Thousands of X users, including prominent cryptocurrency accounts and CoinDesk staff members, reported receiving unsolicited password-reset emails on Tuesday, although there is currently no evidence that Elon Musk’s social media platform has been breached.
Several figures from the cryptocurrency industry said they had received messages they had not requested. CoinDesk staff members were also among those reporting the unexpected emails.
The alerts do not necessarily mean that attackers gained access to users’ email addresses. X allows anyone to begin a password-reset process by entering a publicly visible username, meaning a reset email can be triggered without access to the account itself.
There has also been no confirmed evidence of a wider security breach or widespread account takeovers linked to the messages.
X users can add an extra layer of protection by enabling the platform’s Password Reset Protect feature. When activated, the setting requires confirmation of the email address or phone number linked to an account before a password reset can be completed.
The reports have nevertheless prompted concern among account holders, particularly prominent cryptocurrency users, who are frequently targeted by attempts to gain control of social media accounts. The unsolicited messages appeared across a number of accounts on Tuesday, but the available information does not establish that the emails were generated by an attack on X’s systems.
The ability to start a reset request using a public username means recipients should not assume that their account details have been exposed simply because they received one of the emails. The messages indicate that a reset request was initiated, but do not, on their own, demonstrate that an unauthorised person accessed the account or changed its password.
Users concerned about their accounts can use Password Reset Protect to require further confirmation before a reset goes ahead. There is no confirmed indication that the reported emails resulted in successful account takeovers.
The incident comes as thousands of X users, including well-known cryptocurrency accounts and CoinDesk employees, continue to report receiving password-reset notifications they did not request. At this stage, however, the reports point to unsolicited reset activity rather than confirmed evidence that X has suffered a breach.
