X Targets Phishing Scams With Forced Locks on New Crypto Activity

• X is implementing account locks on first-time crypto posts to curb scams.
• The feature targets phishing account takeovers that use trusted profiles to push tokens.
• Fake death report of Jonathan the tortoise (194) sparked memecoin hype and crash.

X is moving to shut down one of the most common crypto scam routes on its platform, i.e., hacked accounts pushing tokens. The change is that if an account posts about crypto for the first time, it gets locked.

The user must then verify identity before posting again. The goal is to remove the value of stolen accounts.

Auto-Lock Targets the Core Scam Model

X’s Head of Product, Nikita Bier, confirmed the rollout. The system flags accounts with no history of crypto activity that suddenly start promoting tokens, meme coins, or links.

Most phishing attacks follow this exact pattern. A user gets a fake email, often disguised as a copyright notice. They log into a cloned page. The attacker captures login details and two-factor codes. The account is taken over within minutes.

Once inside, the attacker pushes scams to an existing audience that trusts the account. By locking accounts at the first crypto-related post, X cuts this flow at the start. Bier stated the move could remove 99% of the incentive behind these attacks.

Phishing Wave Forces Platform Response

The change comes after a surge in phishing campaigns. Attackers have relied heavily on email exploits, with Bier directly calling out Google for failing to stop malicious emails at the inbox level.

These attacks are not new, but they have scaled. High-follower accounts are prime targets. If an account with over 10,000 followers suddenly launches a meme coin without any prior crypto history, X now treats it as a hack by default.

The platform is also blocking community-mention spam attacks, in which thousands of users are tagged in posts promoting tokens.

Crypto scams on X typically follow a few formats. Fake giveaways promise to double funds, fraudulent airdrops push users to connect wallets, and impersonation accounts mimic public figures to build trust. All rely on speed and reach.

It is important to note that crypto transactions are irreversible. Once funds are sent, they are gone.

Real Case Shows How Fast Scams Move

A recent case shows how effective these scams can be. An account posing as a veterinarian for Jonathan, a 194-year-old tortoise, falsely reported the animal’s death.

Major media outlets picked up the story. The account then pushed a Solana-based meme coin tied to the news. The token surged over 1,500% during the hype cycle and later crashed. 

The real veterinarian later confirmed the tortoise was alive. The account was fake as the post gained over 2 million views before being debunked.

Related: The Crypto Industry Lost $52 Million to Hackers in March, PeckShield Report