A Platform in Crisis
On March 10, 2025, X, the social media platform owned by Elon Musk, experienced multiple outages that left tens of thousands of users unable to access their accounts or view posts. The disruptions, which occurred in waves throughout the day, sparked widespread speculation and prompted Musk to label the incident a “massive cyberattack.” As one of the world’s most influential tech figures and a key player in the Trump administration’s Department of Government Efficiency (DOGE), Musk’s statements quickly drew attention. This article explores the timeline of the X hack, Musk’s claims about its origins, the emergence of a hacker group taking responsibility, and expert reactions to the unfolding narrative.
The Outage Timeline: Waves of Disruption
The trouble began early on March 10, with outage tracking site DownDetector reporting around 20,538 user complaints by 6 a.m. ET. A second, more severe wave hit at 10 a.m., with nearly 40,000 users affected, followed by a third wave around 12:30 p.m. ET, logging about 26,000 reports. Users worldwide reported that the X app and website failed to load, with the outages appearing global in scope according to DownDetector’s international data.
Musk, who acquired the platform (then Twitter) for $44 billion in 2022, was quick to respond. Posting on X, he stated, “There was (still is) a massive cyberattack against X. We get attacked every day, but this was done with a lot of resources”. The scale of the disruption, combined with Musk’s high-profile role in both tech and politics, fueled speculation about the incident’s cause and potential motives.
Elon Musk’s Statements: Pointing Fingers at Ukraine
Musk didn’t stop at calling it a cyberattack. In a follow-up post, he suggested that “either a large, coordinated group and/or a country is involved,” hinting at a sophisticated operation. Later that day, during an interview on Fox Business with Larry Kudlow, Musk doubled down, claiming, “We’re not sure exactly what happened but there was a massive cyber-attack to try and bring down the X system with IP addresses originating in the Ukraine area”.
This accusation aligned with Musk’s recent geopolitical tensions with Ukraine. Just days earlier, on March 9, he had posted on X that Ukraine’s “entire front line would collapse” without his Starlink satellite service, a statement that drew sharp rebukes from Polish and Ukrainian officials. Musk’s suggestion of Ukrainian involvement in the X attack came amid strained relations with the country, exacerbated by his criticisms of its government and his influential role in the Trump administration, which has taken a hard line against Ukraine.
However, Musk provided no concrete evidence to support his claim. His history of attributing X outages to cyberattacks—such as a 2024 livestream crash with Donald Trump, later debunked as a technical failure raised questions about the reliability of his assertions.
Dark Storm Emerges: A Hacker Group Claims Responsibility
As Musk pointed to Ukraine, a different narrative emerged. A pro-Palestinian hacktivist group called Dark Storm claimed responsibility for the outages in a now-deleted Telegram post, stating, “Twitter has been taken offline by Dark Storm Team”. The group shared screenshots from Check Host, a tool often used by DDoS (Distributed Denial of Service) attackers to demonstrate a site’s unavailability globally, as evidence of their involvement.
Founded in 2023, Dark Storm is known for targeting entities supportive of Israel, including Israeli hospitals and U.S. airports, according to cybersecurity firm Check Point. The group also operates as hackers-for-hire, suggesting a mix of ideological and mercenary motives. In response to Musk’s Ukraine claim, an X account purportedly linked to Dark Storm denied any Ukrainian connection, stating, “It is an accusation without any evidence, and we have no relationship with Ukraine”.
Skepticism and Technical Realities
Cybersecurity experts quickly cast doubt on Musk’s Ukraine theory. Nicholas Reese, an adjunct instructor at NYU’s Center for Global Affairs, told the Star Tribune that a state-sponsored attack “doesn’t make a lot of sense” given the outages’ short duration and lack of strategic value. “Something like this was designed to be discovered,” Reese noted, suggesting it was more likely a loud, symbolic act than a covert operation by a nation-state.
Muhammad Yahya Patel of Check Point echoed this skepticism, explaining that DDoS attacks typically involve IP addresses distributed globally, not concentrated in one region like Ukraine. Chad Cragle of Deepwatch added that “definitive attribution requires thorough forensic analysis” beyond simple IP tracing, and Dark Storm’s claim, while not conclusive, couldn’t be dismissed without further evidence.
The scale of the attack, however, impressed some analysts. Tom Parker of NetSPI described it as suggesting “the involvement of a sophisticated threat actor,” whether a nation-state or a well-resourced hacktivist group. Yet, without access to X’s internal data, independent verification remains elusive.
Musk’s Broader Challenges
The X hack unfolded against a turbulent backdrop for Musk. As head of DOGE, he has overseen mass firings of federal workers, sparking protests at Tesla dealerships and criticism of his unchecked influence in the Trump administration. Tesla’s stock dropped over 10% on March 10 amid broader market woes, and a SpaceX rocket explosion days earlier added to his mounting pressures.
Some speculated the attack was retaliation for Musk’s political actions, though Dark Storm’s stated motives didn’t align with this theory. Musk himself suggested it was an attempt to “silence” him, a claim that resonated with his supporters but lacked substantiation.
A Narrative in Flux
The March 2025 X outages remain a puzzle. Musk’s assertion of a Ukrainian-led cyberattack clashes with Dark Storm’s claim and expert analyses pointing to a broader, less centralized operation. Without forensic evidence from X—which Musk has not released—the truth remains obscured. What’s clear is that the incident underscores the vulnerability of even the most prominent platforms and the complexity of attributing cyberattacks in a polarized, digitally interconnected world. As Musk navigates this crisis, his penchant for bold statements continues to shape the narrative, whether or not the facts align.