X Money has become the focus of a new wave of account attacks, according to X, which says bad actors are targeting user accounts following the payment service’s launch. Numerous users have reported receiving unsolicited password reset emails, prompting the social media company to open an active investigation. So far, X says it has found no evidence that any accounts were successfully compromised.
On Tuesday, X product engineer Mridul Singhai posted that the company was reviewing user complaints about the mass password reset attempts. He noted that attackers appear to believe the broad availability of X Money creates an opportunity to gain unauthorized access to accounts. Singhai added that the investigation was ongoing and that no breaches had been identified, while apologizing for the repeated emails users received.
What X Money Is and Why It’s a Target
X Money is the platform’s newly launched payments service, which includes a bank card and additional benefits. For X, the service is designed to make it easier for creators to collect payments directly on the platform, expanding the company’s broader digital economy. The movement of money, however, tends to draw malicious actors, which is what X says may be driving the current activity.
As of publication, X had not shared details through one of its official company accounts. X general counsel James Burnham posted a warning stating that the company’s legal and security teams would work to identify, locate, and hold accountable anyone who attempts to victimize platform users.
How Users Can Protect Their Accounts
With the attacks ongoing, users have been alerting one another and encouraging others to enable two-factor authentication if it is not already active. X’s chatbot, Grok, has also replied to some posts with steps on how to turn on the protection. Grok confirmed that attackers are mass-triggering the password reset form using public usernames.
According to Grok, there is no confirmed system breach or mass account takeovers tied to the activity. The bot described the situation as a widespread wave of unsolicited password reset emails hitting many accounts, generated by attackers exploiting the reset form rather than by any underlying security failure. Grok also pointed users toward Password Reset Protect, found within the security settings, as an additional safeguard.
The reported activity coincides directly with the wider rollout of X Money, and X has stated that its investigation into the password reset attempts remains active, with no evidence of successful account breaches identified at this time.
Source
Image: techcrunch.com
