Crypto Community at the Center of the Reset Wave
Numerous X users have reported receiving an unusually high volume of password reset emails over a short period. Individual accounts received up to 10 separate reset requests within just a few hours. The spike has disproportionately affected prominent cryptocurrency figures and projects, given that X serves as a primary hub for trading announcements, market analysis, and breaking news in the digital asset space.
Crypto analyst Nic Carter highlighted the issue on Tuesday, noting that a significant number of people were targeted and recommending that users activate X’s Password Reset Protect feature. Another user reported persistent and aggressive reset attempts despite having two-factor authentication enabled on their account.
How the Attack Vector Works
Under X’s current security framework, a password reset can be initiated using only a public username. Once triggered, X sends the reset link to the email address linked to the account. The Password Reset Protect setting adds an additional verification layer by requiring the requester to confirm the account’s associated email address or phone number before proceeding.
Several editorial staff members at a leading crypto-focused publication also confirmed receiving similar emails on Tuesday, including individuals whose X-associated email addresses were not publicly well known. This suggests that attackers may have obtained email data through means other than public exposure.
No Confirmed Breach — But History Raises Concerns
As of now, there is no verified evidence that X’s systems have been compromised or that any widespread account takeovers have succeeded. The platform has not issued a public statement regarding the reset attempts, nor has it acknowledged any coordinated security incident.
However, X has a documented history of significant data exposures. In 2021, attackers exploited an API vulnerability that tied users’ email addresses and phone numbers to their accounts. Data linked to over 200 million accounts subsequently appeared on darkweb forums in 2023. There is currently no evidence connecting this latest wave of reset attempts to that earlier breach, but the precedent leaves many users wary.
How to Protect Your Account
- Enable X’s Password Reset Protect feature in your security settings to add an extra verification step.
- Review account activity and recent password reset requests under Security and Account Access.
- Ensure two-factor authentication is active and consider using a hardware security key for added protection.
- Monitor your email inbox for unexpected reset notices and report suspicious activity to X support.
Until X provides an official explanation, users in the crypto ecosystem — and beyond — are advised to take proactive security measures to safeguard their accounts from potential unauthorized access.
