X's Crypto Lockdown: Scam Flow vs. Liquidity Flow

X is directly attacking the financial incentive behind a major scam vector. The new policy auto-locks any account that mentions cryptocurrency for the first time, requiring additional verification before posting resumes. This is a targeted flow intervention aimed squarely at hijacked accounts used to promote scam tokens.

The core incentive being targeted is the immediate monetization of stolen credentials. Hackers use phishing attacks to take over accounts, then leverage the account's established trust to push fraudulent crypto projects. The auto-lock feature aims to kill 99% of that incentive by rendering hijacked accounts useless for spreading scams.

This move follows a recent wave of phishing attacks using fake copyright violation emails to trick users into revealing login details. The stolen accounts are then used to promote fraudulent giveaways and memecoins, a tactic that has plagued the platform for years.

Scam Token Liquidity and Volume Flow

The scam flow targets high-profile accounts for maximum reach. Phishing campaigns trick users into revealing login details, locking them out and hijacking their established trust. This allows scammers to post fraudulent content, like claiming to have bought an Audi with crypto earnings, to the account's followers.

A recent campaign used fake DMs from seemingly legitimate sources to spread the infection. One journalist reported receiving a message from a colleague asking to vote in a contest, which led to account compromise. This method leverages social proof to bypass user skepticism.

The financial mechanics are clear in tokens like $XA48Z. It has 100M liquidity pool and an 820M market cap, indicating significant speculative volume. The token's promotion relies on this hijacked account flow to drive wallet growth and price action, creating a direct link between platform security and crypto market liquidity.

Liquidity Flow Disruption and Price Action

The auto-lock policy directly attacks the primary liquidity source for new scam tokens. By killing the incentive to hijack accounts, it severs the immediate flow of wallet addresses and speculative volume that pumps these projects. This is a targeted strike against the 100M liquidity pool model, where volume is artificially inflated through social engineering rather than organic demand. The policy's success would collapse this artificial liquidity, likely causing sharp price declines for tokens reliant on that flow.

Yet the policy carries a significant risk of collateral damage. It may deter legitimate early-stage project promotion and community discussions on X. The platform's stated goal is to preserve a space for crypto proliferation, but the broad brush of an auto-lock could chill organic growth. This creates a tension between security and utility, where the flow of new ideas and projects might be as constrained as the flow of scams.

The policy's effectiveness hinges on a critical vulnerability: its dependence on Google's failure to stop phishing emails. Head of Product Nikita Bier explicitly criticized Gmail for not protecting users, framing the auto-lock as a necessary workaround. This reveals a key weakness-the policy only mitigates the symptom (account hijacking) after the phishing attack succeeds. If Google were to effectively block these initial credential thefts, the entire incentive structure Bier targets would vanish, rendering the auto-lock feature largely unnecessary.