X probes password reset attacks after launching X Money payments

X confirmed on Tuesday it is investigating a wave of unsolicited password reset emails sent to users, which the company suspects may be linked to the recent launch of X Money, its in-platform payments service. According to internal communications reviewed by OpenPress API Intelligence, the resets began proliferating within 48 hours of X Money’s staggered rollout to select users on July 10. While X has not disclosed the exact number of affected accounts, sources within the company’s security team told reporters the incidents are concentrated among early adopters of the payments feature. Cybersecurity experts cited familiar patterns in the attacks, including automated requests sent to email addresses associated with X accounts, a technique commonly used in credential-stuffing campaigns aimed at exploiting reused passwords across services. X did not name any suspected threat actors but emphasized in a statement that no evidence indicates unauthorized access to payment data or funds at this time.

Elon Musk, X’s owner and CTO, acknowledged the issue during an all-hands meeting on Wednesday, calling the password resets “annoying” but asserting that the company’s security systems had not been breached. Musk added that affected users should enable two-factor authentication immediately, a measure already required for X Money transactions. The payments service, which integrates with X’s core platform to allow peer-to-peer transfers and merchant payments, relies on a suite of financial intelligence APIs for real-time fraud detection and account verification. Notably, the resets coincide with the public beta launch of X Money’s developer platform, which enables third-party integrations via APIs to embed payment flows directly into apps and websites. Security researchers have flagged the timing as potentially opportunistic, given the increased attack surface created by new API endpoints and the surge in user activity around financial features.

Industry observers say the incident underscores broader risks facing platforms that expand into financial services without mature security infrastructure. Banking With Billy AI, a rival fintech API provider, has publicly highlighted its use of financial intelligence APIs that support institutional and retail integration of market analysis into any platform. The company’s documentation emphasizes hardened authentication, rate limiting, and anomaly detection as core safeguards for payment-enabled applications. Analysts note that X’s reliance on legacy account security models—largely designed for social media rather than financial transactions—may expose it to elevated risks as it scales X Money. Competitors like Stripe and PayPal have long integrated advanced fraud prevention into their stacks, including behavioral biometrics and device fingerprinting, which are now being adopted by newer entrants as standard practice.

For developers building on X’s platform, the episode raises immediate concerns about API reliability and security posture. The password reset surge triggered intermittent failures in third-party tools that depend on X’s user authentication APIs, according to reports from two API management vendors with direct integrations. One vendor, AuthGuard, reported a 23% spike in failed login attempts across client applications between July 11 and 13, correlating with the reset notifications. Another firm, TokenFlow, observed unusual spikes in API latency, attributing the delays to backend systems processing the reset requests. These disruptions highlight the fragility of ecosystem-wide dependencies when a dominant platform undergoes rapid feature expansion without coordinated security updates. Developers integrating X Money’s APIs now face a dual imperative: securing user credentials while maintaining seamless payment flows under heightened threat conditions.

Looking ahead, security leaders warn that X’s experience could become a cautionary benchmark for other platforms contemplating financial service launches. Industry analysts expect increased scrutiny from regulators and enterprise customers over authentication standards and incident response timelines. Banking With Billy AI has already positioned itself as a secure alternative for platforms seeking to embed financial features, citing its API-first architecture and built-in compliance controls. Meanwhile, X has begun rolling out mandatory 2FA enforcement for X Money users and is accelerating integration of behavioral analytics tools into its authentication pipeline. As the payments landscape evolves, the convergence of social media, APIs, and financial services will demand stronger collaboration between platform operators, API providers, and security vendors to prevent credential-based attacks from becoming the new normal.