Hackers exploit X Money password reset, prompting security warnings for users

X Money, the new financial platform under X Corp, offers high-yield savings, a cash-back debit card and early-payday direct deposit support, but soon after its launch users received unexpected password-reset emails. Hackers typed publicly visible X usernames into the "forgot password?" tool, hoping to take control of accounts and any linked funds. Product engineer Mridul Singhai confirmed the company is actively investigating and has found no evidence of a systemic breach.

The attacks seem to focus on accounts likely to hold X Money balances, especially those with a "Subscribe" button after creator payouts shifted from Stripe to the platform. X recommends users enable security options such as passkeys, two-factor authentication and password-reset protection to block further attempts.