What to do in the first hour after your X account is hacked

If you're reading this because something just happened, skip the explanations and do the numbered steps. Each one closes a door the attacker might still have open. The order matters: the email account comes first because it's the master key to your X password.

Minutes 0 to 10: lock the inbox

1. Sign in to the email account linked to your X account, from a device you trust. If you can't, recover the email account first using your provider's own recovery process. Without the inbox you can't reset X.
2. Change the email password to one you've never used anywhere else, and turn on two-factor for the inbox.
3. Look for forwarding rules and filters you didn't create. Attackers add rules that hide or forward messages from X so you don't see the alerts. Delete them.
4. Check for recent mail from X about a password, email or phone number change. Those messages often include a link to secure your account. Open it only from the genuine X email, and if in doubt, go to x.com yourself instead.

If the attacker changed the email address on your X account, the old address usually gets a notice. That notice is your best route back, so don't delete it.

Minutes 10 to 20: take the account back

5. Reset your X password. If you're still logged in somewhere, change it in Settings and privacy > Your account > Change your password. If you're logged out, use Forgot password on the X login page and type x.com yourself.
6. Pick a new password you have never used before and store it in a password manager.
7. Review the email address and phone number under Settings and privacy > Your account > Account information. Remove anything that isn't yours.
8. Turn on two-factor authentication, or check it's still set to your own method. Attackers sometimes add their own authenticator app or remove yours. Our 2FA and passkey guide has the steps.

Minutes 20 to 35: cut every remaining door

9. Log out of every other session. Go to Settings and privacy > Security and account access > Apps and sessions > Sessions and log out all sessions you don't recognize. This is what kills a stolen session cookie.
10. Revoke connected apps under Apps and sessions > Connected apps. Remove everything you don't recognize. If you're unsure, remove it; you can reconnect a trusted tool later.
11. Check delegates if you use them. If your account has an X Delegate setup, look at who has access under Security and account access, and remove anyone unexpected. X notes that a password change doesn't remove delegates.
12. Update trusted apps that store your X password, so they don't keep failing logins and lock you out.

The connected apps and sessions guide explains what each entry means.

Minutes 35 to 50: clean up and warn people

13. Delete posts, replies and DMs you didn't send. Check your Posts and Replies tabs, your pinned post, your bio, display name, profile photo and header. Attackers often rename an account to look like a crypto project.
14. Check who you follow. Mass follows of spam or scam accounts are common. Unfollow them.
15. Warn your followers in a short post once you're back in: what happened, roughly when, and that they should ignore links or DMs sent from your account during that window. If people may have sent money or connected a wallet because of your account, say so plainly.
16. Tell close contacts directly through another channel if the attacker DMed them. A message from you saying "that wasn't me" stops the next victim.

If the attacker used your account to promote a giveaway, token or "investment," be specific in the warning. Tell followers which posts were fake, delete them, and say that you will never ask anyone to send crypto or connect a wallet. People who lost money should report it to the platform they paid through and to the police; you can't refund them, but a clear statement helps their reports.

Minutes 50 to 60: if you're still locked out

If the password reset doesn't work, or the attacker changed both the email and phone number, go to X's help center at help.x.com and look for the support request for hacked or compromised accounts. X asks you to use the email address associated with the account, and to include your username and the date you last had access. Use the original email address, even if the attacker changed it.

Expect an automated reply first. Answer from the same email address and don't open several duplicate tickets.

While you wait, don't answer accounts that reply to your public "I was hacked" post with offers to help. Recovery services that contact you first are a well-known follow-up scam, and some of them are run by the same people who took the account.

After the first hour

• Scan the computer you use for X. If the attacker got in without your password, a session-stealing infection is likely. Remove software you don't recognize, update the operating system and browser, and run a reputable malware scan. Then log out of all sessions again.
• Think about how it happened. A phishing link in a DM? A reused password? A recent "sponsorship" file? The common attacks guide helps you match the pattern, which tells you what else to change.
• Check other accounts that share the same password or email. If you reused the password, change it everywhere it was used.
• Save evidence such as screenshots of the attacker's posts, DMs and the timeline of alerts. If money was stolen from you or your followers, report it to the police or your country's fraud reporting service.

Once things are calm, run the security check. It takes five minutes and will show you which gaps are still open.

Source: X Help Center, Help with my compromised account.

Questions

TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.