Twitter/X Account Hacked? What to Do Now

A hacked X (Twitter) account often shows up as posts or DMs you didn't send, frequently promoting a scam or crypto link, sent out before you've even noticed anything's wrong. Recovery is usually straightforward if you act as soon as you notice.

Signs Your X Account Has Been Hacked

• Posts or replies you didn't write, often promotional or scam-related.
• Direct messages sent from your account that you didn't send.
• You're logged out and your password no longer works.
• Your email, phone, or username on the account has changed.

Step 1: Try to Reset Your Password First

If you can still access the login screen, use the standard "Forgot password" flow at x.com first — this resolves many cases quickly, especially if the attacker hasn't yet changed your recovery email or phone.

Step 2: If the Attacker Has Changed Your Details

If the password reset doesn't work because your recovery email or phone has already been changed, you'll need to go through X's account support form and verify your identity — this can include confirming your original account details, past usernames, or associated phone/email history. It takes longer, but it's the correct path once the standard reset is blocked.

Step 3: Once You're Back In

• Check active sessions under Settings → Security and Account Access, and log out anything unfamiliar.
• Review connected apps and revoke access for anything you don't recognize.
• Delete any posts or DMs sent while the account was compromised.
• Change your password, and don't reuse one from another account.
• Turn on two-factor authentication — an authenticator app is stronger than SMS.

Warn People Who May Have Received Messages

If DMs were sent from your account while compromised, a quick public post once you're back in control (or a direct heads-up to anyone who may have received a suspicious message) limits the damage.

If Other Accounts Share the Same Password

A hacked X account is frequently the result of a reused password exposed in an unrelated breach. See Microsoft Account Hacked? What to Do Now and Facebook Account Hacked? What to Do Now if you suspect the same credentials were used elsewhere.

Checking Your Broader Exposure

Scan My Shadow checks your phone number and email across 1,500+ sources so you can see exactly what's publicly exposed, rather than guessing where a hack might have originated.

Related Reading

• Facebook Account Hacked? What to Do Now — recovery steps if Facebook is also affected
• Microsoft Account Hacked? What to Do Now — the equivalent process for Outlook and Microsoft accounts
• My Email Account Was Hacked — What to Do — the broader email-recovery playbook