- X product engineer Mridul Singhai said on Sept. 1 the company is investigating a wave of unsolicited password-reset emails and verification codes, and has “found no evidence of any breaches”.
- Singhai tied the activity to attackers testing accounts now that X Money is widely available; the payments service reached US Premium and Premium+ subscribers on July 27.
- Advice circulating among users and through X’s Grok assistant urged enabling two-factor authentication, switching on X’s “Password reset protect” setting and not clicking links in the emails.
Password-reset emails and verification codes that users never requested hit X in bulk around Sept. 1. This comes weeks after opening its X Money payments service to more US customers.
“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts”, Mridul Singhai, a product engineer at X, posted on Sept. 1. “We are actively investigating the issue and, so far, have found no evidence of any breaches.”
The emails came from X’s own password-reset system, which fires whenever someone requests a reset for an account.
Attackers were feeding public usernames into that form in bulk, according to X, not exploiting stolen data. The messages had been arriving for weeks before the Sept. 1 spike, and X has not said how many accounts were hit.
Read more: Michael Saylor Signals Strategy Is ‘Back’ to Bitcoin Buying
Targeted Accounts
X opened X Money to US Premium and Premium+ subscribers on July 27, its first broad consumer launch after a June test, and limited to select users 18 or older.
The service, built as a Venmo-style payments app, lets users hold deposits, send peer-to-peer payments, pay bills and send wires, with balances held at Cross River Bank and insured by the FDIC up to US$250,000 (AU$350,000).
It also offers a Visa debit card, cash back on purchases and, for Premium+ subscribers, deposit coverage of up to US$10 million (AU$14 million) spread across partner banks.
That attached a bank balance to users’ X handles, part of Elon Musk’s plan to turn X into an “everything app” combining social media and financial services.
US Senator Elizabeth Warren had already pressed Musk on the risks of X Money before its launch, warning that folding payments and crypto into the app could threaten financial stability and national security.
Read more: Bitcoin Eyes $81K Mark While ETF Flows Slow Down
X,X money#Investigates #Suspicious #PasswordReset #Wave #Money #Rollout1788341292
