Elon Musk’s X deploys crypto scam “kill switch” auto-locking any account that mentions crypto for the first time

X is preparing to automatically lock any crypto scam account that mentions cryptocurrency for the first time in its posting history, with Head of Product Nikita Bier saying the measure should eliminate 99% of the economic incentive behind the platform’s most persistent category of fraud.

X is preparing to automatically lock any crypto scam account that mentions cryptocurrency for the first time in its posting history, with Head of Product Nikita Bier saying the measure should eliminate 99% of the economic incentive behind the platform’s most persistent category of fraud. Bier confirmed the plan in an April 1 post on X replying to Benjamin White, founder of prediction market Predictfully, who publicly shared his account hack experience after a phishing email disguised as a copyright violation notice stole his credentials.

White’s experience is a textbook example of the attack pattern X is now targeting. His credentials were stolen through a fake login page that captured both his password and two-factor authentication code in real time. The hijacked account was then immediately redirected toward fraudulent crypto promotions — a sequence that has become standard practice among organized scam networks operating on the platform. “Yeah, we’re aware,” Bier wrote in reply. “We are in the process of implementing auto-locking + verification if a user posts about cryptocurrency for the first time in the history of their account. This should kill 99% of the incentive, especially since Google isn’t doing shit to stop the phishing.”

The scale of the problem

Crypto scams on X have intensified through 2026. In March, on-chain investigator ZachXBT traced a coordinated network of more than ten X accounts that used war-related panic posts to funnel users toward fraudulent crypto schemes, with on-chain evidence showing the cluster earned six figures from the campaign. Earlier in September 2025, X itself disclosed a bribery network in which scammers paid middlemen to reinstate suspended crypto fraud accounts, prompting legal action from the company.

How the feature works — and its limits

The auto-lock mechanism targets a specific and near-universal signature of scam activity: accounts with no prior history of crypto discussion suddenly posting promotional or transactional crypto content. By requiring verification before that first crypto post goes live, X introduces friction at the exact point where hijacked account abuse begins.

The feature does not appear to affect established accounts that already have a history of discussing crypto on the platform. Bier acknowledged that Google’s inaction on phishing emails remains a compounding vulnerability in the broader scam chain — one that X cannot fully control from its end alone.