How to Recover a Hacked X Account in 2026
If you need to know how to recover a hacked X account, speed and accuracy matter more than guesswork.
The right sequence can help you regain access, stop further damage, and lock down your account before the attacker spreads posts or changes recovery details.
X, formerly Twitter, uses a mix of login verification, email-based account recovery, and security prompts, so the exact fix depends on what the attacker changed.
The steps below cover immediate containment, recovery, and the security settings that reduce the chance of another takeover.
Signs Your X Account Has Been Hacked
Before you begin recovery, confirm the compromise.
Some signs are obvious, while others are easy to miss if the attacker is trying to stay hidden.
- Posts, reposts, or direct messages you did not send
- Email or phone number on the account has changed
- Password no longer works
- Login alerts from unfamiliar devices or locations
- New app connections you did not approve
- Followers report spam, scams, or suspicious links from your profile
If you still have access, act immediately.
If you are locked out, move straight to account recovery and avoid repeated failed login attempts that can slow the process.
First 10 Minutes: What to Do Immediately
Fast containment limits damage.
Start with the devices and accounts connected to X, not just the X login itself.
- Check your email inbox for messages from X about password, email, or phone changes.
- Change the password on your primary email account first, especially if it is the recovery method for X.
- Scan your device for malware using a reputable security tool.
- Log out of all other sessions if you still have access.
- Remove any suspicious connected apps or third-party services.
- Warn your followers through another channel if the account is posting scams.
Securing your email is critical because most account recovery flows depend on it.
If an attacker controls your inbox, they may be able to keep re-taking the account even after you reset the X password.
How to Recover a Hacked X Account if You Still Have Access
If you can still sign in, recovery is usually faster.
Your goal is to remove the attacker’s changes before they regain control.
Change your password immediately
Choose a strong, unique password that has never been used on another service.
A password manager is useful here because reused passwords are a common cause of account compromise.
Verify your email address and phone number
Open account settings and confirm that the recovery email and phone number are yours.
Replace any details you do not recognize.
Review active sessions and devices
Look for unfamiliar logins, especially devices in other countries or sessions from browsers you do not use.
End all suspicious sessions and, when available, sign out of every device.
Revoke third-party app access
Attackers often exploit connected apps or compromised OAuth permissions.
Remove any app you do not trust, and review permissions for scheduling tools, analytics platforms, or automation services.
Turn on two-factor authentication
Use an authenticator app or hardware security key rather than SMS if possible.
SMS-based verification is better than nothing, but authenticator apps and passkeys are stronger against SIM-swap attacks and phishing.
How to Recover a Hacked X Account if You Are Locked Out
If the password, email, or phone number has been changed, use X’s account access and password reset tools.
The exact prompts can vary, but the recovery process generally follows a similar path.
- Go to the X login page and select the option for password reset or account access help.
- Enter your username, email address, or phone number associated with the account.
- Use the recovery link or code sent to your email or phone.
- If those details were changed, follow the on-screen prompts to report unauthorized access.
- Submit any identity verification details requested by X.
Use the original email address tied to the account whenever possible.
If the attacker replaced it, search your inbox for X messages showing the date and nature of the change, since those emails can help support verification.
What to Include When Contacting X Support
If automated recovery does not work, contact X support with clear, factual details.
The more evidence you provide, the easier it is to prove ownership.
- Your X handle and display name
- The email address and phone number originally linked to the account
- Approximate date the compromise began
- Any unauthorized changes to email, password, or phone
- Examples of suspicious posts or messages
- Screenshots of account alerts from X or your email provider
Keep your explanation short and direct.
State that the account was hacked, you are the rightful owner, and you need help restoring access and reversing unauthorized changes.
Check for Damage Beyond the X Account
A hacked X account is often part of a larger compromise.
Attackers may try to pivot into your email, other social platforms, crypto wallets, or business tools.
- Change passwords for any account that reused the same password as X
- Review linked banking, payment, or crypto services if you shared sensitive information
- Check whether the attacker sent phishing links to your contacts
- Alert colleagues if the account was used for brand or company communication
- Search for unauthorized API keys or developer app access if you use X for business
If your X account was tied to a business presence, treat the incident as a reputation and security event.
A single compromised post can damage trust quickly, especially if the account has a large audience.
How to Remove Unauthorized Posts and Messages
After access is restored, clean up the account carefully.
Do not just delete suspicious posts and move on; document what happened first.
- Take screenshots of unauthorized posts, DMs, profile changes, and login alerts.
- Delete scam posts, fake links, and spam messages.
- Review your account bio, pinned post, profile image, and username for tampering.
- Check for direct messages sent to followers or contacts.
- Notify affected users if the attacker impersonated you or requested money.
Documentation can help if there are complaints, impersonation reports, or later disputes over the compromise.
It also makes it easier to track whether the attacker accessed the account through phishing, malware, or credential reuse.
How to Prevent Another X Account Hack
Once the account is recovered, focus on hardening it.
Prevention is much easier when you remove the common attack paths that hackers rely on.
Use unique credentials
Every important account should have a unique password.
Reuse is one of the fastest ways a breach on another website becomes an X takeover.
Enable passkeys or an authenticator app
Passkeys reduce reliance on passwords and are resistant to common phishing tactics.
If passkeys are not available for your setup, an authenticator app is the next best choice.
Audit recovery methods regularly
Keep your recovery email current and protected with strong authentication.
Remove old phone numbers that could be reassigned or accessed by others.
Limit third-party access
Only connect apps that are necessary and reputable.
Review them periodically, especially if you have used automation, publishing tools, or social media dashboards.
Watch for phishing attempts
Attackers often impersonate X support or send fake security alerts.
Never enter your password on a page reached through a suspicious link, and verify the domain before logging in.
When the Account Cannot Be Restored
In some cases, recovery is not immediate.
If support requests more proof, follow up with the same email thread and provide consistent information.
If the account is permanently inaccessible, protect your identity and online presence elsewhere.
- Claim or secure similar usernames on other platforms if appropriate
- Tell your audience which accounts are official
- Monitor for impersonation accounts
- Continue watching your email for sign-in attempts or password reset requests
Even when access takes time, staying organized improves your chances.
Keep a record of support tickets, recovery emails, screenshots, and the timeline of events so you can respond quickly to new requests from X or other services.