MEXC’s public disclosures show two important parts of its governance attack surface: reserve reporting and the platform’s discretion to review accounts or restrict access. They do not, by themselves, establish comprehensive solvency, independently verified fairness in individual account decisions, full cybersecurity maturity, or authorization in every jurisdiction. This review examines what MEXC has said, what those statements support, and what remains unresolved as of October 4, 2026.
What a governance attack surface review can establish
A centralized exchange’s governance attack surface includes the points where its decisions, controls, or disclosure practices can affect customer funds and access: how reserves are reported, who can trigger account reviews, how long restrictions may last, what external reviewers examine, and which legal entity serves users in a given location.
The material available for MEXC documents company statements and an announced external review relationship. It is not an audit of MEXC, a finding of wrongdoing, or a complete account of its internal controls. That distinction matters: a published policy can show what a platform says it may do, but cannot establish how consistently it does so or whether a particular decision was justified.
What MEXC’s reserve disclosures show
In a May 14, 2026 release distributed through Newswire.ca, MEXC reported that Hacken audited its May Proof of Reserves (PoR) snapshot. The release listed these asset-specific reserve ratios:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Asset | Ratio reported by MEXC for the May 2026 snapshot | What the figure does not establish on its own |
|---|---|---|
| BTC | 293% | Whether all possible liabilities, encumbrances, or liquidity risks were included in the review. |
| ETH | 123% | Whether customers can access funds at any particular time or under every account circumstance. |
| USDT | 117% | Whether the ratio covers obligations beyond the disclosed reserve comparison. |
| USDC | 120% | Whether the snapshot demonstrates comprehensive solvency across all assets and liabilities. |
These are dated figures reported by MEXC, not a general guarantee of liquidity or withdrawal access. A reserve ratio is most useful when its date, covered assets, customer-liability methodology, wallet-control evidence, and reviewer’s scope are clear. The May release supplies the ratios, but the materials cited here do not establish that all liabilities or every form of liquidity risk were audited.
Merkle Tree verification and the Guardian Fund
In a November 1, 2025 statement, MEXC said its PoR uses a Merkle Tree and that users can independently verify data. The same statement said the company established a $100 million Guardian Fund and publicly disclosed an address. These are MEXC’s descriptions; the available material does not independently establish the fund’s legal structure, coverage terms, claim triggers, or whether a specific user loss would qualify. A publicly disclosed address and a verification mechanism are relevant transparency measures, but they are not substitutes for evidence about those terms.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What MEXC says about account reviews and withdrawal restrictions
Published review triggers and discretion
MEXC’s Risk Control Guideline, published May 1, 2025, lists trading anomalies, spot or futures market irregularities, compliance or legal concerns, and listing-related risks as possible reasons for review. It says the platform may initiate broad review procedures based on its judgment. The guideline also states: “No details of MEXC’s internal risk control mechanisms or review processes may be disclosed for security reasons, and the duration or outcome of any review cannot be guaranteed.”
That language makes the stated discretion and uncertainty explicit, while leaving users unable to assess the internal decision process from the guideline alone. The document does not establish how often each trigger is applied, what evidence is required in a particular case, or how an individual review will be resolved.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Possible duration and MEXC’s reported trigger rate
In a March 14, 2025 statement, MEXC said accounts could be temporarily frozen during review for suspected abnormal trading or market manipulation. Its examples included wash trading, self-trading, front-running, false quoting, and layered orders. The company said: “In severe cases involving coordinated illicit activities, the risk control period may extend up to 365 days.” That is a stated possible maximum in severe cases, not a reported typical duration.
MEXC also reported that its accidental-trigger rate was below 0.1%. The statement did not establish the methodology or provide independent validation for that figure, so it should be treated as a company-reported statistic rather than a measured rate of user experience.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Withdrawal restrictions and advanced KYC
In an August 26, 2025 statement, MEXC said it temporarily restricted withdrawals and required advanced KYC for some accounts it considered to involve potentially risky funds. The company said most affected users passed verification and had restrictions lifted, while some accounts remained restricted because of suspicious fund activity. It also said it had responded to official freeze requests supported by law-enforcement documentation.
Those statements describe MEXC’s account of its compliance and access controls; they do not quantify how common such restrictions are or independently establish the merits of any individual case. For a customer, the practical concern is whether funds might be inaccessible while a review is pending, particularly if prompt access is important.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the Hacken relationship does—and does not—cover
MEXC’s November 20, 2025 blog said Hacken would conduct monthly Proof of Reserves reviews with public reports, and described the expanded relationship as building on a 2025 mobile application security audit. This supports saying that MEXC announced a monthly review cadence and referenced an app audit. It does not support treating a reserve review as a whole-company security audit or as an independent assessment of every governance control.
The materials cited here do not provide a comprehensive independent assessment of MEXC’s board or ownership structure, internal audit function, incident response, access controls, business continuity, vendor concentration, or governance accountability. These are unanswered evaluation areas, not established deficiencies. A reader assessing a particular Hacken engagement should distinguish the individual report’s stated scope, procedures, and findings from the broader fact that an engagement was announced.
How to assess MEXC before relying on it
Use the disclosures as inputs to a decision, not as a blanket assurance. The following checks identify what to verify for your own needs:
- Check reserve coverage: Look for the snapshot date and update cadence, the assets included, how customer liabilities are treated, evidence of wallet ownership or control, and the reviewer’s methodology and scope.
- Understand access risk: Read the current risk-control and account terms for possible review triggers, evidence requests, notice, correction or appeal channels, and whether review duration or outcomes are guaranteed.
- Read the underlying assurance: Where a public report exists, identify what was examined and what was excluded. Do not infer broad security coverage from a reserve verification or mobile application audit.
- Confirm the relevant entity and product: Availability and legal status can differ by jurisdiction and product. Check the exact MEXC legal entity and service against official registers, regulator notices, and current terms for your location.
- Consider access needs: If you may need immediate access to funds, account-review discretion and the possibility of withdrawal restrictions are operational risks to weigh separately from reserve figures.
Regulatory status depends on jurisdiction
The available material does not establish a complete, current licensing or enforcement map for MEXC. The CFTC explains that its RED List concerns foreign entities that appear to be acting in a capacity requiring CFTC registration but are not registered; being listed is not, by itself, a legal finding by the CFTC or a court that a violation occurred. The SEC’s PAUSE resource describes that list generally but does not establish a MEXC-specific SEC finding.
Recommended Free Tools
Accordingly, these materials do not support a blanket claim that MEXC is licensed or unlicensed everywhere. A jurisdiction-specific assessment requires checking the legal entity and product available to you against the relevant official register and notices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
