X Money Made X Accounts Look Like Bank Accounts, Then the Password Reset Emails Started

X users were hit by a wave of unsolicited password‑reset emails on Tuesday, with some reporting multiple alerts within minutes, shortly after the wider US rollout of X Money on 27 July 2026.

A large number of users, including prominent crypto accounts, reported receiving the emails. Some said they received as many as 10 messages within a few hours. Others reported login alerts or temporary account lockouts. X product engineer Mridul Singhai said the company was investigating and had found no evidence of a breach.

'Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts. We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience,' Singhai said.

Reset Requests Can Start With a Username

X's account‑recovery system allows users to initiate a password reset with an account's username, email address or phone number. When someone enters a username, X sends the reset message to the email address linked to that account.

An attacker can therefore trigger a reset email without knowing the account holder's private email address.

Receiving the message does not show that an account has been compromised. It only means that someone started the recovery process.

X offers a setting called Password reset protection. When enabled, the feature requires confirmation through the email address or phone number linked to the account before X sends a password‑reset link or code.

The setting is separate from two‑factor authentication. X recommends using both features, along with a strong, unique password.

Its security guidance also advises users to access the service through x.com instead of clicking suspicious links in unsolicited messages. Crypto investor Nic Carter was among those urging users to enable the protection after the messages began appearing.

X Money Rollout Adds Financial Function

X Money became more widely available to US‑based Premium and Premium+ subscribers on 27 July 2026, after a limited rollout in June. The service adds payment functionality to the platform.

X Money uses infrastructure provided by Cross River Bank and allows users to send money through X. It is not available worldwide, and there is no evidence that X Money itself was compromised in the password‑reset activity.

X Money is not itself an FDIC‑insured bank. Deposits associated with the service are held through Cross River Bank. Singhai linked the apparent reset attempts to the wider availability of X Money.

That explanation remains X's assessment and has not been independently confirmed. There is also no evidence that Cross River Bank was involved in or responsible for the reset requests.

Users Reported Other Security Alerts

Some users said they saw login alerts or experienced temporary lockouts after receiving the reset emails. Those reports do not establish that attackers successfully took control of the affected accounts. A reset request does not automatically change an account's password.

As of Tuesday, X had not confirmed a system breach, widespread account takeover or access to users' funds. The investigation remained focused on the source of the reset requests and the activity behind them.