X's “killer weapon” against crypto scams: the first tweet will be automatically locked, and identity verification is required to unlock
Author: Shenzhao TechFlow
Deep Tide Guide:Nikita Bier, product leader of the X platform, announced that the platform is deploying a new mechanism: any account that first posts crypto-related content will be automatically locked and require authentication, saying that this move will “eliminate 99% of the motives for misconduct.” The policy directly points to the most rampant fraud model: hackers steal accounts through phishing emails and then use the trust of their fans to promote fake tokens.
Crypto fraud has become the X Platform's most persistent security scourge, and the platform is preparing to come up with the most aggressive product-level response to date.
According to Crypto Briefing on April 2, X product leader Nikita Bier announced on April 1 when responding to a phishing attack on the X platform that X is deploying an automatic locking mechanism: when any account posts crypto-related content for the first time in its history, the system will automatically lock the account and require completion of authentication, and can only continue to post after passing verification.
Bier wrote in the original post: “This should kill 99% of the incentive, especially since Google hasn't done it to stop the phishing.” At the same time, he pointed the finger at Google, criticizing its failure to effectively block phishing emails at the Gmail level, saying that X's automatic lock is essentially a remedy for Google's lack of security.
Phishing attacks have become the main vehicle for crypto scams, and stolen accounts have become “coin push tools”
What triggered Bier's statement was a personal experience of Benjamin White, founder of the predictive market platform Predictfully. According to TheStreet, White detailed how his account was hacked on the X platform on April 1: the attackers tricked him into clicking on a fake login page with a phishing email disguised as a notice of copyright infringement, stole login credentials including two-factor authentication codes, then locked down his account and used the account to promote fake cryptographic projects. To go even further, the hacker even asked him for an “account ransom” of $4,000.
This attack model is now highly industrialized. The typical operation process for hackers is to send phishing emails disguised as official notices (copyright warnings, security reminders, etc.), trick users into entering credentials on carefully imitated login pages, post false token promotions or phishing links immediately after stealing the account, and use the original account's fan trust base to quickly cash out. Since cryptocurrency transactions are irreversible, once a victim is fooled, the funds cannot be recovered.
According to Chainalysis' annual crypto crime report released this year, on-chain fraud inflows reached at least $14 billion in 2025, a significant increase from $9.9 billion in 2024. According to CertiK data, in January 2026 alone, phishing attacks caused more than US$311 million in losses, with a single victim losing US$284 million due to social engineering attacks.
Turning stolen accounts into “scrapped cards”
Bier's strategy points directly to a key link in this chain of interest: making stolen accounts completely devoid of value at the level of crypto promotion.
The specific mechanism is as follows: if an account that has never posted encrypted content suddenly starts promoting tokens, the system will automatically trigger the locking and authentication process. According to Bitget quoting Bier's further explanation, he specifically named a typical scenario: “If you have more than 10,000 fans, but have never had any history of crypto-related activities, and suddenly start promoting a meme coin, then this is 100% a scam. We have detected this behavior and requested verification of account ownership to reduce hijacking.”
The core logic of this mechanism is at the economic level: the primary purpose of a hacker stealing an account is to use its fan base to promote false tokens. If the stolen account is locked as soon as the encrypted content is posted, then the input-output ratio of the entire piracy will deteriorate dramatically, breaking down the motive for evil at the source.
X's anti-fraud combo
Automatically locking the first encrypted post is just one part of X's anti-fraud strategy.
According to TheStreet, some users reported in Bier's post that fraudulent accounts often spam 50 users at once with @标记. Bier responded that this kind of batch tagging “should have been blocked,” but judging from user feedback, there is still room for improvement in the actual blocking effect.
Additionally, X will increase monitoring of account hijacking. Stolen accounts posting fraudulent content are currently one of the main carriers of crypto fraud on the platform. According to Bitget, the new verification system will also target robot accounts that impersonate legitimate crypto companies. Such accounts usually reply below official posts and disguise themselves as customer service personnel to lure victims.
Since joining X as Product Leader in July 2025, Bier has led multiple rounds of anti-spam campaigns. In October of last year, X removed 1.7 million robot accounts for replying to spam information; in the same month, an account transparency tool was launched to publicly display metadata such as account registration countries and username change history. In January of this year, X also imposed restrictions on InfoFi-like apps (platforms that monetize information and user interactions) because such accounts post large amounts of low-quality AI-generated content and respond to spam.
Judging from the point of time, Bier's statement coincided with a fraud incident that attracted widespread attention. According to TradingView quoting Cointelegraph, a scammer recently posed as a veterinarian responsible for taking care of the health of the 193-year-old turtle “Jonathan” and promoted a Solana-based meme coin “JONATHAN” on social media. The token once surged more than 6000% and then quickly collapsed. The BBC and other media later revealed the truth about the scam.
As of now, X has not announced a specific launch schedule for this autolock feature.
Twitter:https://twitter.com/BitpushNewsCN
Compare the TG exchange group:https://t.me/BitPushCommunity
Compare TG subscriptions:https://t.me/bitpush
