X's new payments app X Money hit by mass hacking attempt

Summary

On 2 September 2026, X warned that attackers might be targeting users following the launch and expansion of X Money, its integrated payments service. The warning followed reports from multiple users who received unexpected password-reset emails. According to the article, X has investigated the incident but has found no evidence that the attempted attacks successfully compromised accounts. One suspected method is mass-triggering password-reset requests using publicly visible usernames. The risk is potentially significant because X Money allows eligible users to hold funds, send and receive payments, and make peer-to-peer transfers. X general counsel James Burnham said the company’s legal and security teams would pursue anyone attempting to harm users. X users have shared warnings and encouraged others to activate two-factor or multifactor authentication, with the Grok chatbot also offering security guidance. The article says some users reported receiving follow-up messages containing fake X links, allegedly designed to steal login credentials through phishing. It therefore presents the incident as potentially more than an isolated password-reset issue, while noting that the broader phishing claims remain user reports rather than confirmed findings. The article also mentions prior scrutiny of X Money’s banking partner, Cross River Bank, and the service’s advertised 6% deposit yield.