X (Twitter) experienced a major password reset attack on Monday, with users receiving multiple unsolicited emails from the platform. According to reports from X, one user's inbox received eight emails in three minutes, all appearing legitimate as they came directly from X itself. The latest wave of attacks saw users receiving as many as 10 notifications within minutes, with screenshots shared online showing inboxes filled with repeated "Password reset request" alerts arriving just seconds apart. The company has confirmed that the emails are real but emphasized they were not sent in response to any user requests, with attackers instead exploiting X's own recovery form system. As reported by BeInCrypto, the attackers are pointing X's own recovery form at public usernames, over and over, creating a systematic attack on the platform's recovery system.
X addressed the incident through Mridul Singhai, a product engineer at the company, who provided a detailed response to users. As reported by X, Singhai stated that attackers appear to believe they can gain unauthorized access to accounts now that XMoney is widely available. The company emphasized that it has found no evidence of any breaches and is actively investigating the issue. Singhai addressed the surge in a post on the platform, saying "We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience." According to BeInCrypto, this was the company's only official response, with the main X account, X Support, and X Money all remaining silent during the incident. The company has not disclosed who may be responsible for the requests, how many accounts received them, or whether the activity came from an automated campaign.
The timing of the attack coincides with the recent expansion of XMoney's peer-to-peer payments feature for US Premium subscribers, which was made available to Premium and Premium+ subscribers with US accounts in recent weeks. According to X, deposits for XMoney are held at Cross River Bank with federal insurance of up to $10 million. This integration means that X login credentials now provide access to banking services, potentially increasing the value of stolen accounts for attackers. As reported by BeInCrypto, a stolen profile can promote a fake token, and a stolen wallet can be emptied, changing the mathematical value of compromised accounts significantly. The X Money service includes deposit accounts, instant transfers, and a Visa debit card with annual yields of up to 6% for eligible X Card purchases.
X has implemented existing security features that users can activate to prevent similar attacks. As reported by X, the platform's help pages instruct users receiving unsolicited resets to turn on password reset protection, which requires verification through email or phone on file before processing any requests. Additional security measures include using authenticator apps instead of text messages and adding passkeys that tie login to specific devices. Cybersecurity commentators, including several verified accounts, have urged users to enable two-factor authentication and turn on X's "password reset protect" feature. X specifically advises users to check that login pages use the x.com domain and avoid clicking links from unexpected emails. Users who received repeated password reset requests have been advised to review their account security settings as a precaution.
This incident represents a different type of attack compared to X's previous security breach in July 2020, when internal staff were compromised and 130 accounts were forced to reset with $118,000 in Bitcoin stolen. According to X, the current attackers are operating externally using public recovery forms rather than exploiting internal systems. The episode has brought back concerns about X's security, with users pointing to previous large-scale data exposures involving the platform. Security researchers and users online speculated that the reset attempts may have been mass-triggered using publicly available usernames rather than through any direct compromise of X's systems, though this has not been independently verified. As reported by BeInCrypto, attacks like this usually run on old email lists that circulate on criminal markets for years, but X's recovery form accepts usernames on their own, making public usernames the primary opening for these systematic attacks.
