A flood of reset requests buys an attacker cover and confusion, but not access to the account itself. X's recovery flow will not complete unless the requester has access to the email address or phone number on the account [7], so volume alone leaves the credential where it was [15]. What the volume does produce is a stream of genuine X mail arriving in inboxes, which is good cover for a phish built to look like it [10]. Malwarebytes rates that imitation ahead of any defect in X as the immediate consumer risk [14]. The second effect is quieter: repeated alerts push people to rotate passwords that did not need rotating, bury the notifications that do matter, and in some cases lead users to turn protections off to stop the noise [11].
X's account of the motive is a reading of attacker behaviour, an inference rather than a confirmed finding. Product engineer Mridul Singhai wrote that attackers "appear to believe" wider X Money availability gets them into accounts [4]. X has not confirmed that X Money caused the reset traffic, and there is no evidence anyone has reached X Money balances or funds [8]. Earlier this year Instagram users saw a comparable flood of reset mail on a platform with no payments service at all [9], which places the pattern among the things that happen to large consumer platforms whether or not they hold money.
What did change is the payout per successful recovery. Eligible US users now get interest-bearing accounts, a Visa debit card and peer-to-peer payments inside X, with Cross River Bank providing the banking infrastructure [5]. Malwarebytes notes that accounts with payment access, large followings, business use or social-engineering value are the attractive ones [13]. That is the part of the editor's repricing thesis the evidence carries: the email inbox and the phone number behind an X account now sit on the path to a card, and the activity on the wire looks like bulk requests against exactly that path [6].
The control that changes the arithmetic is free and already shipped. X's password-reset protection requires additional account information, such as the email address or phone number, before X will send a reset link or code at all [12]. It sits four levels down in the menu, under Settings and privacy, then Account, then Security [16]. Layer an authenticator app or a security key on top, and never hand a reset code to anyone who contacts you [17].
Until X reports a completed reset, the honest description of this is a noisy and so far unsuccessful probe of the recovery path against a platform that has just raised the value of the accounts behind it [2][5].
