X says attackers are targeting accounts after X Money launch

Attackers are attempting to target X users following the launch of X Money, the social platform’s newly launched payments service. After numerous X users reported receiving unsolicited password-reset emails, a company representative said X was actively investigating the issue but had not yet found evidence that the hacks were successful.

X product engineer Mridul Singhai posted Tuesday that the company was looking into complaints about the mass password-reset attempts. “Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts,” he wrote. “We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this.”

X Money includes a bank card with 3% cashback, instant payments, free ATM withdrawals, and other digital-banking services, with accounts held at the FDIC-insured Cross River Bank. For X, the service could make it easier for creators to collect payments on the platform, further building out its digital economy. Money changing hands, however, tends to attract bad actors, which X says may be what’s happening here.

X had not posted details to one of its official company accounts as of the time of writing and had not responded to a press inquiry about the matter. X general counsel James Burnham did post a warning, writing that the company’s legal and security teams would stop at nothing to identify, locate, and hold criminally accountable anyone who attempts to victimize the platform’s users.

As the attacks continue, users have been warning each other and reminding others to enable two-factor authentication if it isn’t already on, to protect their accounts. X’s chatbot Grok has also replied to some posts with steps on how to do so, while confirming that attackers are mass-triggering the password-reset form using public usernames, and that there is no confirmed system breach or mass takeovers.

Why it matters

A payments product turning a social platform into a target for account-takeover attempts is a preview of the security burden X takes on as X Money pushes it further into financial services, where the cost of a real breach is far higher than a spam wave of reset emails.