My account is finally back.
First, a security reminder: please use a unique, randomly generated strong password for every important account. Do not rely on 2FA alone. 2FA can be bypassed, and I strongly recommend using a passkey.
Here’s what happened:
On Sep 30, I received an email about a new login to my X account. Unfortunately, I didn’t pay enough attention to it at the time.
On Oct 1, my account was compromised despite having 2FA enabled. My Gmail account remained under my control the entire time, and I have never entered my credentials on any phishing/scam website. As far as I can determine, the attacker only had my password. How they managed to bypass 2FA and take over the account is still unclear to me.
About 10 minutes after the takeover — while I was still on vacation — I received an email from Kimbo Chen telling me that my account appeared to have been hacked. Huge thanks to him for noticing and reaching out so quickly.
When I checked, my password had already been changed and a large number of scam links had been sent through my Chats. What made the situation even worse was that the Chat passcode could apparently be reset directly, while I myself could no longer access my own Chats.
I immediately opened my first ticket with X Support. The initial response essentially said that because I could still access the account at that point, they would not take further action.
Later that same day, I lost all access to the account.
On Oct 6, I submitted another hacked-account ticket. The suspension on this account was subsequently lifted, but during this period
@GenAI_is_real was targeted by the scam and nearly had their account compromised as well.
This whole situation was crazy.
Through the new support ticket, I was eventually able to reset the password and regain control of the account. The account is now back to normal.
I sincerely apologize for the impact caused by my poor security practices. More than 100 accounts were affected or contacted by the attacker, including
@MIT_CSAIL (which has now blocked me), and
@GenAI_is_real, who thankfully avoided losing their account.
I’m extremely grateful to everyone who warned me, helped report the account, or offered assistance during the past week. Special thanks again to Kimbo Chen, and to my colleague
@frankyouchill for taking time out of an already busy schedule to help me deal with this mess.
Again: use unique random passwords, and use passkeys whenever possible. Treat 2FA as an additional layer of protection, not something that makes an account impossible to compromise.
Everything on this account should now be back to normal.
Thank you all for your help, and I hope everyone stays safe and has a great day.