X users have been inundated with unsolicited password reset emails and login alerts since early August, sparking fears of a data breach. X engineer Mridul Singhai confirmed the company is aware but denied any new breach, attributing the activity to a 2021-2022 API vulnerability, a 2025 dataset of 201 million records, an active botnet, and a phishing campaign running since July. The reset emails originate from X’s own systems, making them legitimate but unrequested. The pattern mirrors a January incident on Instagram involving 17.5 million accounts, where Meta confirmed a bug allowed outside parties to trigger resets. Separately, Proton is experiencing a service disruption from a hardware failure, compounding confusion for users relying on it as a recovery email.
The news carries moderate negative sentiment for X as a platform, eroding user trust and raising questions about account security on the social network. While no direct crypto market impact is evident, the incident underscores ongoing risks around credential stuffing and phishing targeting high-profile platforms. It may indirectly pressure X’s valuation narrative and any future tokenization or monetization plans tied to the platform. No major crypto assets are directly implicated, but the broader theme of platform vulnerabilities reinforces caution around centralized social media ecosystems.