X Faces Bulk Password Reset Requests; X Product Engineer Mridul Singhai States Company is Investigating
Thousands of X users have reported receiving password reset emails that were not initiated by them, with some receiving up to 10 emails within a few hours; affected users include multiple accounts in the crypto industry and at least 4 CoinDesk employees.
The emails are confirmed to have been sent by X's official system, not by verified spoof emails. Attackers can repeatedly invoke the account recovery process using only publicly available usernames, triggering the platform to send reset links to the associated email; therefore, receiving a reset email does not prove that the attacker has access to the email address, the original password, or has gained control of the account.
Crypto investor Nic Carter noted that many users are experiencing unsolicited reset attempts and suggested enabling "Password Reset Protect." When this option is activated, the password recovery process will no longer accept just the username, requiring the submission of the associated email address or phone number, thus raising the threshold for triggering reset emails using public usernames.
User cap.eth stated that even with two-factor authentication enabled, there are still attempts to reset their password. Two-factor authentication primarily protects logins or critical operations, while the password recovery process remains a separate attack surface; if an attacker can trick a user into clicking a fake reset link, intercepting an SMS verification code, or controlling the associated email, 2FA does not automatically eliminate the risks of social engineering and recovery processes.
X product engineer Mridul Singhai stated that the company is investigating the matter and has not found evidence of a system breach; he indicated that attackers may believe that taking over accounts after the broad opening of X Money would yield higher economic value. The main account, X Support, and X Money accounts have not yet released a complete incident report, and the platform has not confirmed the existence of coordinated attacks or data breaches.
Users can enable Password Reset Protect in "Settings & Privacy - Security and Account Access - Security" and use an authenticator app or security key instead of SMS verification codes, while also checking active sessions and login records for the associated email. Users should not click on abnormal emails, private messages, or reset links in pop-ups; they should directly access the official X app or manually enter the official domain to complete security settings.
In market mechanisms, the value of X accounts to crypto projects, media, traders, and KOLs comes from instant dissemination, brand reputation, and the potential link to X Money payment gateways; attackers will prioritize targeting high-value accounts that have followers, influence market information flow, or may access commercial accounts. Beneficiaries are institutional accounts with security keys, independent secure emails, and strict permission management; those under pressure are individuals and teams that reuse passwords, rely on SMS verification, and use social media accounts as their only announcement channels for projects.
Source: Public Information
ABAB AI Insight
The password recovery process of X has long faced a design contradiction between "public identifiers - private recovery channels": usernames are easy for anyone to look up accounts but can also be used to trigger recovery requests. Previously, Twitter experienced incidents where social engineering attacks controlled internal tools to hijack high-value verified accounts; in 2020, attackers controlled about 130 accounts and stole approximately $118,000 in Bitcoin. There is currently no evidence that this incident is a repeat of internal permission failures, but it again exposes that the recovery chain for high-value accounts is easier to become an attack entry point than ordinary login pages.
Attackers' capital path is usually not to directly crack passwords but to create panic and information noise through bulk reset requests, then use spoofed emails, fake customer service, forged 2FA pages, or SIM swap attacks to deceive users into providing final verification credentials. The expanded availability of X Money will increase the potential returns of this chain: once accounts can be linked to payments, identities, or commercial transactions, social media accounts transform from information distribution tools to potential financial gateways, increasing the ways to monetize after hijacking. X currently only states that it is investigating, and this cannot be taken as evidence that attack activities have targeted X Money.
This is similar to the gradual promotion of security keys by Google, Apple, and Microsoft: passwords are not the only weak point; recovery processes, SMS channels, and user click behaviors are common bypass routes for attackers. Traditional two-factor authentication can significantly raise the cost of direct logins, but if users actively input one-time verification codes on a spoofed page, attackers can still proxy the session in real-time. Security keys bind authentication to devices and domains, reducing the space for credentials to be reused by phishing sites.
Essentially, this is about the transfer of pricing power: when social accounts carry payments, media distribution, and brand trust, the platform's account recovery mechanism becomes part of the financial infrastructure. In the past, the mass sending of reset emails was mainly an issue of experience and spam; when accounts can influence token prices, release corporate announcements, or connect payment functions, the security level of the recovery chain will determine who bears the cost of fraud. If the platform cannot layer convenience and verification strength, high-value users will have to shift their security investments to independent emails, hardware keys, and institutional permission systems.
ABAB News · Cognitive Laws
The weakest entry point of an account is often not the login page.
Value enters social platforms, and attackers will follow.
Two-factor authentication protects logins, but the recovery process determines the bottom line.