Crypto Project X Account Hacked? A Response Playbook

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Warn users on every other channel not to click the account's links, and recover it through X's own process. Then revoke unknown sessions, apps and delegates, check the phone and email, and switch to hardware keys.

Watch: Crypto Project X Account Hacked? A Response Playbook 1:38

Video transcript

A project's X account is its most trusted link, so attackers want it. When it posts a scam, warn users first, then recover, investigate and harden.

In October 2025, BNB Chain's X account posted ten phishing links to nearly four million followers. The team put user losses at about eight thousand dollars.

The scam stays live while you work, so warn users on your website, in Discord and Telegram, and through team accounts. Say there is no airdrop, mint or migration.

Blockaid found drainer accounts pushing lookalike revoke sites around official posts. Tell users no link in the replies is yours.

Getting back in is not getting the attacker out. Per the Security Alliance, sign out unknown sessions, revoke apps and delegates, restore your email and phone, and reset two-factor.

Then clean up: record the evidence, delete the scam posts, check the bio, and post an all-clear.

Next, find the root cause. The SEC lost its account to a SIM swap, Mandiant likely to a brute-forced password. Also check the account email and approved apps.

Both accounts lacked strong two-factor. CISA calls FIDO the only widely available phishing-resistant method, while SMS codes are open to SIM swaps. Register two hardware keys and remove the phone number.

Guardian's OpSec Audit maps every path to your funds. Read the full playbook, or talk to Guardian at guardian.security.

On October 1, 2025, BNB Chain's X account, with nearly four million followers, posted ten phishing links in a fake rewards campaign.

The team regained control that morning. It put user losses at about $8,000 and said it would reimburse them, Cointelegraph reported.

A project's own account is the most trusted link it has, which is why attackers want it. This playbook covers the first hour, the recovery, the root cause and the hardening.

Warn Users First

The scam post stays live while you work on access. Every minute it is up, followers can click.

Post a warning everywhere you still control:

A banner on your website and docs.
Pinned announcements in Discord and Telegram.
Founders', team members' and partners' accounts on X.
Exchanges, wallets and security firms that can amplify it.

Keep it short. Say when the account was taken, that its links are unsafe, and that there is no airdrop, mint or migration.

When BNB Chain's account was taken, Binance co-founder Changpeng Zhao told users not to click "any links recently posted from this account."

Expect fake replies

Drainers answer your warnings too. After the Drift, KelpDAO and ZetaChain incidents in April 2026, Blockaid found drainer accounts on X pushing lookalike "revoke" sites around official posts.

So tell users that no link in the replies is yours, and give one address to type by hand.

If anyone connected a wallet or signed on the scam site, point them to what to do when a wallet is drained.

Recover the Account

Start with X's own process. Mandiant, whose account was taken over on January 3, 2024, regained control "working with X."

If you still control the account email, reset the password at once. If the attacker changed the email or phone, start from X's Help Center page for compromised accounts.

Getting back in is not the same as getting the attacker out. The Security Alliance (SEAL) says to "log out of all sessions, revoke suspicious apps, and change your password immediately."

Then work through these settings, in order:

Setting	What to do	Why, per SEAL
Sessions	Sign out every device you do not recognize	Unfamiliar sessions are possible persistence
Connected apps	Revoke anything unneeded or unknown	App tokens remain until revoked
Delegates	Remove members you did not add	Delegate access can outlast your recovery
Email and phone	Restore your own; remove the phone if you can	A hijacked number can reset the password
Two-factor	Re-register methods and generate new backup codes	Backup codes bypass two-factor

Check every scheduling or team tool that can post, too. SEAL's X guide names Typefully and says to keep Publisher and Admin roles to a minimum.

Remove the Scam Posts

Once you hold the account, clean up before you post anything new:

Record post IDs, screenshots and phishing domains first.
Delete the scam posts, replies and quote posts.
Check the bio, website link, display name, header and pinned post.
Read sent direct messages for phishing sent in your name.
Clear queued posts in any scheduling tool.

Then post an all-clear from the account itself, with the time window and what users should do. Repeat it on every channel that carried the warning.

Report the phishing domains to their registrar and host, so the pages come down.

Find the Root Cause

Do not close the incident until you know how they got in. Two public cases found two different doors; a third is unexplained.

Account	Date	How it was taken	Source
SEC	Jan 9, 2024	SIM swap of the linked phone; MFA off since July 2023	SEC
Mandiant	Jan 3, 2024	Likely a brute-forced password, without adequate two-factor	Mandiant
BNB Chain	Oct 1, 2025	Not disclosed; root cause under investigation	BNB Chain

SIM swap

A SIM swap convinces a carrier to move your number to the attacker's SIM, CISA explains. The attacker then gets the texts meant for you.

In the SEC case, the Justice Department says the swapper used a fake ID made with a victim's personal information.

The SEC says X Support had disabled the account's MFA at staff's request in July 2023, "due to issues accessing the account."

If a phone tied to the account lost service, call the carrier and ask whether the number was moved.

Email compromise

Whoever controls the account email can start a password reset. Check that inbox for new sessions, forwarding rules and changed recovery details.

SEAL also says to confirm that any email claiming to be from X comes from an @x.com address.

Malicious apps

Some takeovers need no password. In September 2025, developer Zak Cole flagged a campaign that led targets to X's own app authorization screen, Cointelegraph reported.

The app was called "Calendar," spelled with two Cyrillic letters, and asked for broad account control. Approving it gave access with no password or two-factor code.

Passwords

Mandiant said its account was likely hit by a "brute-force password attack."

It added that "due to some team transitions and a change in X's 2FA policy, we were not adequately protected."

So check for a reused password, a fake login page in anyone's history, and staff who left without a password change.

Harden Before the Next One

The SEC and Mandiant accounts shared one gap: neither had strong two-factor protection when it was taken.

CISA calls FIDO/WebAuthn "the only widely available phishing-resistant authentication." It rates SMS codes as vulnerable to phishing, SS7 and SIM swap attacks.

SEAL's X guide turns that into settings:

Register two hardware security keys, a primary and a backup.
Turn off SMS two-factor and remove the phone number.
Turn on password reset protect.
Store backup codes offline, ideally printed.
Use a long, unique password.
Remove connected apps, sessions and delegates you do not need.

Add team rules on top:

Use an admin email that is not public and not tied to a person's name.
Put hardware keys on that email too, since it can reset the account.
Limit delegates and Publisher roles to the people who post.
Review apps, sessions and delegates monthly, and whenever someone leaves.
Write the warning post now, and agree who sends it.

The people behind the account matter as much as its settings. See our crypto OpSec baseline and how attackers social engineer multisig signers.

How Guardian Helps

Guardian's OpSec Audit maps every path to your funds and reviews how your team holds, approves and changes them. It covers access across every system and secrets handling.

Managed Security keeps that work current. Offchain, Guardian's Sentry watches your domains, DNS, certificates, cloud and code host, and a Guardian engineer responds when something fires.

Frequently Asked Questions

What should we post first when our X account is hacked?

A warning on every other channel you control: website, Discord, Telegram and team accounts. Say the account is compromised, give the time window, and say there is no airdrop, mint or migration.

Can a hacked X account be recovered?

Yes. Mandiant regained its account in January 2024 by working with X. BNB Chain regained its own the same day in October 2025. Afterward, remove unknown sessions, connected apps and delegates, or the attacker may keep access.

Does two-factor authentication stop X account takeovers?

Hardware security keys help most. CISA calls FIDO the only widely available phishing-resistant method, and SMS codes are open to SIM swaps. But two-factor does not stop a malicious app you approve, like 2025's fake Calendar app.

How do we know if it was a SIM swap?

Check whether the phone tied to the account lost service. The SEC found its number had been taken through the carrier. Call the carrier, ask whether the number moved to a new SIM, and remove the number from X.

Sources

Find every path to your funds

Guardian's OpSec Audit maps the keys, signers, people and access around your funds, and ranks the changes that close each path.

Talk to Guardian Explore Managed Security