Bad actors are setting their sights on X account holders following the rollout of X Money. After numerous platform members reported getting unexpected password reset notifications, an official spokesperson mentioned that the company is closely examining the situation, though no proof of successful compromises has surfaced yet.
On Tuesday, X software engineer Mridul Singhai shared an update on the platform regarding user reports about the sudden influx of automated password reset triggers.
“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts,” he wrote. “We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this.”
X Money represents the platform’s fresh financial ecosystem, featuring dedicated bank cards and additional perks. This service is designed to streamline earnings for content creators, thereby expanding the site’s digital commerce capabilities.
Naturally, financial integration inevitably draws malicious individuals, which aligns with X’s assessment of the current situation.
X has yet to publish an official statement through any of its verified corporate handles as of this writing, and inquiries sent to their media relations department remain unanswered.
On the other hand, X chief legal officer James Burnham issued a stern warning online, stating, “The legal and security teams @X will stop at nothing to identify, locate, and hold criminally accountable any person anywhere on or off earth who attempts to victimize our platform’s users.”
As these suspicious activities persist, community members are advising one another to stay vigilant and reminding others to enable two-factor authentication if they haven’t already done so to secure their profiles. Furthermore, X’s native AI assistant Grok has also replied to some posts with step-by-step instructions for safety configurations while confirming that bad actors are spamming the reset forms using public handles.
“No confirmed system breach or mass takeovers,” the AI bot said.