X Says Attackers Are Targeting User Accounts After the Launch of X Money

For years, losing a social media account meant losing access to your posts, followers and messages.

Add payments, and the stakes change.

Shortly after X Money became widely available, X users began reporting waves of unsolicited password-reset emails. X says attackers appear to believe the arrival of its payments service makes those accounts worth targeting. So far, the company says it has found no evidence that the attempts resulted in successful breaches.

The interesting part isn't that attackers target money. Of course they do.

It's what happens when your social identity, audience and financial activity increasingly live behind the same platform login.

X Accounts Just Became More Valuable

TechCrunch reports that X is investigating the password-reset attempts after numerous users complained about receiving unsolicited reset emails. X product engineer Mridul Singhai said attackers appear to believe they can gain unauthorized access now that X Money is widely available.

At the time of the report, X said it had found no evidence of breaches. Users were being encouraged to enable two-factor authentication, while X's Grok chatbot described the activity as attackers "mass-triggering" password-reset forms using public usernames.

That's an important distinction. There is currently no basis for saying X Money was hacked or that users' financial accounts were compromised.

What appears to have changed is the incentive.

An X account has always had value. It can represent years of posts, private messages, relationships, reputation and access to an audience. For creators and public figures, an account with a large following can itself be a significant business asset.

Connect that account to financial services and its potential value to an attacker increases.

The Everything App Creates an Everything Account

X has spent years moving toward Elon Musk's vision of an "everything app." Payments are an important part of that strategy.

X Money includes a bank card and other financial functionality, while TechCrunch notes that the service could make it easier for creators to collect payments directly through X. For creators already using the platform to publish content, communicate with fans and build audiences, that can be extremely convenient.

But convenience and concentration tend to arrive together.

The same account can increasingly represent your public identity, publishing history, audience, private communications and commercial activity. Instead of maintaining several independent relationships with different systems, more of your digital life becomes accessible through one set of credentials.

That doesn't make the model inherently bad. Integrated products are popular precisely because people don't want to assemble ten different services to accomplish one thing.

It does mean the consequences of losing control of that account become larger.

Creators Have More to Lose Than a Password

For a casual user, an account takeover is disruptive.

For a creator running a business through that account, it can be existential.

Imagine a creator who spends five years building an audience on a social platform. Their followers are there. Their messages are there. Their publishing history is there. Their reputation is represented there. Then payments and financial services are added to the same environment.

The creator hasn't simply connected another feature.

They've concentrated more of their business around an identity controlled by the platform.

That distinction is easy to ignore while everything works. It becomes painfully obvious when an account is suspended, compromised, impersonated or otherwise inaccessible.

The password isn't necessarily the most valuable thing being protected.

The relationship behind it is.

Your Account Is Not Your Identity

There's a strange assumption embedded throughout the modern internet: that an account represents the person who owns it.

Most of the time that's perfectly practical. @username becomes you.

But technically, the platform owns the account system. It decides how identity is represented, how access is authenticated, what happens when credentials are lost and what evidence is required to recover an account.

The creator controls access to an account inside that system.

Those aren't quite the same thing.

This distinction becomes more important as platforms expand beyond publishing. A social profile can become a storefront, customer database, messaging system, payment endpoint and eventually something resembling a financial account.

At that point, "don't lose your social account" starts carrying considerably more weight.

Payments Change the Threat Model

The attacks reported around X Money demonstrate a basic principle of security: attackers follow value.

If compromising an account lets someone send spam, that's one incentive.

If compromising it gives access to a valuable audience, that's another.

If that identity is also connected to payments or other financial capabilities, the potential reward increases again.

This doesn't mean combining social media and payments can't be done securely. Banks, marketplaces and financial technology companies have spent decades building systems around valuable accounts.

It means creators should think carefully about what they're actually consolidating.

Security isn't only a question of whether a platform has good authentication.

It's also a question of how much of your digital business depends upon that authentication succeeding.

Creator Infrastructure Can Start Somewhere Else

Certifyd approaches that problem from a different direction.

The goal isn't to eliminate platforms. X can be useful for communication and discovery. YouTube can be useful for video. Streaming services can be useful for music distribution. Marketplaces can be useful for commerce.

The architectural question is whether any one of those accounts needs to become the authoritative home of the creator themselves.

Certifyd Core allows creator identity, works, release records, provenance and commerce to originate from infrastructure operated by the creator. Those records can then participate in other services rather than existing exclusively because an external platform created an account for them.

That changes the relationship.

The platform becomes somewhere the creator goes rather than the place where the creator exists.

Payments make that distinction especially interesting. If creators increasingly earn money through the same platforms where they build their audiences, the temptation will be to allow identity, distribution, relationships and commerce to collapse into one convenient account.

Convenience has real value.

So does independence.

X Money Isn't the Problem

None of this is an argument against X Money.

Giving creators additional ways to get paid is useful. Integrating payments with communication can remove friction. If X successfully builds a large financial network around its social graph, creators could find genuinely interesting ways to use it.

The password-reset campaign doesn't prove otherwise. X says it has found no evidence of successful breaches, and attempts to compromise accounts are an unfortunate reality for virtually every large online service.

The incident is interesting because it reveals how the value of an account changes when new capabilities are attached to it.

Yesterday, an attacker might have wanted your X account because it had 100,000 followers.

Tomorrow, that same account could represent your audience, reputation, communications and financial activity.

The more valuable the account becomes, the more important it becomes to understand what you actually own.

Build on Platforms. Don't Become Dependent on One.

Creators shouldn't abandon platforms. They should use them aggressively.

Go where the audience is. Publish where discovery happens. Use useful payment systems. Participate in communities. Take advantage of distribution that would be impossible to build independently.

But there is a difference between using platforms to build a business and allowing one platform account to become the business.

The arrival of X Money makes that distinction easier to see.

Social networks are no longer competing merely to host our posts. They're increasingly competing to host our identities, audiences, communications, commerce and money.

That can create extraordinarily useful products.

It can also create extraordinarily valuable accounts to attack.

For creators, the long-term answer isn't necessarily to avoid those systems.

It's to make sure your entire digital existence doesn't begin and end with somebody else's login screen.

Source

TechCrunch, September 1, 2026: "X says attackers are targeting user accounts after the launch of X Money"