X's Crypto Post Lock: A 99% Scam Volume Kill?

X is implementing a direct, flow-based intervention to attack the economics of crypto scams. The core mechanism is an auto-lock for any account that mentions cryptocurrency for the first time. This forces users to go through additional verification before regaining posting privileges, effectively cutting off the immediate utility of hijacked accounts.

The explicit goal is to eliminate the primary incentive for attackers. Head of Product Nikita Bier stated the policy aims to "kill 99% of the incentive" for hackers who target accounts to promote fraudulent crypto schemes. This is a targeted strike at the profit motive, not just a technical fix.

Viewed through a flow lens, this is a blunt instrument designed to kill the volume of scam activity. By making hijacked accounts useless for immediate posting, the policy attacks the liquidity of the scam operation at its source.

The Scam Flow: Hijacking and Volume

The existing scam ecosystem runs on a simple, high-volume flow: hijack an account, then broadcast a fraudulent message to its entire network. This creates an immediate, viral channel for attention and engagement, which is the scam's primary currency.

The targeting is strategic, focusing on high-profile accounts with large followings. When a journalist or official like Kentucky horse racing writer Jennie Rees is compromised, the scam's reach explodes. As Rees described, her contacts began receiving that bogus DM that started it all. This hijacking turns the victim's trusted network into a direct conduit for scam promotion, flooding their followers with the fraudulent message.

Catalysts and Flow Implications

The policy's effectiveness hinges entirely on the friction of the verification process. If the additional steps are quick and easy, the lock may be a minor nuisance. But if they are slow, complex, or require multiple attempts, they will act as a significant deterrent. The core incentive for attackers is to post a scam and move on. Any process that delays or blocks that immediate utility directly attacks the flow of the scam operation.

The primary flow impact will be a sharp reduction in the volume of scam posts originating from hijacked accounts. By design, the auto-lock kills the immediate utility of a compromised profile. This should force a direct, measurable drop in the number of scam messages broadcast from hijacked networks. The goal is to "kill 99% of the incentive", which translates to a massive reduction in scam volume if the verification hurdle is high enough.

Watch for shifts in scam tactics as attackers adapt. The most likely response is a move toward more direct phishing aimed at new, clean accounts rather than hijacking existing ones. This could lead to a rise in suspicious crypto-related post volume from fresh accounts, as scammers try to bypass the lock. Monitoring the volume and velocity of these new crypto mentions will be a key early indicator of whether the policy is working or if the scam ecosystem is simply finding a new vector.