What does an x account compromised by someone else look like?
An X account is compromised when someone other than you can post, message or change settings on it. X's help page on a compromised account lists six signs: posts you never wrote, Direct Messages you never sent, follows, unfollows or blocks you never made, a notice from X that the account may be compromised, a notice that your account information changed when you changed nothing, and a password that suddenly stops working. One sign is enough to act. Two or more, and the question of whether someone hacked my x account is already answered. Those notices arrive by email, so the inbox tied to the account is the first place to look, before you even try to log in, because it also holds the dated record of what the intruder changed, and exactly when.
Not every odd post means a stranger is inside. According to X, a buggy third-party app can post on its own, and revoking that app's access stops it. Passwords that no longer work, an email you don't recognise on the account, or DMs your friends ask about are different: those point to a person, not a bug. People type "my twitter got hacked", "my x account got hacked" or "hacked on twitter" into search at this moment, and the honest answer is the same for every phrasing. Whether my twitter account is hacked or simply misbehaving comes down to those six signs.
Search phrases such as "x hacked account", "twitter hacked account", "hacked x account" and "hacked twitter account" all describe one situation, and so do "x account was hacked", "my twitter account hacked" and "my x account has been hacked". Whichever words you used, the order of moves below works for each of them.
Lookalikes cause most of the confusion. Sudden locks after login attempts are covered in our guide to how to unlock my suspended twitter account, and falling reach with no strange activity is usually a twitter shadow ban, not a hacker.
Your Reputation Solution is an account recovery and reputation management service that helps people regain social accounts through each platform's own forms, and a twitter account hacked by a stranger is one of the cases it handles most carefully, because the first hour decides how much proof survives.
Can you still log in? The first-hour order of moves
If you can still log in, change the password first and revoke app sessions second; everything else waits. X's own sequence is five steps: change the password, secure the email address, revoke unknown third-party apps, update the password inside apps you trust, then contact Support. Order matters because a new password alone does not end every session. In X's words, changing the password does not log the account out of the X apps for iOS or Android. Visit Settings, then Apps, and revoke access there, and the next launch of the app asks for the new password. Do it from a device you trust, not the one where a suspicious link was opened, and keep the old session list as a screenshot first. Those entries show the devices and approximate places the intruder used, which helps later if X asks what happened. Anyone wondering how to recover hacked x account access while still logged in has the easiest version of this problem.
When we prepare a hacked-account request, three facts get written down before any form is touched: the exact username, the email and phone that were on the account before the attack, and the last date the owner was able to log in. Your Reputation Solution asks for those because X's own support form asks for the username and the date of last access, and a request that gets them wrong usually comes back asking again.
Two smaller settings close doors the attacker may come back through. You can require your email address or phone number before anyone can start a password reset, which blunts reset spam. Teams users in X Pro should check the members list and remove anyone they don't recognise. Then scan the computer you use for X, because malware that collected one password will collect the next one.
Already locked out? Begin at the reset page instead, and if the reset email never arrives, the steps to recover twitter password access cover the username and email lookups X allows.
Accounts deactivated by the intruder have a clock on them, so check how to recover deactivated twitter account after 30 days before assuming the profile is gone for good.
For the broader map of every X recovery route, from locked to banned, our walkthrough on how to restore twitter account access sits one level above this page.
Twitter account hacked and email changed: how do you undo it?
Check your inbox for a message from [email protected] about an email change; X says the link in that message reverses the change. That single sentence from X's compromised-account page is the fastest fix a twitter account hacked and email changed can get, because it hands the address back to you before the attacker settles in. Search the old inbox, the spam folder and any archive rule for that sender, and click only the link inside the real message, never one forwarded to you. Attackers who get into the email account first sometimes add a filter that deletes X's mail, so open the mail settings and remove any forwarding or filter rule you did not create. Then change that email password too. Through all of this, Your Reputation Solution can walk you through each check, but only X can hand the account back.
Revert link gone or already used? The next door is the phone. On its page about email address access, X confirms that a verified mobile number can receive the reset by SMS. When neither works, file the hacked or compromised account form from the account's original email address, with the username and the date you last had access. Phone verification inside that form helps X confirm ownership, and a number previously on the account may be re-added after review. If my twitter account was hacked and every reset path is closed, that form is how to get hacked twitter account back.
One limit needs saying plainly: without the account's email or a verified mobile number, X writes, it is "unable to continue troubleshooting", and no outside service can override that rule.
Owners who also lost the second factor should read how to recover twitter account after lost two factor authentication, since backup codes change which form applies.
Missing both email and username is a different job. It is explained in how to recover twitter account without verification code access.
How do you report a hacked Twitter account to X?
You report your own hacked account through X's hacked or compromised support form, not the in-app report button. Report menus on posts are built for rule violations by other accounts, while the support form is how X verifies that you own an account. Searches like "report hacked twitter account", "report twitter account hacked" and "twitter report account hacked" usually mean that form. File it once, from the email address tied to the account before the attack, and add the username, the date you last had access and a short factual description of what changed. Duplicate tickets from several addresses make ownership harder to prove, not easier. Save screenshots of the posts and DMs the attacker sent, with their dates, before you delete anything, because X's guidance on precautions says to delete unwanted posts and those posts are the evidence. In these cases Your Reputation Solution keeps the ownership request and content reports in one dated log.
Reporting someone else's hacked account is a different job. Use the post's report menu to report a twitter user when the hijacked profile sends spam or scam links, and tell the real owner through another channel.
Clones are the other half. Built a copy of your profile? Our page on how to report fake x account profiles walks through the impersonation route.
Hijacked accounts are sometimes used to publish leaked personal details or stolen media. Those posts have their own channels: doxxing on twitter reports and an x dmca takedown for copied photos or video.
Single posts the attacker left on accounts you don't control can be challenged too; see how to delete someone's tweet through the report and legal routes.
Threats sent from or about a hijacked profile belong in a separate file. Our twitter report scammer guide covers blackmail and extortion messages, which should never be paid.
Why would my x account was hacked and suspended at the same time?
X may suspend an account it believes is hacked until it can be secured and returned to the owner. Its page on suspended accounts lists "account security at risk" as a suspension reason of its own, aimed at limiting what a compromise can do. So a person writing "my x account was hacked and suspended" may be looking at a protective lock, not a penalty. Worse is the other version: the attacker posts crypto spam or mass-follows, automated systems read it as platform manipulation, and the suspension lands as a rule violation. Cases of an x account hacked and suspended therefore run on two tracks. One track proves the account is yours through the hacked form. The other explains, through X's appeal form, that the violating activity started on a stated date and came from the intruder. Running only one track is the most common reason these cases stall.
Before either request goes in, Your Reputation Solution lines up the dates from X's change notices with the first spam post, because that timeline is what makes the appeal believable.
Appeals for spam the intruder posted read much like those in x account restored but still suspended cases, where the account is back but the label is not.
Permanent outcomes need a different plan. A separate guide to x twitter suspended account recovery covers accounts X has closed for good.
Suspensions also come from outside. Some attackers, or the people who hired them, buy mass reports; read how to get a twitter account banned to see why those campaigns mostly fail.
Sellers of "takedown" packages often pitch hacked owners too, and what a Twitter ban service actually is explains what such services can and cannot honestly offer.
Strange followers arriving after the attack are usually fallout, not a new breach; the twitter bots following me guide shows how to clear them.
What keeps it from happening a second time?
Turn on two-factor authentication with an authentication app or a security key, then revoke every app you don't use. On its two-factor authentication page, X offers three methods: text message, authentication app and security key. Since 20 March 2023, text-message 2FA is available only to X Premium subscribers, so most owners should pick an authenticator app or a hardware key. Save the backup code shown at enrollment somewhere offline. Use a new password you have never used anywhere else, because X lists reused or weak passwords, malicious third-party apps, malware and compromised networks as the usual ways in. Teams members, connected apps and the email account itself all deserve the same audit. People searching "x account hacked how to recover" rarely ask how the attacker got in, yet that answer decides whether it happens again within weeks. That audit is part of every recovery file Your Reputation Solution builds.
Valuable handles attract repeat attacks. Owners of a short or x priority handle should expect phishing that targets the name itself.
Stolen names are sometimes resold, which is why guides on how to sell a twitter handle warn buyers to check ownership history.
Abandoning a compromised profile is an option too. But when does twitter delete inactive accounts is a slower answer than most expect, so delete the account yourself if you choose that route.
Attackers who take an X login often try the Telegram account on the same phone number next. Lost that number too? See how to recover telegram account lost phone access, and read how to recover telegram account without two step verification before you request another code.
Telegram holders should secure the rest of that side as well: see how to recover telegram account lost email settings and telegram account recovery after deleting account limits before an attacker tests them.
Recovery scams follow every public hack. Within hours of a post saying someone hacked my twitter account, replies and DMs arrive from "recovery experts" asking for a fee, your password or a login code. We never ask for your password or 2FA codes, we never promise a result, and we never pay or contact the attacker for you; our disclaimer spells out those limits.
Need a second pair of eyes on a hacked X account? Your Reputation Solution reviews what you still control, prepares the hacked-account and appeal requests, and tells you honestly when X's own rules close a door. Get a free recovery review.
Speed still matters after the account is back: delete the attacker's posts once screenshots are saved, warn followers who received DMs, and watch the email inbox for further change notices. For anyone asking "twitter got hacked what to do", that short list after the five official steps is the part most often skipped.