Thousands of X users have reported receiving password reset emails that were not initiated by them, with some receiving up to 10 emails within a few hours; affected users include multiple accounts in the crypto industry and at least 4 CoinDesk employees.

The emails are confirmed to have been sent by X's official system, not by verified spoof emails. Attackers can repeatedly invoke the account recovery process using only publicly available usernames, triggering the platform to send reset links to the associated email; therefore, receiving a reset email does not prove that the attacker has access to the email address, the original password, or has gained control of the account.

Crypto investor Nic Carter noted that many users are experiencing unsolicited reset attempts and suggested enabling "Password Reset Protect." When this option is activated, the password recovery process will no longer accept just the username, requiring the submission of the associated email address or phone number, thus raising the threshold for triggering reset emails using public usernames.

User cap.eth stated that even with two-factor authentication enabled, there are still attempts to reset their password. Two-factor authentication primarily protects logins or critical operations, while the password recovery process remains a separate attack surface; if an attacker can trick a user into clicking a fake reset link, intercepting an SMS verification code, or controlling the associated email, 2FA does not automatically eliminate the risks of social engineering and recovery processes.

X product engineer Mridul Singhai stated that the company is investigating the matter and has not found evidence of a system breach; he indicated that attackers may believe that taking over accounts after the broad opening of X Money would yield higher economic value. The main account, X Support, and X Money accounts have not yet released a complete incident report, and the platform has not confirmed the existence of coordinated attacks or data breaches.

Users can enable Password Reset Protect in "Settings & Privacy - Security and Account Access - Security" and use an authenticator app or security key instead of SMS verification codes, while also checking active sessions and login records for the associated email. Users should not click on abnormal emails, private messages, or reset links in pop-ups; they should directly access the official X app or manually enter the official domain to complete security settings.

In market mechanisms, the value of X accounts to crypto projects, media, traders, and KOLs comes from instant dissemination, brand reputation, and the potential link to X Money payment gateways; attackers will prioritize targeting high-value accounts that have followers, influence market information flow, or may access commercial accounts. Beneficiaries are institutional accounts with security keys, independent secure emails, and strict permission management; those under pressure are individuals and teams that reuse passwords, rely on SMS verification, and use social media accounts as their only announcement channels for projects.

Source: Public Information