A hacker renamed your X account and your old handle is free? See what X's terms say about usernames, the order to act in and the handle risks to watch.
Get back into the account first, then change the username back straight away, before someone else registers your old handle. X's Terms say X may reclaim usernames, and its terms pages do not promise to return a handle someone else has taken. Secure the login, restore branding, warn followers and keep an evidence log.
SummaryYou open X and your brand account is gone from its usual handle. Someone has taken it over, changed the username to something like a crypto wallet support desk, stripped the branding and started posting. Your followers are seeing it. The handle your customers know may now be free for anyone to grab. This is a race, and the order you do things in matters more than speed alone.
This guide keeps to X's own terms pages: the Terms of Service and the Privacy Policy, plus X's Transparency centre. It sets out a timeline, a handle risk check and what the pages do not promise. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 30 October 2026.
Sometimes, and the first hours matter. A username on X is a label on the account, so when a hijacker changes it, the account and its followers stay together but the old handle can become available. If you regain access before anyone registers the old handle, you can change it back yourself. If someone else registers it first, the pages we cite do not promise to return it. The Terms of Service say X may reclaim usernames, including to protect the service or its users, and for breaches of its rules. X decides in the end.
RTÉ reported on 16 October 2026 that two official Garda accounts on X were taken over in a breach related to cryptocurrency, and that the GardaInfo account was not available under that username for hours because it had been changed to appear as a support account for a cryptocurrency wallet. The report says the Gardaí regained control. The Hindu reported on 19 October 2026 that the X account of Hyderabad's airport posted cryptocurrency promotions after a hack, and that the airport later regained access and removed the posts. We take these details from the reports. They show the pattern, not how X handled each case.
| Stage | Action | Why it comes here |
|---|---|---|
| 1. Regain access | Use X's own password reset or account access routes from the real app or x.com | Nothing else works until you are in |
| 2. Lock the login | Set a new strong password used only for X, and turn on two-factor authentication with an authenticator app or security key | X's Terms ask for both, and it stops a second takeover |
| 3. Reclaim the handle | Change the username back as soon as you are in | The old handle may be free and anyone can take it |
| 4. Clean the account | Remove the attacker's posts, bio, links and any connected apps you did not add | Followers may still be clicking scam links |
| 5. Restore branding | Put back your name, photo, banner and website link | Followers need to recognise the real account |
| 6. Warn followers | Post from the restored account and your other channels that the posts were not yours | Limits harm from the scam posts |
| 7. Keep an evidence log | Screenshots, times, the fake username and any scam links | Helps any report to X or the police |
Step 3 is the one people miss. While you are busy deleting scam posts, someone could register your old handle and pose as you. Change the username back first, then clean up.
Before you change anything, take a few screenshots of the renamed profile, the fake username and a sample of the scam posts. Note the time you first saw them. Once you restore the account these traces disappear, and they are the clearest record you have if you later report the takeover to X, to your bank or payment provider, or to the police. Keep the screenshots off the compromised device if you can.
Once you are back in, check whether your old handle is still free. If it was taken while you were locked out, these questions help you decide what to do.
If someone is now posing as you on the old handle, our guide to reporting a fake X account impersonating you covers that route.
If the attacker also changed the email and phone on the account, reset links go to them, not to you. Our guide to an X account hacked with the email changed explains that situation. For accounts that posted crypto spam while hijacked, see our guide on X accounts hacked to post crypto. X's Terms of Service say you may not breach or circumvent any security or authentication measures, so anyone who offers to break into the account for you is offering to break X's terms.
X's 2025 Transparency Report says it uses a combination of machine learning and human review to enforce its Rules, and that it has an appeals process for any potential errors. That matters if your hijacked account was restricted for the spam it posted while you were locked out. Explain the takeover clearly when you ask X to look again, and include your evidence log.
Malaysian brands, agencies and public figures face the same crypto hijack pattern. Agree in advance who holds the login, keep the account email on a company inbox you control, and turn on two-factor authentication with an authenticator app or security key. If followers lose money to scam posts from your account, a report to the police or to CyberSecurity Malaysia creates a record alongside your report to X.
Some teams handle this alone, and the official routes stay first. The risks are real. The old handle can be registered by someone else while you work. Buying it back from a stranger is risky. Fake recovery helpers target brands at exactly this point. If the account carries your brand, your public service or your income, or you are unsure what the attacker changed, having an experienced team handle it is the safer choice. AwareXone does this work. See our X account help page.
A case review helps when your old handle has been taken, when the attacker changed the email and phone, or when several staff had access and you do not know which login leaked. We are a Malaysia-based team, independent of X, and we work through the official routes only. We never ask for your password or codes, and we cannot promise a result. Read how we work on our trust page.
More free guides on the same kind of problem.
