Following the launch of the payment service X Money, unusual account activity occurred on the platform. Multiple users reported receiving unsolicited password reset emails. X stated that it is investigating the matter and has found no evidence that hackers have successfully compromised any accounts.
Multiple users received reset emails.
According to X, the attackers appear to believe that, with @XMoney now widely open, they could attempt to gain unauthorized access to user accounts. The company stated that its current investigation has found no evidence of data breaches or compromised accounts, but acknowledged that users may receive repeated related emails as a result.
TechCrunch reported that, as of press time, X had not yet released a more detailed statement through its official corporate accounts and had not responded to further media inquiries.
X Money came under pressure after launch.
X Money is X’s newly launched payment service, featuring functions such as debit cards. For X, this service aims to make it easier for creators to receive payments within the platform, further advancing its digital payment ecosystem.
After the payment feature was launched, the connection between accounts and funds increased, making them more attractive targets for attackers. According to X, this incident appears to have involved attackers using publicly available usernames to bulk-trigger password reset forms, rather than having breached the platform’s system.
- No evidence of system compromise has been found.
- No confirmed large-scale account takeovers at this time.
- Abnormal activity is related to the password reset process.
User reminder: Enable two-factor authentication
As the anomaly continues, some users on the platform have warned each other to enable two-factor authentication promptly to reduce the risk of account compromise. X’s chatbot, Grok, has replied to certain posts with steps to enable two-factor authentication, stating that attackers are “bulk-triggering” password reset requests.
X's Chief Legal Officer, James Burnham, also posted on the platform that X’s legal and security teams will investigate and hold accountable those attempting to harm platform users.