Musk’s X hit by wave of unsolicited password reset emails

Thousands of X users are reporting a wave of unsolicited password reset emails, including several prominent crypto accounts, raising concerns about an attempted account-takeover campaign or possible leak. Individual users received as many as 10 emails within a few hours.

X has an outsized role in the crypto industry, as traders, projects and executives use it as a primary channel for announcements, market commentary, niche trading ideas and breaking news.

Crypto investor Nic Carter said Tuesday that “a lot of people” were receiving unsolicited reset attempts and urged users to switch on X’s Password Reset Protect feature. Another crypto user, cap.eth, said someone had been “aggressively” attempting to reset his password despite having two-factor authentication enabled.

At least four CoinDesk staffers separately said they received similar emails Tuesday, including two whose email addresses associated with X were not widely used.

That does not necessarily mean attackers have obtained users’ email addresses.

X’s Security terms allow a password reset request to be initiated using a public username, after which X itself sends the reset message to the email address attached to the account. Its Password Reset Protect setting adds another step by requiring the person requesting a reset to confirm the account’s email address or phone number.

There is so far no confirmed evidence of a breach of X’s systems or widespread account takeovers. The company has not publicly commented on the reset attempts, nor has identified any coordinated campaign or security incident.