If you haven’t been closely following X, you might not know that Elon Musk recently introduced X Money, a platform for financial services that he first envisioned when acquiring the X.com domain back in 1999. However, right after it launched, users experienced some troubling security issues as hackers attempted to exploit vulnerabilities.
X Money operates under Musk’s expanding brand, X Corp. It’s not officially a bank in the traditional sense, but it does provide various financial services typically found at banks. Users can access high-yield accounts offering up to 6.00% APY, which is considerably higher than the national average of 0.62% APY. There’s also the X Card debit card, giving a 3% cash back on qualifying purchases and early access to direct deposit funds.
The attackers aimed to reset user passwords to gain access to their X account funds.
The X Money website promotes its strong security measures, yet these assurances were recently tested when hackers targeted new users of the platform.
The situation escalated when some users received unexpected password reset requests for their X accounts. The attackers’ goal was clear: to reset passwords and access accounts to steal funds. As noted in a response from Grok, hackers flooded the password reset feature with requests, putting in users’ public X usernames.
Some users did receive emails asking for password changes, causing confusion but also leading to concerns about account security.
X’s product engineer, Mridul Singhai, addressed the issue, reassuring users that, while they were investigating the matter, there was no current evidence of a broader attack. He stated, “We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this.”
Put simply, the hacking attempts don’t seem to stem from any sort of data breach or security flaw in the system itself. Instead, scammers are targeting those who are believed to have X Money accounts and are exploiting the password reset tool to try to take control.
Regarding how the hackers identified their targets, it’s worth noting that there isn’t a specific identifier to differentiate X Money customers from standard X users. However, since X recently transferred its creator payment program from Stripe to X Money, accounts with a “Subscribe” button might be particularly vulnerable.
For users of X Money or just X in general, maintaining security in your profile is really pretty straightforward. X has several security features you can activate, and honestly, it’s wise to do so even if you don’t think you’re at risk.
To beef up your security, open the X app, tap on your profile picture at the top left, and navigate to “Settings and privacy” at the bottom. Then go to “Security and account access,” and select “Security.” This area presents various options. At the minimum, setting up Passkeys is highly recommended, but enabling all of these features is beneficial.
Two-factor authentication is particularly important, as it requires a secondary form of verification—something you have access to—in order to log in. This could be a text sent to your phone, a temporary code via an authentication app, or even a physical security key. Personally, I think the authentication app is an excellent choice, but you should select the method that suits you best.
Password reset protection ensures that a person needs to know both your email address and username to reset your password, which is crucial since your email isn’t public on your profile. This should keep your information safer.
Lastly, using Passkeys introduces a biometric layer to the login processes. Instead of the usual login information, you may verify identity with a FaceID scan or your fingerprint. It’s the most secure option available, since only you have access to your unique biometric data.
Once all these measures are in place, your X account will be much safer from any unauthorized access attempts.
