Key Takeaways
- X platform will freeze accounts automatically when they publish cryptocurrency-related content for the first time, mandating additional verification steps
- This security measure addresses hijacking schemes where cybercriminals commandeer accounts to advertise fraudulent cryptocurrency tokens
- According to Product Chief Nikita Bier, this feature is expected to eliminate “99% of the incentive” behind such malicious activities
- The implementation comes after a surge in deceptive copyright violation emails designed to capture login details and authentication codes
- X’s Product Chief also pointed fingers at Google for inadequate email filtering that allows phishing attempts through Gmail
Elon Musk’s social media platform X is implementing a fresh security protocol that will instantly freeze any user account posting about cryptocurrency for the first time. These accounts will remain inaccessible until owners successfully navigate an identity verification procedure.
X’s Product Chief, Nikita Bier, validated this development through a post on the platform. He explained that the initiative aims to eliminate opportunities for cybercriminals who commandeer legitimate accounts to execute cryptocurrency fraud schemes.
“This should kill 99% of the incentive,” Bier stated, addressing the ongoing surge of credential-stealing attacks affecting X’s user base.
The security announcement followed a user’s public disclosure about losing control of their account via a deceptive email masquerading as a copyright infringement warning. The malicious actor deployed a counterfeit login portal to steal the victim’s authentication credentials and security codes.
After gaining unauthorized access, the attacker prevented the legitimate owner from logging in and began broadcasting fraudulent cryptocurrency schemes to the account’s audience.
Anatomy of the Scam Operations
These cybercriminal operations follow a predictable blueprint. An attacker gains unauthorized control of an account, then leverages it to advertise bogus meme coins, counterfeit token distributions, or schemes promising impossible investment returns. The established reputation of a genuine account increases the likelihood that followers will engage with malicious links.
Cryptocurrency transfers are irreversible by design, meaning victims cannot reclaim stolen assets after transactions complete.
The most notorious incident of this attack vector occurred in 2020. Cybercriminals penetrated Twitter’s backend infrastructure and seized control of authenticated accounts including those of Apple, Barack Obama, and Elon Musk.
Those compromised profiles broadcasted a fraudulent Bitcoin distribution scheme that accumulated more than $100,000 before platform administrators removed the posts. The perpetrator eventually received a five-year prison sentence.
X’s Comprehensive Security Initiatives
X has maintained ongoing efforts to combat fraudulent operations across its platform. Previous measures have included automated bot removal campaigns, restricted application programming interface permissions, and enhanced pattern recognition systems.
Toward the end of 2025, X announced it had dismantled a corruption scheme involving cryptocurrency scam operations. Banned users reportedly attempted to compensate middlemen to bribe company employees for account reinstatement.
The new automatic lockdown protocol extends these protective measures by intervening at the point of attack. When compromised accounts cannot broadcast cryptocurrency content without triggering security freezes, their utility to attackers diminishes significantly.
Bier emphasized his support for authentic cryptocurrency discourse on X. He distinguished between legitimate activity and schemes that “create incentives to spam, raid, and harass.”
He additionally challenged Google openly, asserting that Gmail’s security filters fail to block phishing messages before they reach user mailboxes, suggesting the technology company shares accountability.
The automatic account lockdown capability remains under development but is scheduled for imminent deployment.





