X Says Attackers Are Targeting Accounts After X Money Launch

X is investigating a wave of unsolicited password reset emails after X Money became available to Premium and Premium+ subscribers with US accounts.

Some users reported receiving as many as 10 reset messages within a few hours. X said it has found no evidence of a breach or widespread account takeover.

Good to Know

• The password reset emails are being generated through X systems.
• X Money is now widely available to eligible US Premium and Premium+ accounts.
• Users can reduce account recovery risk by enabling Password Reset Protect and two factor authentication.

X Money Rollout Draws Account Access Attempts

X product engineer Mridul Singhai said attackers appear to be targeting accounts following the wider rollout of X Money.

“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts.

We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience.”

Reports indicate that repeated requests are being submitted through the public account recovery process, triggering legitimate X emails even when account owners did not request a password change. Receiving one of these messages does not by itself mean an account has been compromised.

The timing has raised additional concern because X Money adds payment functionality directly to X accounts. The service allows eligible users to send money through infrastructure supplied by Cross River Bank.

X Money expanded to all eligible Premium and Premium+ subscribers with US accounts at the end of August after an earlier limited rollout.

X Recommends Extra Account Protection

Password Reset Protect requires additional account information before X sends a reset link or confirmation code. The feature works separately from two factor authentication, so users can enable both protections.

Users receiving unexpected reset emails should avoid opening links inside the messages and instead access X directly through the website or app.

X continues to investigate the activity, with no widespread successful account breaches confirmed as of September 2.