The U.S. Department of Justice and X are jointly investigating a large-scale password-recovery attack that targeted hundreds of thousands of X accounts this week, according to U.S. Attorney General Todd Blanche. X disrupted the attack before any accounts could be compromised, and the Justice Department is now working with the company to identify those responsible.

The incident is particularly relevant to crypto users, whose X accounts can serve as direct channels for promoting fake token giveaways, airdrops, and malicious links.

How the Attack Targeted X Users

Blanche described those behind the campaign as "sophisticated cybercriminals" but did not disclose how the attack was carried out or identify any suspected individuals or groups.

This week, sophisticated cyber criminals attempted a password-recovery attack on hundreds of thousands of X users. X disrupted the attack to prevent user accounts from being captured. But, as we've shown, the Justice Department will stop at nothing in its pursuit of cyber… — Attorney General Todd Blanche (@AGToddBlanche) September 2, 2026

A password-recovery attack exploits the "forgot password" or account-recovery process rather than trying to crack users' existing passwords, allowing attackers to attempt account takeovers at scale. These attacks often exploit the SMS or email verification step in account recovery and use automated attempts to target large numbers of accounts at once.

Blanche confirmed that X successfully blocked the attempt before any accounts were compromised. The full scope of the campaign remains unclear. Neither the DOJ nor X has publicly disclosed the specific technique used, the exact number of accounts targeted, or whether particular groups of users were singled out.

Why Crypto Users Should Pay Attention

X is a major communication channel for crypto projects, exchanges, and industry figures. An account takeover can therefore become more than a social-media security problem: attackers can use a trusted account to impersonate a project or executive and direct followers toward a fake airdrop, fraudulent investment opportunity, or malicious website.

The risk has precedent. In 2020, attackers hijacked high-profile X accounts — including those of Elon Musk, Barack Obama, and major crypto exchanges — to promote a Bitcoin giveaway scam. In 2024, attackers gained control of the U.S. Securities and Exchange Commission's X account in a SIM-swap incident and used it to publish a false announcement about the approval of spot Bitcoin ETFs.

How to Protect Your X Account From Password-Recovery Attacks

Do not use links in unsolicited X password-reset emails. Access X directly and enable Password Reset Protect under Settings > Security and account access > Security.

Enable 2FA with an authenticator app or hardware security key rather than SMS. This adds protection if attackers attempt to exploit the account-recovery process.

Why This Matters

The massive password-recovery attack was stopped before X accounts were compromised, but the campaign shows why account-recovery systems can be attractive targets at scale. For crypto users, protecting an X account is also about protecting a channel that can be used to influence followers and move money.

Source: DailyCoin

Primary source: Attorney General Todd Blanche on X