X users report being subjected to X Money's proactive payment "financial DDoS"

Multiple X users claim to have received unsolicited X Money transfers, with single or cumulative amounts reaching tens of thousands of dollars, notifications flooded, and they describe it as a "financial DDoS". Public discussions point to a peer-to-peer channel that allows payments to any verified username, as well as third-party services that convert token transaction fees to USD directed at a specific username; recipients can accept or reject, with unclaimed funds returned after about 14 days. After completing identity verification, no upper limit on amounts was noted in the public descriptions.

X Money has opened up more broadly to U.S. Premium and Premium+ users, providing accounts, peer-to-peer payments, and branded debit card capabilities through Cross River Bank, with deposits going through that bank rather than X's own banking license. This round of discussions is not the same mechanism as the wave of password reset emails in early September: at that time, product engineers stated that attackers triggered recovery in bulk using public usernames, and the company claimed no breaches were found; this round involves the payment notifications themselves becoming the load. The platform has not issued a corresponding official characterization regarding the "tens of thousands of dollars in proactive payments".

The sender consumes USD or transaction fees from verified accounts, while the recipient deals with notifications, tax implications, and the decision to accept. Funds remain in the channel for about a two-week window; if accepted, they are credited, if rejected or expired, they are returned. Beneficiaries are senders who can exchange payments for attention or increase their visibility; those under pressure are the notification system and recipients who must assess the nature of incoming funds. The driving event is the product allowing unlimited peer-to-peer payments to public usernames, not a confirmed system being breached.

Source: Public information