Jack Levin's X account is back. The account, compromised on 13 September after Levin clicked a phishing link dressed up as a security notice from X, posted again on the evening of 14 September. That was less than an hour after Levin told the X1 community on Telegram that he had written directly to Nikita Bier, X's head of product.
After a day of warnings not to trust anything posted from the account, the recovery came fast once the right person was reached, and the X1 community's first instinct was to reach for XNT.
How he got it back
At 20:44 CEST on Monday, Levin wrote in the X1 Telegram group: "Wrote to Nikita Bier to unlock my X account." A moment later he added: "Hopefully soon."
Asked why Bier would pick it up, Levin pointed to an old connection: "I've been investor in his old company, he certainly remembers me." He later named it: tbh, the anonymous compliments app Bier co-founded, which Facebook went on to acquire.
He then shared a screenshot of the email thread. It shows a message from Bier dated Monday, 14 September 2026, and Levin's reply: "Thank you, I appreciate it." Of Bier's answer, Levin told the group: "He just said he is pushing it thru."
At 21:34 CEST (19:34 UTC) the account was live again, fifty minutes after his first Telegram message about writing to Bier.
"Chooms, I am back"
Levin's first post back was short and in character. Over a photo of the sea at sunset, he wrote: "Chooms, I am back. Btw, Richard's birthday is coming up, let's come up with a good b-day present for him," tagging @CLOUT_COCKS.
No token, no link, no announcement. After a compromise in which the account was used to push scam contract addresses, that is exactly the kind of first post followers should hope to see.
Who is Nikita Bier
Bier became head of product at X in July 2025. He is best known as the founder of two viral consumer apps: tbh, acquired by Facebook, and Gas, acquired by Discord. Levin was an investor in tbh. His path to X was a public one. In 2022 he posted a direct pitch to Elon Musk, "Hire me to run Twitter as VP of Product", and joined the company three years later.
Levin's route to recovery ran through that product chief rather than X's standard support queue. The day before, Levin had said he had a ticket open with X, and he was frustrated by the pace: "I wish X would act a bit quicker, they got my email etc."
"Send him XNT!"
The community's reaction was immediate. ArnettX1 replied in the group: "Send him XNT! Simultaneously thank him and Onboard him at the same time!"
Levin's answer: "Already did."
He did not say which part he meant: sending Bier XNT, getting him onto X1, or simply thanking him. X1 Report has not been able to confirm it.
What happened on the 13th
Levin raised the alarm on Telegram at 08:13 CET on 13 September: "My Twitter account was hacked. Don't click any links. I had X ticket opened so likely it won't be used to post bad links." Asked how it had happened, he answered: "I clicked what I thought was a security link from X." The lure was a fake DMCA notice about his account that pointed to a support page which did not belong to X.
While the attacker held the account, it posted contract addresses for several scam tokens. Those posts were later removed.
Lessons for everyone on X
- Treat account-warning links as hostile. Copyright strikes, suspensions and "verify your account" messages are the most common phishing lures. Open X directly instead of following a link, and check the domain before signing in anywhere.
- Anything posted during a compromise is suspect. Contract addresses posted from Levin's account between the hack and the recovery were not his. Do not act on them.
- Verify announcements in more than one place. X1's Telegram community was where the warning appeared first and where the recovery was confirmed.
- Harden your login. A passkey or an authenticator app makes a stolen password far less useful.
Levin is back on X and the scam posts are gone. For X1, the weekend's security scare ended better than it started.