Elon Musk's X to deploy scam kill switch by auto-locking first-time crypto mentioners

Social media platform X is implementing a new security measure to combat a prevalent form of crypto phishing that exploits hijacked accounts to promote fraudulent tokens. The company will soon automatically lock any account that mentions cryptocurrency for the first time, requiring users to undergo additional verification before posting again. This move aims to significantly reduce the incentive for these attacks.

New Security Measure Details

Nikita Bier, X's Head of Product, announced the upcoming feature, stating it is designed to address the core motivation behind the phishing schemes. He believes this will effectively neutralize 99% of the incentive for these attacks. The change comes in direct response to a user's detailed account of losing control of their X account after falling victim to a phishing email disguised as a copyright violation notice. The attacker used a convincing fake login page to steal two-factor authentication codes, subsequently locking the user out and using their account to promote illicit crypto projects.

Prevalence of Crypto Scams on X

These types of scams have been a persistent issue on the platform, even before its acquisition and rebranding from Twitter. Common tactics include the "double your money" scam, where users are tricked into sending crypto with a promise of receiving more in return. Other scams involve promoting fake memecoins or fraudulent airdrops, often leveraging hijacked accounts to appear legitimate. Impersonation of prominent figures is a frequent strategy, leading users to click malicious links that mimic genuine crypto platforms. Given that cryptocurrency transactions are irreversible, victims often lose their funds permanently.

Historical Context and Previous Efforts

A notable past incident occurred in 2020 when hackers gained access to Twitter's internal systems, compromising major accounts including those of Apple, Barack Obama, and Elon Musk. These accounts were used to promote a fake bitcoin giveaway, reportedly netting over $100,000. The hacker responsible for this breach, which involved social engineering against Twitter employees, received a 5-year sentence. X has previously attempted to enhance security through measures such as bot purges, API restrictions, and behavioral detection. The new auto-lock feature for first-time crypto mentions is an extension of these efforts, aiming to disrupt scam tactics by rendering compromised accounts unusable for fraudulent purposes.

Criticism of Google's Role

Bier also directed criticism towards Google, suggesting the tech giant has a responsibility in failing to prevent phishing emails at the email service level, thereby not adequately protecting its users from such attacks.