X Probes Password-Reset Wave Following X Money Availability

X is investigating a wave of unsolicited password-reset emails reported by users after X Money became widely available. Product engineer Mridul Singhai said attackers appear to believe they can gain unauthorised access to accounts now that the payments service has launched, while stressing that the company has found no evidence of breaches.

The company apologised for the multiple emails and said it was actively examining the reports. X had not published details through one of its official company accounts at the time described in the report, and it had not responded to a press inquiry.

Reset requests appear to be triggered with public usernames

Singhai characterised the activity as mass password-reset attempts rather than confirmed intrusions. X’s chatbot Grok gave a more specific description in replies to users, saying attackers were “mass-triggering” the password-reset form using public usernames.

Grok also said there was no confirmed system breach or mass account takeover. That distinction matters: a password-reset email can indicate that a reset workflow was initiated for an account, but X has not said that attackers completed resets or obtained access to affected accounts.

X Money raises the stakes for account protection

X Money is the platform’s newly launched payments service. It includes a bank card and other benefits, and X sees it as a way to make it easier for creators to collect payments on the platform and support its digital economy.

The arrival of a service that handles payments can increase the appeal of user accounts to criminals. X has said that this apparent interest is the context for the current activity, but it has not attributed the attempts to a particular group or disclosed further technical details about the investigation.

Steps users can take while the investigation continues

Users have been advising one another to enable two-factor authentication. Grok also pointed users to X security settings and referenced Password Reset Protect as an available safeguard.

X general counsel James Burnham said the company’s legal and security teams would seek to identify and hold accountable anyone attempting to victimise platform users. For businesses and creators using X, the immediate implication is to review account recovery and two-factor authentication settings directly within the service, while treating unexpected reset emails as alerts rather than proof of a successful compromise.