X users report surge in unsolicited password reset emails

Thousands of X users, including well-known cryptocurrency industry figures and CoinDesk staff, reported receiving unsolicited password reset emails on Tuesday. Some users received as many as 10 such emails within a few hours.

How the reset requests work

X allows anyone to initiate a password reset request using a public username. The platform then sends the reset link to the email address linked to the account. This means the emails do not necessarily indicate that attackers have obtained users’ email addresses.

X offers a security feature called Password Reset Protect, which adds an extra step by requiring confirmation of the account’s email or phone number before a reset can proceed.

No confirmed breach

There is no confirmed evidence so far of a breach of X’s systems or widespread account takeovers. The company has not publicly commented on the reset attempts, nor has it identified any coordinated campaign or security incident.

In 2021, attackers exploited an API flaw that linked users’ email addresses and phone numbers to their accounts. Data tied to over 200 million accounts later circulated online in 2023, but there is no evidence connecting Tuesday’s events to that older breach.

Reactions from crypto users

Crypto investor Nic Carter noted that many people were receiving unsolicited reset attempts and advised users to enable X’s Password Reset Protect feature. Another user, cap.eth, reported aggressive password reset attempts despite having two-factor authentication enabled.

At least four CoinDesk staff members also received similar emails, including two whose email addresses associated with X were not widely known.

Why this matters for crypto

X plays a significant role in the cryptocurrency industry, as traders, projects, and executives use it as a primary channel for announcements, market commentary, and breaking news.

Sources

• CoinDesk