Analysis
X said on Sept. 1 that attackers were mass-triggering password reset forms against accounts using publicly visible usernames, a wave that began as X Money reached wide availability, TechCrunch reported. X product engineer Mridul Singhai said attackers "appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts." The company found no evidence of any breaches and no confirmed takeovers. General counsel James Burnham threatened legal action.
The mechanics matter for anyone shipping payments on top of a social graph. X Money adds a bank card and payment collection for creators to a platform where the primary identifier -- the handle -- is public by design and permanent. That makes credential-stuffing and reset-flow abuse cheap: the attacker does not need to discover targets, only to enumerate them. Every social platform that has added money on top of public identity has faced the same first week. Cash App, Venmo and Telegram wallets all did. Pulse has previously covered X as it has pushed further into ad and now payments products.
X's recommended mitigations are two-factor authentication and Password Reset Protect, a setting buried in Settings and privacy under Security. Both are opt-in. That is the structural problem: the account population most attractive to attackers -- high-follower creators now holding a balance -- overlaps only partially with the population that has enabled hardware-backed 2FA. Platforms that have solved this, notably Coinbase and Stripe-hosted checkouts, made step-up authentication mandatory at the moment money is added rather than optional at signup.
“X is running this launch with a security team that has been repeatedly reduced since 2022, which is the resource constraint underneath the incident.”
The absence of confirmed compromise is genuine and worth stating plainly. This is a story about attempted attacks and about attacker intent, not about a breach. What it demonstrates is that the threat model changed the day the product shipped, and that the defenses on offer are the same ones X had before there was money in the account.
The regulatory dimension is not trivial either. A payments product with a stored balance pulls X into money transmitter licensing state by state, and state regulators examine account takeover controls as part of that supervision. A publicized wave of reset abuse in the launch window creates an examination record before the product has scale. Cash App's parent Block spent years and a consent order working through similar scrutiny; PayPal and Venmo built dedicated account-integrity organizations for the same reason. X is running this launch with a security team that has been repeatedly reduced since 2022, which is the resource constraint underneath the incident.
For fintech founders the transferable lesson is sequencing: mandatory step-up authentication should ship before the balance does, not as an advisory afterward. Retrofitting it onto an existing account base is a support burden every consumer fintech underestimates, and X now has to do it live.
