On September 1, thousands of X users reported receiving unsolicited password reset emails, including accounts of prominent crypto industry figures and CoinDesk employees. Some users received up to 10 such emails within hours, raising concerns about potential account takeover attacks or data breaches.
User Reactions and Advice
Crypto investor Nic Carter noted that a large number of users are receiving X password reset requests and recommended enabling the platform's "Password Reset Protect" feature. Another user, cap.eth, said that even with two-factor authentication enabled, someone was "actively" trying to reset his password.
Security Mechanism and Current Status
There is currently no evidence that X's system has been compromised or that a large-scale account takeover has occurred. X's security mechanism allows an attacker to initiate a password reset request using only a public username; X then sends a reset email to the linked address. Receiving such an email does not necessarily mean the user's email address has been leaked. X has not yet publicly responded to the abnormal password reset requests or confirmed any coordinated attack or security incident. Industry insiders advise users to check their account security settings and enable the password reset protection feature.