Password Reset Surge
X investigates a surge of password-reset emails amid the rollout of financial services.
Anonymous
Key Points
1
The wave has hit thousands of X accounts, with victims including high-profile crypto personalities and journalists. Some users reported receiving eight to ten automated password-reset emails in rapid succession.
2
X’s default password-recovery flow can be abused because anyone who knows a public username can trigger a reset; Password Reset Protect is available to add an extra verification step before a reset is sent.
3
The security situation intersects with X Money, the platform’s financial services expansion built with banking infrastructure; the rollout has included opening X Money to Premium and Premium+ subscribers in the United States and leverages Cross River Bank.
4
Despite the surge, X officials say there is no evidence of a system breach and investigations are ongoing; the company has not disclosed how many accounts were affected or whether the activity was automated.
X is investigating a surge of unsolicited password-reset emails hitting thousands of accounts as the platform launches X Money, its financial services product. Whale's Book reports that X officials have found no evidence of a system breach, but the wave appears driven by automated bots exploiting the platform's public password-recovery system. The timing has raised alarms among security analysts, who note that attackers may be targeting X Money users to increase the payoff of potential account takeovers.
High-profile crypto personalities and journalists are among those affected, with some users reporting eight to ten reset emails in rapid succession. SearchEngineWatch noted that the attacks highlight a critical vulnerability: anyone who knows a public username can trigger a password reset. X is urging users to enable two-factor authentication and activate Password Reset Protection to shield their accounts.
X Money's Launch Intensifies Security Concerns
X Money represents a major expansion into financial services, with the platform now offering banking features built on infrastructure from Cross River Bank. Tech Yahoo reported that the password-reset surge coincides directly with X Money becoming available to Premium and Premium+ subscribers in the United States. Attackers likely recognize that compromised accounts linked to financial services carry far higher value than standard social accounts.
The rollout of banking functions on a social platform creates new attack surfaces. A compromised X Money account could give criminals access to payment systems, stored financial data, and linked bank accounts. Security experts warn that integrating fintech with social networking demands bulletproof account security — a challenge X now faces as it scales its financial ambitions.
How Attackers Exploit the Public Password System
X's password-recovery flow has a built-in weakness: anyone can request a reset if they know your public username. Crypto News explained that this design allows attackers to flood targets with reset emails, overwhelming them and increasing the odds that a user will accidentally click a malicious link or comply with phishing attempts. The system was never intended for this level of abuse.
To protect against this, X offers Password Reset Protection, an optional feature that adds an extra verification step before a reset email is sent. Users must also enable two-factor authentication and avoid clicking links in unexpected emails. Security researchers stress that victims should never share reset codes with anyone, as these codes grant direct access to accounts.
No Breach Found, But Investigation Continues
Tech Yahoo quoted product engineer Mridul Singhai confirming that the emails originated from X itself, not fake senders mimicking the platform. This ruled out phishing campaigns using forged messages. X officials have stated there is no evidence of a system breach, meaning attackers did not steal internal X data — they are simply abusing the password-recovery system that X intentionally makes public.
However, X has not disclosed how many accounts were targeted or whether the attack was fully automated. The ongoing investigation aims to identify the attackers' methods and intent. Company leaders have emphasized that user trust is essential to X Money's success, and that security missteps could undermine confidence in the platform's financial services.
Sentiment
Mostly NegativeNEGATIVENEUTRALPOSITIVE
Publishers
11
Articles
6
Reach
17
A
AnonymousAuthor
