X (Twitter) Account Hacked? Recovery Steps That Work

Your X account is not a chat app. Losing it costs you an audience you cannot rebuild overnight, a posting history people attribute to you, and a direct line into your contacts inboxes, which is exactly what the attacker was after. This guide follows the order the situation itself demands: work out what actually happened, secure the channel that controls recovery, use the platform's own two paths, then close every door the attacker left open. Nothing here asks you to break into anything. All of it is about proving you own the account and getting it back through X's own forms.

Why an X account is a reputation target, not a message store

On a messaging app the attacker wants your conversations. On X the attacker wants your credibility. A handle with years of posts behind it is borrowed trust: when it announces a token, a giveaway or an emergency, people believe it long enough to send money. That is why takeovers on X cluster around financial fraud and impersonation rather than quiet reading, and why the first scam post usually appears within minutes, not days.

The commercial side matters too. Accounts with a large following are resold, used to push affiliate spam, or held to extort the owner. In every one of those cases the loss compounds while you are still looking for a support form, so the sequence below is ordered by minutes, not by convenience.

Signal check: takeover, deactivation or lock

These three look similar from the outside and are handled by three different procedures. Sending the wrong one costs you the attempt you needed, because a hacked-account report on a merely locked profile gets answered as a lock, not as a takeover.

If your signals are in the second column, start with the reset and appeal path. If even one strong signal from the first column is present, treat it as a full takeover from that moment and stop logging in from unfamiliar networks, which is how lockouts pile up on top of a takeover.

Secure the recovery email before you touch X

Every password reset on X ends up in the mailbox attached to the account. If that mailbox is compromised, resetting the X password hands the new password to the same person who took the account. So the email comes first: change its password, enable two-factor authentication there, then read the settings the attacker would have changed.

• Check forwarding rules and filters for an address you do not recognise. A silent forward is how reset emails disappear.
• Check the recovery email and recovery phone on the mailbox itself, not only on X.
• Review recent login activity and active sessions on the mail provider, then sign out everywhere.
• Look for the platform email-change notice. X mails the previously used address when the email on an account changes, so that alert, often in spam or a social tab, gives you the exact moment the takeover started.

Path A: you can still log in, so contain in order

Path B: you are locked out, so reset once and then use the form

Start with the reset flow, using the recovery channel you still control. Go to x.com, choose Forgot password and enter the username, email or phone on the account. Email is usually the strongest channel; a phone number is weaker if you suspect a SIM swap, and it is the wrong choice if the number was never yours.

If the reset never arrives because the email or phone was changed, move to the compromised-account form in the help centre: I need login and account support, then I need to regain access to my account, then the option for a hacked or compromised account. Two fields decide the outcome, and the platform states both explicitly.

One complete request is faster than five partial ones. Keep the automated ticket number and reply inside that thread rather than opening new forms, since duplicates are treated as separate cases and reset your queue position, not help it.

If the attacker changed the email: the ownership proof card

This is the case where most people give up, and it is also the case where a prepared file wins. Build one document before you submit anything: a plain chronology of the takeover with dates, the details listed above, and the evidence attached in the order it happened. Then state clearly in the request that the email on the account was changed without your consent, and name the address that was there before.

Response times vary with the queue and the quality of the evidence, and a paid subscription can move a ticket into a different queue without guaranteeing an outcome. Do not promise yourself a date. Do check the spam and social folders of the original mailbox daily, because that is where support replies and the platform notices land.

If the original mailbox itself is gone, recover that first. When both the email and the phone on an account are lost for good, the help centre is candid that creating a new account may be the only remaining option, which is why securing the mailbox is worth more than any other hour you spend on this.

What the attacker is doing while you wait

• Posting a token, giveaway or emergency appeal to your followers, then deleting it once payments arrive.
• Direct-messaging your contacts to ask for a code, a favour or a transfer, using your name and your history with them.
• Editing the profile to point at a lookalike site that harvests logins from the people who trust you.
• Farming follows and engagement so the account looks healthy when a buyer inspects it.
• Trying to lock you out of the email too, so the recovery channel disappears with the account.

Warn your audience through a channel the attacker does not control: a pinned post on another profile, a story, a group chat, a short note to the people most likely to be targeted. A warning that arrives before the scam message is worth more than a correction afterwards. If you cannot post at all, ask two or three close contacts to relay it.

Cleanup after recovery, in order

1. Set a fresh password again, since the one you used during recovery may have been typed on a device the attacker influenced.
2. End all other sessions and re-check connected apps, then wait ten minutes and check again.
3. Confirm the email, phone and username are yours, and turn password reset protection on.
4. Enable an authenticator app or security key, and store the backup codes offline.
5. Read the DMs the attacker sent, then message each recipient that the request was not from you and that no money should move.
6. Delete the fraudulent posts and replies after you have captured them, and restore the profile fields, banner and pinned post.
7. Review billing and payment methods on the account, cancel anything you did not buy, and check linked subscriptions.
8. Read the account access history to establish how the attacker got in, so the next attempt meets a closed door.
9. Post one short, factual notice that the account was compromised and that any request for money from it is fraud.

If money moved during the takeover

Document first: screenshots of the posts and DMs, wallet addresses, amounts and timestamps. Then report inside the app, notify your bank or payment provider the same day, and file a police report with your local cybercrime unit. Recovery of transferred funds depends on how fast the receiving accounts can be frozen, which is measured in hours rather than weeks.

Then expect the second wave. Someone will offer to recover your money or your account by hacking the thief. That is a second fraud aimed at the same victim, and it is the reason our guide to cryptocurrency scam recovery spends as much space on the follow-up scams as on the first one.

Prevention that survives next time

• A unique, long password stored in a password manager, never reused from another site.
• Two-factor authentication with an authenticator app or a security key, with SMS as a fallback rather than the only factor.
• Password reset protection switched on, so a reset needs your email or phone.
• A recovery mailbox as well defended as the account itself: its own strong password, its own two-factor, no silent forwarding rules.
• Email-change alerts left on and actually read, since they are the earliest signal you will get.
• A quarterly pass over connected apps, and the habit of never entering a code because a DM asked for it.

The same pattern, with the platform-specific details, is in our guides to WhatsApp, Instagram, LinkedIn and account recovery in general. If the takeover started with a phishing email rather than a password guess, the sequence in our email hacking investigation guide covers the mailbox side, and phone hacking detection covers the SIM and device questions.

When a professional is the right call, and the limits

For a business, creator or brand account with revenue attached, assembling the ownership file, drafting a request that survives review, chasing the ticket and then hardening the account afterwards is real work, and it is the part most owners do badly under pressure. An authorised engagement can do all of it without ever holding your password.

What nobody can lawfully do is log in as you, guess credentials, persuade an employee to reset the account, or take it back by force. Unauthorized access is a crime regardless of who held the account first, and any offer framed that way is an attempt to take it again. For a company profile the engagement starts with written authorization from the owner of record, because that document is the line between recovery support and unauthorized access.

If you are at that point, describe the timeline and what proof you still hold, and we will tell you which route your case belongs to before anything is submitted: our recovery and investigation services are built around the platform's own channels.