Password reset emails flood X users after X Money rollout

Attackers are taking aim at X users in the wake of the platform’s new payments service launch. Over the past few days, a wave of users has reported receiving unsolicited password reset emails — the kind that make you wonder if someone is trying to break into your account.

X product engineer Mridul Singhai acknowledged the issue on the platform Tuesday, saying the company is actively investigating. So far, there’s no evidence that any breaches have succeeded.

“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts,” Singhai wrote. “We are actively investigating the issue and, so far, have found no evidence of any breaches. We apologize for the multiple emails and appreciate your patience as we work to resolve this.”

What is X Money and why does it matter?

X Money is the social network’s freshly launched payments service, complete with a bank card and other perks. For creators, it’s a potential game-changer — a way to collect payments directly on the platform without bouncing through third-party services. That’s a big step for X’s ambitions to build a full digital economy inside its walls.

But here’s the flip side: money attracts bad actors. Always has, always will. And when a platform suddenly starts handling financial transactions, the criminals take notice.

What exactly is happening to X accounts?

Users are reporting a barrage of password reset emails they never requested. The pattern suggests attackers are using a technique called “mass-triggering” — essentially flooding the password reset form with public usernames to generate emails en masse.

X’s own AI chatbot, Grok, has weighed in on the situation, confirming the attacks are happening while reassuring users that there’s been “no confirmed system breach or mass takeovers.”

The bot also pointed users toward enabling Password Reset Protect, a security feature that adds an extra layer of verification before a password can be changed.

What the attacks mean for your account

Here’s the uncomfortable truth: even if these attempts are unsuccessful, the sheer volume of reset emails suggests attackers are testing the waters. They’re looking for weak points, and they’re betting that X Money’s popularity will make users more vulnerable — or at least more panicked.

• Enable two-factor authentication if you haven’t already. It’s the single most effective step you can take.
• Turn on Password Reset Protect in your security settings. It requires additional verification before a password reset can go through.
• Don’t click links in unexpected emails. If you get a password reset email you didn’t ask for, ignore it — or better yet, report it.
• Use a unique password for X that you don’t use anywhere else.

X’s response: investigation and threats of legal action

X hasn’t posted an official statement to its company accounts yet, and the platform hasn’t responded to press inquiries at the time of writing. But X general counsel James Burnham didn’t mince words in a post of his own.

“The legal and security teams @X will stop at nothing to identify, locate, and hold criminally accountable any person anywhere on or off earth who attempts to victimize our platform’s users,” he wrote.

Strong words, for sure. Whether they’ll translate into actual arrests remains to be seen. But the message is clear: X is treating this as a criminal matter, not just a technical glitch.

How to protect yourself during the X Money launch chaos

If you’re an X user, now is the time to tighten up your security. The attackers are counting on confusion and complacency. Don’t give them the satisfaction.

Head to Settings and privacy, then Security and account access. From there, you can enable two-factor authentication and turn on Password Reset Protect. It takes about two minutes and could save you a world of trouble.

For more on keeping your accounts safe, check out our guide on two-factor authentication best practices and how to spot phishing attempts before they catch you.

The bottom line? X Money is here, and it’s changing how the platform handles payments. But with new features come new risks. Stay alert, enable your protections, and don’t let the panic — or the phishing emails — get the best of you.

The Clock Is Ticking on Disrupt 2026 Side Events

TechCrunch Disrupt 2026 is barreling toward San Francisco’s Moscone West from October 13–15. More than 10,000 founders, investors, and tech’s sharpest minds will pack the halls. But the real action? It spills well beyond those three days.

That’s where the Disrupt Side Events program comes in. From October 10–16, you can host your own gathering — a dinner, a workshop, a VC office-hours session — and get it promoted directly to Disrupt’s massive audience. The catch? The application deadline is this Friday, September 4, at midnight PT. Yes, that’s days away.

If you’ve been sitting on an idea for a meetup, now’s the time to move. Here’s everything you need to know.

Why Bother Hosting a Side Event?

Side Events put you in the driver’s seat. Instead of hoping you run into the right people in a crowded expo hall, you create the room where conversations happen. Your brand, your agenda, your crowd.

Here’s what you get:

• Direct access to thousands of the most curious and capable people in tech.
• Real relationships with potential partners, investors, and future collaborators — not just business cards.
• Full control over your narrative. You decide what to showcase and how to frame it.
• Buzz that lingers long after the event ends, thanks to promotion through Disrupt’s official channels.

Approved Side Events are listed on the official calendar and pushed out through Disrupt’s marketing. That’s free exposure to an audience that’s already primed for innovation.

What Kind of Event Can You Host?

Pretty much anything that fits your vision. Past Disrupts have seen industry roundtables, intimate dinners, casual happy hours, deep-dive workshops — you name it. The format is yours to design.

One recommendation: aim for the evenings of October 13–15. There’s less competition for attention, and the post-conference energy is perfect for real conversations. Just make sure your event is open to both Disrupt attendees and the broader public.

What You Need Before Applying

Don’t wing it. The application form asks for specifics, so have these locked down first:

• A venue in the Bay Area — this is strictly in-person, so location matters.
• A title, description, and venue details ready to paste in.
• A quick read of the Side Events Host Guide and the Side Event Host T&Cs so there are no surprises.

If you hit a snag, the Side Events team is just an email away. They’re genuinely helpful.

Who Should Apply?

Venture capitalists looking to spark dialogue. Companies launching something new. Community builders with a point of view. If you have a following, a network, or just a killer idea for bringing people together, this is your shot.

There’s zero cost to apply and zero cost to participate. The organizers prioritize events that add real value for founders, investors, and the startup ecosystem — but beyond that, you know your community best.

So here’s the bottom line: the deadline is September 4 at midnight PT. The application takes minutes. The payoff could define your quarter.

Apply now. Tell them what you want to build, who you want to reach, and what you need logistically. They’ll handle the rest — and you’ll be at the center of the Bay Area’s biggest tech week.

A Familiar Name, A Different Game

You read that right. There’s a new social network called Twitter.now on the block, and it’s being operated by a startup called Operation Bluebird. The founding team includes Stephen Coates, who once served as Twitter’s trademark counsel. That’s a detail that matters — because this isn’t just another microblogging clone. It’s a direct shot at the legacy of the bird.

According to Ars Technica, X Corp. sued the company last year, asking a Delaware judge to block Operation Bluebird from launching a platform called Twitter. But Operation Bluebird fired back, arguing that X had effectively abandoned trademarks like “Twitter” and “Tweet” when it rebranded to X in 2023. The case is still winding through the courts.

What Is Twitter.now, Exactly?

Coates laid out the vision in a LinkedIn post. “When X Corp. retired the Twitter brand, we saw an opportunity to build something new: a public square organized around trust, transparency, and user choice.” He was careful to distance the project from the old platform. “Twitter.now is not an attempt to recreate the old platform. We are building a different service, with trust signals that provide context for what users see and tools that allow people—not an opaque algorithm—to decide how much credibility and noise reach their feeds.”

Right now, the site is in testing. Early access costs $20. That’s a pay-to-play model, which is a bold move in a world where most social networks are free and ad-supported. But Operation Bluebird is betting that people will pay for something they can trust.

VERA: The AI That Grades Your Posts

The centerpiece of Twitter.now is an AI system called VERA. According to the company’s home page, VERA gauges posts, checks claims, and gives users the source of those claims, plus context. It then attaches a trust score to each piece of content. You’ll be able to set your preferred trust score threshold, and posts that fall below it get filtered out of your feed.

That’s an intriguing idea, but it raises a big question: who decides what’s trustworthy? The company says VERA is transparent about its reasoning, showing users the sources behind a claim. But AI moderation has a spotty track record, and the stakes are high.

VERA 2.0 Is Coming

Operation Bluebird told TechCrunch that VERA is currently in its initial version. “VERA 2.0, with expanded capabilities, is on the near-term roadmap, where the user will be able to set their app to only see posts above the threshold they choose,” the company said in an emailed statement. So the current version is just a taste of what’s planned.

The Moderation Minefield

Here’s the thing about social networks: moderation is a nightmare. As user numbers ramp up, platforms often find themselves forced to choose sides. The original Twitter had to navigate that minefield for years before Elon Musk took over. Bluesky has faced its own criticism lately for moderation missteps. And now Twitter.now is stepping into the same arena, armed with an AI that claims to solve the problem.

Will VERA actually work? That’s the million-dollar question. Trust scores are a noble concept, but they can be gamed. Bad actors could flood the system with fake sources, or the AI could develop blind spots. The company seems aware of this, which is why VERA 2.0 is on the roadmap. But in the fast-moving world of social media, a near-term roadmap can feel like a lifetime.

What’s at Stake in the Trademark Fight

The legal battle with X Corp. is still unresolved. X’s lawsuit sought an injunction to stop Operation Bluebird from using the Twitter name. Operation Bluebird’s defense hinges on the idea that X abandoned the trademark when it rebranded. That’s a clever argument, but it’s not a slam dunk. Trademark law is messy, and X has deep pockets.

If Operation Bluebird loses, the whole project could be dead on arrival. If it wins, we could see a wave of “retro” platforms trying to resurrect old brand names. Either way, this is a case worth watching.

Will Anyone Actually Pay $20?

That’s the other big question. Twitter.now is asking users to pay $20 for early access, and eventually a subscription fee. In a world where free Twitter alternatives like Bluesky and Threads exist, that’s a tough sell. But there’s a niche of users who are desperate for a platform that feels safe and credible. If VERA delivers on its promise, those users might be willing to open their wallets.

Operation Bluebird is positioning itself as the anti-algorithm, pro-user-choice network. It’s a compelling pitch, but the proof will be in the product. And right now, the product is still in testing.

The Bottom Line

Twitter.now is a bold experiment. It’s betting that trust can be quantified, that users want control over their feeds, and that people will pay for a better experience. The team has the legal chops — Coates knows trademark law inside out. But they’re up against a giant in X Corp., and the history of social media is littered with well-intentioned startups that couldn’t scale moderation.

Still, you have to admire the audacity. In a landscape dominated by a few big players, here’s a startup that’s willing to take on the legacy of Twitter, name and all. Whether it succeeds or crashes, it’s going to be interesting to watch.

If you’re curious, you can sign up for early access now. Just be prepared to pay $20 and to be patient while the kinks get worked out. And keep an eye on that Delaware courtroom — the next chapter of this story might be written there.