is compromised, changing the password is not enough — delete and regenerate every API key at the same time.

5. The "frozen withdrawal" problem

The most common complaint about MEXC is suspended withdrawals. Its published risk-control triggers include suspected wash trading, self-trading, front-running, spoofing or layering, deposits from suspicious sources, mismatched identity information, bulk registration, and anti-money-laundering flags.

Rules like these are not unusual across exchanges. The problem is the experience: once triggered, trading and withdrawals can both be suspended for an open-ended manual review. For anyone who needs to move funds on short notice, that is a real liquidity risk.

6. How it compares with OKX and HTX

On the security dimension of our exchange series, the gap is licensing. OKX holds licences or registrations in multiple jurisdictions; HTX's position is more complex but discloses some compliance arrangements; MEXC currently has no tier-one authorisation. MEXC wins on fees and token coverage; it trails on safety and compliance.

That is the point we keep returning to: fees decide your cost, licences decide whether you have anyone to appeal to when things break.

7. If you still use it, do these seven things

• Keep balances small — only what you can afford to lose — and never make MEXC your sole custodian;
• Enable 2FA with a dedicated email and a password you do not reuse elsewhere;
• Attach an IP allowlist to API keys and never enable withdrawal permission on them;
• If anything looks wrong: change the password, delete all API keys, and audit trade history — all three, together;
• Keep complete deposit, withdrawal, and statement records; they are your only evidence in a dispute;
• Move larger holdings to licensed venues or self-custody wallets;
• Refuse any "account recovery" or "internal unfreeze" service — those are almost always secondary scams.

FAQ

Has MEXC ever been hacked?

There is no confirmed large-scale platform breach in the public record, but the September 2026 incident did see about $340,000 drained from a single user via an API key, later reimbursed. Single-account incidents and platform-wide breaches should be assessed separately.

Does a 288% reserve ratio mean it is absolutely safe?

No. A reserve ratio reflects asset coverage at one point in time. It does not cover liabilities, key management, or internal controls. It is a necessary condition, not a sufficient one.

Are "MEXC scam" search results reliable?

Separate three categories: formal regulator warnings (verifiable), individual user complaints (check the evidence), and competitor or affiliate marketing content (often exaggerated). Every regulatory action cited in this article can be found on the relevant regulator's own website.