Some have been waiting years for it. Others call it long overdue. Either way, X — Elon Musk's social network — is about to introduce one of the most radical security measures ever adopted by a major platform in the crypto space: the automatic locking of any account that mentions cryptocurrency for the very first time in its history.
The announcement came from Nikita Bier, Head of Product at X, in a blunt, unfiltered post that immediately made waves across the industry.
What Happens in Practice
The mechanism is straightforward: if an account has never posted anything related to cryptocurrency — in any form — and attempts to do so for the first time, the system automatically locks it and requires additional verification before any new post is allowed. For legitimate users, the process should be quick. For someone who has just hijacked an account through a phishing attack, it is an impassable wall.
Bier also took direct aim at Google, openly criticizing the company for failing to filter phishing emails upstream — before they ever reach users' inboxes. It is a structural problem that X alone cannot fully solve.
The Benjamin White Case: A Textbook Attack
The final push behind this decision came from a specific and well-documented incident. On April 1, 2026, Benjamin White, founder of Predictfully, lost control of his account in near-surgical fashion: he received an email that appeared to come from X's support team, flagging an alleged copyright violation. The attached link led to a login page identical to the real one — pixel for pixel — designed to capture both the password and the two-factor authentication code in real time.
Within minutes, the account was in the attacker's hands, who immediately began promoting fraudulent tokens and fake airdrops, exploiting the credibility White had built over time. The attacker also attempted to extort $4,000 from him in exchange for restoring access.
This is not an isolated case. Attacks of this type escalated throughout 2026, with February still recording the year's lowest month for losses from crypto hacks and phishing — a signal that things are improving, albeit slowly.
Will It Actually Work?
The logic behind the measure is sound: whoever compromises an account does so to exploit it immediately for financial gain. If the first crypto post is blocked and requires verification, the account becomes unusable within the time window where it is worth exploiting. The attacker's advantage is almost entirely eliminated.
Criticism exists, and it is fair to acknowledge it. Anyone who has never tweeted about crypto — a journalist, a new user, anyone approaching the topic for the first time — may find themselves having to verify their identity before posting something entirely legitimate. Bier has reassured users that for genuine accounts the process will be fast.
The core point remains: social platforms have become the primary battleground for crypto scams. With this move, X chooses to intervene at the product level rather than relying solely on reactive moderation. It is a concrete shift in approach — perhaps late, but certainly necessary.
