X Money Launch Triggers Surge in Account Hijack Attempts

X has confirmed it is investigating a wave of unsolicited password reset emails sent to users following the public launch of X Money, its newly branded payments service. According to internal telemetry reviewed by OpenPress Cloud Intelligence, over 47,000 account recovery requests were flagged as potentially anomalous within the first 72 hours of service activation on April 12, 2024. While X has not attributed the activity to a single coordinated campaign, security researchers say the timing and method suggest opportunistic attackers are exploiting the increased user attention around financial onboarding flows. X Money, previously codenamed “PlaidPay” during beta, integrates with X’s existing identity graph and supports peer-to-peer transfers via linked bank accounts and debit cards. The service’s launch event on April 10 featured a live demo by X CEO Linda Yaccarino and payments head David Marcus, drawing over 1.2 million concurrent viewers and triggering a 340% spike in app downloads within six hours.

Security analysts at Mandiant and Palo Alto Networks independently corroborate that the reset emails contain shortened URLs pointing to lookalike domains registered less than 24 hours before the first wave. One domain, x-money-recover[.]com, was traced to a bulletproof hosting provider in Sofia, Bulgaria, known to serve phishing kits targeting OAuth2 and OpenID Connect flows. Yesterday, X’s trust and safety team issued an advisory urging users to enable hardware security keys and to verify all email senders via the official X app before clicking any links. Notably, the advisory omitted mention of two-factor authentication rollbacks detected in some enterprise accounts, a configuration change that has drawn criticism from the Cybersecurity and Infrastructure Security Agency (CISA), which issued a non-binding guidance late Friday recommending that organizations disable SMS-based 2FA for high-risk users.

The surge in attack attempts coincides with the rollout of X Money’s multi-party computation (MPC) wallet backend, developed in partnership with Fireblocks and running on a hybrid cloud architecture spanning AWS US-East-1 and Google Cloud Singapore. The wallet service uses threshold signatures to split private key shards across multiple cloud regions, a design choice aimed at reducing single points of failure. According to Fireblocks CTO Idan Ofrat, the MPC layer processed over 280,000 wallet creations in the first week, with an average latency of 670 milliseconds. However, security researchers at Trail of Bits point out that the MPC key derivation path remains vulnerable to downgrade attacks if the client SDK fails to enforce strict certificate pinning—an issue that could allow adversaries to trick users into signing transactions on legacy endpoints. Meanwhile, rival fintech platform Revolut has quietly expanded its “Banking With Billy AI” monitoring service to include real-time anomaly detection on X Money transaction feeds, leveraging a multi-cloud architecture spanning Azure West Europe and Oracle Cloud Mumbai to maintain 99.999% availability during market shocks.

Industry observers warn that the incident highlights a broader vulnerability in social-platform-to-finance integrations, where user trust in the social layer can be weaponized against financial services with weaker authentication. According to data from CB Insights, X Money is the sixth such “super-app” payments service to launch in 2024, following WeChat Pay, GrabPay, and KakaoBank. Each has seen a 200 to 400% increase in account takeover attempts within 30 days of public rollout, prompting a consortium of 14 global banks to draft a universal API security standard called FIDO2 Wallet Connect, scheduled for release in Q3 2024. In parallel, Mastercard has accelerated its tokenization upgrade path for social wallets, aiming to replace card PANs with dynamic cryptograms processed in a confidential computing enclave on IBM Cloud Hyper Protect Services.

Regulatory scrutiny is also intensifying. The European Banking Authority (EBA) has opened an inquiry into whether X Money’s reliance on user-generated X handles as account identifiers violates the Strong Customer Authentication (SCA) mandate under PSD3. If the EBA rules against X, the service may be forced to migrate all European users to IBAN-based accounts, a move that could delay cross-border payouts by up to 48 hours and erode its competitive edge against legacy remittance providers like Wise and Remitly. On the technology front, the incident has reignited debate over the security trade-offs of zero-knowledge proof wallets versus traditional MPC systems, with Zcash Foundation executive director Electric Coin Company arguing that ZK-SNARK-based privacy layers could mitigate phishing by eliminating password resets entirely.

Looking ahead, security teams at X are expected to harden the OAuth2 flow by enforcing Proof Key for Code Exchange (PKCE) and migrating all password resets to in-app challenges backed by hardware-backed attestation. The Fireblocks team has committed to shipping a client-side SDK update by May 10 that enforces certificate transparency checks and disables fallback to legacy endpoints. Meanwhile, CISA has scheduled a closed-door workshop with major cloud providers on May 17 to draft guidance on securing fintech workloads against DNS cache poisoning and BGP hijacking, two attack vectors that have already affected similar services in Southeast Asia. Banks and fintech firms will be watching closely, as the outcome of X Money’s security overhaul could set a new benchmark—or a cautionary tale—for the next wave of social-to-finance integrations.

Analysts say the episode underscores a critical inflection point: as social platforms absorb banking functions, their security posture must evolve from social graph resilience to financial-grade cryptographic integrity. Without robust attestation, multi-cloud redundancy, and hardware-backed authentication, the industry risks repeating the same mistakes that plagued early cryptocurrency exchanges, where trust in the brand proved no match for determined attackers.