X has begun investigating a wave of unsolicited password-reset emails and confirmation codes, although its initial review has found no evidence that the platform’s systems were breached.
Summary
- X users reported receiving password-reset messages they had not requested.
- The company has found no evidence of a breach during its initial investigation.
- X advised users to enable two-factor authentication and Password reset protection.
- The email wave coincided with X Money’s expansion to eligible U.S. subscribers.
X finds no breach in initial password-reset review
X Product Engineering team member Mridul Singhai said Tuesday that the company was examining reports from users who received unexpected password-reset emails and codes. According to Singhai, X had not identified a compromise of its internal systems at the time of his statement.
Several account holders said the messages arrived without any attempt on their part to change their login details. Some users also reported receiving several reset requests, raising questions about whether unknown parties were trying to take control of their accounts.
An unsolicited reset message does not by itself show that an account password has been exposed or that someone has gained access. X allows a person to start the recovery process by entering an account username, email address, or phone number, after which the platform sends a confirmation code to the registered contact method.
Even so, users should not share a reset code or approve a password change they did not request. Singhai advised account holders to enable two-factor authentication and avoid opening links sent through unexpected emails.
He also said attackers appeared to believe that increased access to X Money could make control of X accounts more valuable. The company has not disclosed who may be responsible for the requests, how many accounts received them, or whether the activity came from an automated campaign.
X security settings can restrict reset requests
Under X’s published account security guidance, users can turn on Password reset protection from the Security section of their account settings. Once enabled, the feature requires additional identifying information before X sends a password-reset link or confirmation code.
Depending on the information connected to an account, a user may need to provide an email address, phone number, or both. Requiring those details can make it harder for an unknown party to trigger repeated reset requests using only a public username.
Two-factor authentication adds another check during login. X currently supports text messages, authentication applications, and physical security keys, although the available methods can depend on the account type and subscription status.
According to the platform’s password recovery instructions, reset codes sent by email remain valid for 60 minutes. Completing a password reset logs the account out of all active X sessions, while changing a password from an existing session leaves the session used for the change active.
X specifically advises people who repeatedly receive reset emails they did not request to enable both Password reset protection and two-factor authentication. Its security page also tells users to check that a login page uses the x.com domain before entering account credentials.
Rather than following an email link, account holders can open the X application or type the platform’s address directly into a browser to review their settings. X says its legitimate emails come from addresses ending in @x.com or @e.x.com, do not include attachments, and never ask recipients to provide their password by email, direct message, or reply.
Anyone who entered credentials into an unfamiliar website should change the password through X, secure the email address linked to the account, and remove access for unrecognized third-party applications, according to the company’s guidance. A new password should also be different from credentials used on other services.
X Money expands access across the United States
The reset-email reports emerged as X expanded X Money to Premium and Premium+ subscribers with U.S. accounts. The service lets eligible users send money to one another without leaving the social platform and relies on Cross River Bank for its banking infrastructure.
As crypto.news previously reported, the X Money launch includes deposit accounts, instant transfers, and a Visa debit card. The service also offers annual yields of up to 6%, while eligible X Card purchases can earn 3% cash back.
Cross River holds customer deposits and connects X Money to the banking networks used for transfers. Deposits held directly at a Federal Deposit Insurance Corporation member bank can qualify for standard FDIC insurance of up to $250,000, subject to the agency’s rules.
X Money also uses a cash sweep program that places funds across participating insured banks. Eligible customers may receive aggregate pass-through FDIC coverage of up to $10 million, although X Payments is not a bank or an FDIC-insured institution.
The payment service uses passkeys for authentication and gives customers tools to set transaction limits and extra approval requirements. Visa provides security and risk-management measures for purchases made through the X Card.
Initial access had been limited to selected Premium+ users when the payment service began using Cross River’s infrastructure in June. X later added Premium subscribers as it expanded availability across the United States.
Despite Cross River’s past work with Ripple, neither X nor the bank has announced support for XRP or another cryptocurrency within X Money. The current service moves U.S. dollars through conventional banking and card networks.
X has also considered stablecoin creator payments
X’s financial plans extend beyond transfers between users. In August, the company was considering USDC payments and other stablecoins as possible options for creator rewards, according to a person familiar with the discussions.
No token, blockchain network, or launch date had been selected at the time of that report. X also had not disclosed whether creators would receive stablecoins automatically or choose them as an alternative to bank payments.
The discussions came ahead of the platform’s planned replacement of its Revenue Sharing program with Original Content Rewards on Sept. 8. Under X’s announced eligibility rules, creators need at least 500 verified followers and 500,000 Home Timeline impressions from verified users during the previous 90 days.
X has not confirmed that digital assets will be added to X Money. The platform’s payment service currently remains limited to eligible U.S. subscribers, and the company has not provided a timetable for access by free accounts or users outside the country.
