X is facing a wave of suspicious activity following the rollout of its new payments feature, X Money. Users have been receiving numerous password reset emails they didn’t request, prompting the company to launch an investigation. While there’s currently no confirmed breach, X says attackers may be trying to gain unauthorized access by mass-triggering password reset functions using public usernames.
What’s happening
X engineers have noticed a trend: after X Money became broadly available, many users started getting unsolicited password reset emails. The company’s investigations, led by product engineering teams, suggest this activity is connected to the payments platform’s launch and fueled by attackers attempting to compromise accounts. As of now, there’s no evidence anyone has succeeded in accessing accounts improperly.
Security responses and safeguards
To protect users, X is advising everyone to enable two-factor authentication and turn on newly introduced Password Reset Protection. The platform’s AI assistant, Grok, has been helping folks walk through these steps and confirmed that no system breach or mass takeover has been detected so far.
Meanwhile, X’s general counsel has escalated the tone, vowing that the company’s security and legal teams will pursue those responsible, wherever they are. More transparency from official channels is expected, as X has yet to issue a detailed update through its main accounts.
Why it matters
X Money adds a financial component to the social platform, allowing users to make and receive payments directly. Naturally, that raises the stakes for security—the presence of real money makes it a more attractive target for attackers. That in turn requires stronger protections, both technical and procedural.
This episode underscores the broader vulnerability social platforms face when adding commerce features. History shows that introducing payments or financial transactions often draws new – and more aggressive – forms of attack. For users, knowing how to secure an account and using tools like two-factor authentication becomes essential in this environment.
What to watch now: whether X will provide more specific details on the vulnerabilities exploited, how quickly it knits in stronger protections like phishing detection or rate-limiting form submissions, and whether there actually are impacted accounts despite no confirmed breach yet.
