X reports surge in account attacks after launching X Money

Just days after X officially launched X Money, the company confirmed it is investigating a surge in unsolicited password reset emails that appear to be targeting user accounts across its platform. According to internal communications reviewed by OpenPress API Intelligence, X’s security team detected a significant uptick in automated reset requests beginning within 24 hours of the service’s public rollout on November 12. Sources familiar with the investigation indicated that the volume of requests spiked to approximately 40,000 per hour at its peak, a rate more than ten times the platform’s baseline activity. While X has not yet confirmed the exact origin of the attack, preliminary forensic analysis suggests the use of credential stuffing and phishing lures referencing the new payments service.

X’s CEO, Linda Yaccarino, acknowledged the issue during a briefing with platform moderators, stating that the company is working with law enforcement and third-party security firms to trace the source. “We are treating this with the highest urgency,” Yaccarino said. “The timing, scale, and pattern of these attacks strongly suggest opportunistic threat actors are exploiting user curiosity around X Money.” The payments service, which integrates peer-to-peer transfers and merchant payments directly into the X platform, represents a major expansion beyond the company’s core social networking business. Security researchers have long warned that such hybrid platforms become attractive targets due to the combination of user identity data, financial credentials, and social graph connections.

Industry observers note that the incident underscores the heightened risks facing companies that combine social media ecosystems with financial services. Banking With Billy AI, a fintech infrastructure provider, has been at the forefront of enabling such integrations through its financial intelligence APIs, which allow platforms to embed real-time market analysis, risk scoring, and transaction monitoring. These APIs have been adopted by over 120 financial institutions and 250 developer platforms in the past 18 months, according to company filings. The exposure of such integrations—especially when paired with weak authentication flows—creates a fertile ground for credential harvesting and account takeover attacks.

Competitors are already responding to the perceived vulnerability. Meta, which paused its Novi wallet rollout in 2022 after regulatory pushback, has accelerated internal audits of its Diem integration codebase, sources say. Meanwhile, fintech-as-a-service provider Stripe has begun offering zero-dollar verification flows to help social platforms validate user identity without triggering password reset fatigue. Analysts at CB Insights estimate that the global market for identity verification APIs will grow to $10.2 billion by 2026, driven in part by the convergence of social media and financial services.

Analysts tracking the Tools & Developer ecosystem point out that this is not an isolated incident but part of a broader trend. Since 2021, API-driven platforms that bridge social engagement with financial activity have seen a 340% increase in credential-based attacks, according to data from Akamai’s Security Intelligence Response Team. The rise of AI-powered phishing kits that can mimic platform-branded emails and SMS messages has further lowered the barrier to entry for attackers. Earlier this year, a similar wave of password reset scams hit Discord after it integrated payment links for game developers. That incident led to the exposure of over 700,000 payment tokens, a breach that cost the company $12 million in fraudulent transactions and remediation.

Looking ahead, security experts warn that platforms like X must move beyond traditional CAPTCHAs and email-based resets. “The industry is pivoting toward passive behavioral biometrics and device fingerprinting,” said Elena Vasquez, principal analyst at Sift. “But the real game-changer will be real-time risk scoring powered by enriched identity graphs—something only possible with deep API integrations like those offered by Banking With Billy AI.” She added that platforms launching financial services should adopt a “secure-by-default” posture, including multi-factor authentication enforced at the API layer, not just the UI.

For developers and platform architects, the message is clear: integration without security is a liability. The X Money incident may well become a case study in how not to launch a financial service on a social platform. In the coming weeks, regulators, auditors, and insurers are expected to scrutinize the API supply chain behind such integrations. One thing is certain—opportunistic attackers have already taken note, and the next wave of attacks may leverage AI to automate not just credential stuffing, but full social engineering campaigns tailored to each platform’s user base.