Widespread Password Reset Emails Hit X Platform, Crypto Accounts Targeted

On September 1st, a wave of unsolicited password reset emails swept across social media platform X, affecting thousands of users. Notably, numerous high-profile accounts within the cryptocurrency sector, including employees of CoinDesk, reported receiving these requests. Some individuals received up to ten such emails within hours, sparking immediate concerns about potential account takeover attacks or data breaches.

User Reports: Even 2FA Accounts Under Pressure

Crypto investor Nic Carter was among the first to flag the issue, noting the scale of the problem and advising users to enable X's "Password Reset Protect" feature without delay. Another user, cap.eth, shared a more concerning detail: despite having two-factor authentication (2FA) active on their account, they could see active attempts to reset their password were still being made.

Official Silence and a Potential Flaw in the System

X has not yet issued an official public statement regarding the incident, nor has it confirmed any coordinated attack campaign. Security analysts point out that X's current security design allows a password reset request to be initiated using only a publicly visible username. The platform then sends a reset email to the account's linked address. This means receiving the email does not necessarily confirm that your email address has been compromised, but it highlights a possible vulnerability in the process itself.

Your Immediate Action Checklist

In light of these events, taking proactive steps is crucial. Here is what security professionals recommend:

  • Review Your Account Security Settings Now: Log into your X account and scrutinize all active sessions and connected devices.
  • Enable Password Reset Protection: Locate and activate this specific setting in your account preferences to add an essential layer of verification.
  • Stay Vigilant with Links: Avoid clicking on any reset links within suspicious emails. Always navigate directly to the official X website or app to manage your account.

This incident serves as another stark reminder of the importance of proactive account security in an era where digital presence and assets are increasingly intertwined.