U.S. Justice Department and X are investigating a large-scale attempt to hijack accounts by abusing password-recovery flows. X says no accounts were captured, but the incident highlights risks for crypto-linked accounts used to spread fake airdrops and scams.
Password-recovery attacks exploit 'forgot password' verification steps (email or SMS) and can scale to many accounts with automation.
Crypto users should treat X accounts as high-value channels and use non-SMS two-factor authentication and X’s Password Reset Protect setting.
# What happened Attorney General Todd Blanche said this week that sophisticated cybercriminals attempted a mass password-recovery attack against hundreds of thousands of X users. X disrupted the campaign before any accounts were captured, and the U.S. Justice Department is collaborating with the company to identify those behind the effort.
# Why this matters for crypto users
# How password-recovery attacks work A password-recovery attack targets the account-reset process instead of trying to guess existing passwords. Common elements include:
Authorities and X have not disclosed which exact technique was used in this incident, whether specific user groups were targeted, or the precise number of accounts hit.
# What X and authorities have said Attorney General Todd Blanche described the perpetrators as "sophisticated cybercriminals" and confirmed X blocked the attempt before accounts were compromised. No additional evidence about methods, identified suspects, or targeted cohorts has been publicly released.
# Practical steps to protect your X account The story lists concrete defensive actions users can take:
# What remains unclear Key details are still unknown: the specific technical method used, the exact count of accounts targeted, and whether attackers focused on crypto-related or other high-value accounts. The Justice Department and X continue their investigation.
# Bottom line The campaign was stopped before account takeovers occurred, but the event highlights how the account-recovery process can be abused at scale. For users involved in crypto or with sizable followings, securing account-recovery channels and using non-SMS two-factor methods reduces the risk that a hijacked account will be used to spread scams or malicious links.
X users are receiving password reset confirmation emails apparently triggered by hackers, which may be hiding a second attack.
X is investigating a wave of unsolicited password reset emails that it believes may be tied to the rollout of its new payments service.
Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. [...]
Flashpoint data reveals infostealers were responsible for taking 1.7 billion credentials in the first half of 2026
Rapid7 unveiled a new cryptocurrency phishing campaign targeting 885,000 phone numbers, aiming to steal investors’ holdings by redirecting them to fake wallet provider websites. Cybersecurity firm Rapid7 unveiled a new cryptocurrency phishing campaign known as Operation Asterix, targeting roughly 885,000 phone numbers
Trezor told Cointelegraph that the phishing email was sent to 347,000 subscribers and said it is treating every address as “known to the attacker and possibly reusable for phishing.” An attacker exploited a flaw in email platform Brevo’s login system to access 138 client accounts, enabling a phishing email to reach rou
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.