# Onyx Protocol Twitter/X Incident (And possibility to recover stolen funds)

**URL:** <https://community.onyx.org/t/onyx-protocol-twitter-x-incident-and-possibility-to-recover-stolen-funds/1661>\
**Category:** Updates\
**Created:** [July 11, 2024, 8:04am UTC](https://community.onyx.org/t/onyx-protocol-twitter-x-incident-and-possibility-to-recover-stolen-funds/1661 "2024-07-11T08:04:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.onyx.org/alex/32/95_2.png) [@alex](https://community.onyx.org/u/alex)\
**Post date:** [July 11, 2024, 8:04am UTC](https://community.onyx.org/t/onyx-protocol-twitter-x-incident-and-possibility-to-recover-stolen-funds/1661/1 "2024-07-11T08:04:39Z")

</div>

Hey!

The @OnyxProtocol Twitter/X account was compromised on July 1st. It was recovered on July 9th. The incident occurred as follows and transparency around the situation is detailed below:

Summary: The @OnyxProtocol account was secured via a 10+ character password with a combination of alpha numeric, case variance, and symbols. The account was secured via a Google Authenticator 2FA (not SMS). The malicious actor used a zero-day method to get access to the account and bypassed both account password and 2FA.

After X/Twitter staff finally responded to the situation, it was explained that an internal method was used to access the account and it based on the information collected it was a zero day compromise.

Timeline of events:

• On July 1, At 12:58pm PST, there was a password reset request to the ••••••••@••••.••• email account.

• On July 1, 1:29pm PST, a login from Japan on an Android device came which was unauthorized.

• Then at 1:57pm PST a password was reset and 2FA reset to a new 2FA.

• At 2:00pm PST, the DAO was unable to access the account there after

• On July 1 and multiple days after, the community opened several tickets which none were answered properly

• Finally on July 9, the DAO regained access to the account

# For those affected

Email [**info@onyx.org**](mailto:info@onyx.org) **details** about your interactions with the malicious links and the DAO will work with the individuals to recover funds.

---

<div class="post-metadata">

**Author:** ![defitime](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.onyx.org/defitime/32/53_2.png) [@defitime](https://community.onyx.org/u/defitime)\
**Post date:** [July 11, 2024, 5:05pm UTC](https://community.onyx.org/t/onyx-protocol-twitter-x-incident-and-possibility-to-recover-stolen-funds/1661/2 "2024-07-11T17:05:01Z")

</div>

Glad its back now . also good you guys applied golden tick

---

<div class="post-metadata">

**Author:** ![bigdoge](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.onyx.org/bigdoge/32/50_2.png) [@bigdoge](https://community.onyx.org/u/bigdoge)\
**Post date:** [July 11, 2024, 5:19pm UTC](https://community.onyx.org/t/onyx-protocol-twitter-x-incident-and-possibility-to-recover-stolen-funds/1661/3 "2024-07-11T17:19:17Z")

</div>

what happened to the new X account ? 🤔

---

<div class="post-metadata">

**Author:** ![Zane](https://yyz2.discourse-cdn.com/flex008/user_avatar/community.onyx.org/zane/32/48_2.png) [@Zane](https://community.onyx.org/u/Zane)\
**Post date:** [July 11, 2024, 5:22pm UTC](https://community.onyx.org/t/onyx-protocol-twitter-x-incident-and-possibility-to-recover-stolen-funds/1661/4 "2024-07-11T17:22:25Z")

</div>

Golden verification is smart move . Good work 🕶