X Money Offers New York Users $300 Bonus as Bitcoin (BTC) Payments Push Hits NYDFS Wall

NYDFS Halts Interest on X Money Balances

X Money has replaced interest with a one-time payment for New York users after the New York Department of Financial Services (NYDFS) told Elon Musk's payments arm this week that it cannot keep paying bank account-style interest on balances held in non-bank accounts. The intervention targets a product that behaves like a checking account in every customer-facing way while legally sitting outside the banking system. X Money does not offer bank accounts in New York. Customers instead hold funds in what the company calls a stored value account, marketed as a place to “earn yield,” get cashback, send wires, mail checks, pay bills and make free ATM withdrawals while being “protected with FDIC coverage.” The fine print tells a different story. The account terms state that “X Payments is not a bank, is not FDIC-insured, and does not take deposits,” even though our review of the X Money homepage found the word deposits used 16 times. The distinction matters, because stored value accounts carry none of the consumer protections attached to bank deposits, and marketing language about FDIC coverage risks blurring that line. The license record is equally explicit: NYDFS approved X Payments LLC as a money transmitter — a business that moves money for the public, not a deposit-taking institution — effective July 23, with license number MT-105532 issued July 24, and the company's own license page concedes in a single line that “X Payments LLC is not a bank.” To keep New York users from pulling funds out, X Money restructured the payout: balances could “obtain interest” through September 30, and from October 1 customers instead “earn a $300 bonus,” credited within 14 days of $3,000 in qualifying deposits. The official direct deposit bonus page repeatedly stresses that the payment “does not constitute APY or interest” — interim compensation in everything but name.

Password Reset Flood Targets X Users

Security is the second pressure point. X users across several regions began reporting unsolicited password reset emails in August, and the reports surged on September 1. The emails are genuine — they originate from X's own system — but the account holders never requested them, and the company says it is investigating. The likely mechanism is low-tech: because usernames are publicly visible, an attacker can repeatedly submit the forgot-password form for any handle and trigger reset emails at will. So far there is no evidence of a breach of X's platform and no confirmed wave of account takeovers, but the technique works as a probe, mapping which accounts have weak defenses before a more targeted attempt. X's guidance is to ignore links inside unexpected reset emails and check account status only through the official app or website, then harden the account with password reset protection, two-factor authentication and passkeys. The stakes are rising as X matures into a financial venue. The everything-app playbook — the model that layered payments and financial services onto social platforms after earlier bundling attempts by services like Uber — means a compromised social account is no longer just a hijacked feed. If the same login controls wire transfers, stored balances and bill payments, credential probing becomes attempted financial theft, and scam playbooks crypto users already know from the rug pull era migrate toward account-level attacks. In markets such as Japan, where X's payment and investment features have yet to launch, the reset wave is a preview: users are inheriting financial-grade risk before financial-grade products arrive. Decentralized identity built on blockchain domains and peer-to-peer crypto rails such as Bitcoin Cash remove the centralized reset endpoint entirely — but they shift recovery responsibility onto the user. Readers tracking the market in real time can follow live spot and futures prices on Binance.

One Perimeter, Two Warnings

Read together, the NYDFS order and the reset flood describe the same fault line from two sides. Our reading of the primary records — X Payments' own license disclosure MT-105532 and its stored value account terms — confirms the company itself states it is not a bank and takes no deposits; the regulator applied the existing perimeter rather than inventing a new rule. Meanwhile, the reset campaign shows how cheaply that perimeter can be probed when usernames are public. For users weighing an everything-app wallet against self-custodied assets in X's crypto-era payments push — from Bitcoin to privacy-focused Zcash — the trade-off is now explicit: convenience against control.