Following the launch of its new payments service X Money, the social media platform X is experiencing a surge in attackers targeting user accounts. Many users reported receiving unsolicited password reset emails, prompting X to initiate an investigation. Mridul Singhai, a product engineer at X, acknowledged these password reset attempts on social media, noting that while attackers seem to be trying to exploit the rollout of X Money to gain unauthorized access, no breaches have been confirmed so far. The company apologizes for the inconvenience caused by the multiple emails and is working to resolve the issue.

X Money is a newly introduced feature on the platform designed to facilitate payments for creators by offering a bank card and other benefits. The service represents a step toward building a more robust digital economy within X. However, the introduction of financial transactions on the site appears to have attracted malicious actors seeking to exploit the system by targeting account credentials and initiating resets en masse. This has led to a wave of user complaints and increased warnings across the community.

X’s general counsel, James Burnham, has issued a strong statement emphasizing that the platform’s legal and security teams are fully committed to identifying and prosecuting those responsible for these attacks. Users have been advised to enable two-factor authentication (2FA) to enhance their account security. The company’s AI chatbot, Grok, has also been actively responding to user posts, explaining how to activate additional security measures and confirming that the attackers are triggering password reset forms using publicly available usernames, though no systemic breach has been found.

At the time of reporting, X has not yet released official details about the ongoing investigation through its corporate accounts. Meanwhile, users continue to alert one another about the situation and the importance of using protective features like 2FA. Despite these attempts, the social media company is maintaining that it has not detected any confirmed large-scale account takeovers or breaches tied to the password reset spam, underscoring the situation as a preventative security challenge in the wake of the X Money launch.