X Auto-Locks Accounts on First Crypto Post to Crush Phishing Scams Instantly

by

X Platform to Auto-Lock Accounts on First Crypto Mention to Kill Phishing Scams

X, formerly Twitter, is introducing a new security measure to protect users from scams. Any account mentioning cryptocurrency for the first time will be automatically locked until the owner verifies their identity. This change is a response to a recent surge in account takeovers where hackers used compromised accounts to promote fraudulent crypto tokens by taking advantage of people’s trust.

Summary

  • X Head of Product Nikita Bier confirmed the auto-lock feature, saying it targets the financial incentive behind crypto phishing attacks on the platform
  • The measure follows a surge in account hijacking incidents, including the April 1 compromise of Predictfully founder Benjamin White’s account, which was used to push scam content and extort $4,000 from the real owner
  • Bier estimates the feature should eliminate 99% of the incentive behind current phishing operations and called out Google for failing to block phishing emails at the Gmail level

As an analyst, I’ve been looking into the new auto-lock feature, and it’s designed to stop a common type of scam. Basically, if an account makes its very first post about cryptocurrency, it’s automatically locked. The user then needs to verify their identity to unlock it. The idea is to cut off hackers at the source. They often gain access through phishing, immediately lock out the real owner, and then exploit the account’s existing followers to promote scams like fake tokens or giveaways. This auto-lock aims to prevent that from happening.

The Feature

According to Bier, this situation will likely eliminate almost all motivation for this type of attack. It happened after a user reported losing access to their account due to a phishing scam that appeared to be a copyright warning. The attacker used a nearly identical fake login page to steal the user’s username, password, and security codes, then locked the user out and started promoting a scam.

What This Targets

Account takeovers linked to cryptocurrency have been a recurring issue on X (formerly Twitter) for some time. This new ‘auto-lock’ feature is an extension of previous efforts to stop spam and coordinated activity often used to promote crypto schemes. Users who haven’t previously posted about crypto will be asked to verify their accounts the first time they do, but legitimate users should be able to quickly regain access through the verification process, according to Bier.

Bier publicly faulted Google for failing to prevent phishing emails from landing in users’ Gmail inboxes. He stated that Google wasn’t taking sufficient action, and described the auto-lock feature as a necessary solution to a problem X couldn’t fix on its own, as the issue originated with Google’s platform.

The U.S. Federal Trade Commission reports that scams involving cryptocurrency on social media have become a huge problem, costing victims billions of dollars. Because crypto transactions are usually final and can’t be reversed, people rarely get their money back. This is why hackers prize social media accounts that already have a lot of followers – they can use these accounts to quickly promote crypto scams. The new ‘auto-lock’ feature aims to stop this by making it harder for hackers to access accounts and immediately profit from them.

Limitations

Some experts point out this solution only kicks in *after* an account has already been hacked through phishing. To truly prevent these attacks, email providers need to do a better job of blocking phishing emails before they even reach users. While the system might occasionally cause a slight delay for legitimate new crypto posts from existing accounts, the creator mentioned the verification process should be quick for real users.

While crypto scams and hacks have been decreasing recently – February 2026 saw the lowest monthly losses since March 2025 – the $285 million theft from Drift Protocol is a stark warning that significant risks still exist. X’s new feature tackles one common type of attack, but crypto fraud remains a widespread problem.

Read More

2026-04-04 15:03