Elon Musk’s X botched its security key switchover, locking users out

Thousands of users are reporting they’ve been locked out of their X accounts or trapped in endless login loops following a botched security update tied to Elon Musk’s ongoing rebrand of Twitter.

The problem arises from a mandatory two-factor authentication (2FA) change that took effect after November 10. On October 24, X had warned users who rely on passkeys or hardware security keys — such as YubiKeys — that they would need to re-enrol their credentials under the new x.com domain. Users who use an authenticator app were not affected.

What Went Wrong

When X officially migrated from twitter.com to x.com in May 2024, many passkeys and hardware keys remained tied to the old domain. These credentials can’t be automatically transferred — meaning users had to manually un-enrol and re-enrol using the new site.

As the deadline passed, countless users across social media began sharing reports that they couldn’t log back into their accounts, were receiving error messages, or were stuck in endless verification loops.

“Every time I try to log in, it just keeps asking me to re-enroll — I’ve done it ten times,” one user wrote on Threads.

This glitch effectively locks users out until they switch to another form of 2FA or X resolves the authentication issue.

Part of a Larger X Transition

The failure marks another setback in Musk’s long-running effort to retire Twitter’s old branding in favour of X. Since Musk’s $44 billion acquisition in 2022, the platform has undergone sweeping changes — including massive layoffs, policy overhauls, and a new “everything app” vision combining payments, streaming, and messaging.

However, the platform’s infrastructure changes continue to cause disruptions. The 2FA breakdown is the latest in a string of technical issues tied to the rebrand.

X has not responded to requests for comment, though Musk himself appears unaffected, continuing to post on the platform as usual.