How to Delete Tweets Made by a Hacked Account
A guide on what to do when an attacker tweets from your account, how to delete those posts, and how to secure the account afterward.
Check What the Attacker Posted
When you regain access to your hacked X account, the first step is to figure out what happened while you were locked out. Go to your profile and review your timeline chronologically. The attacker likely posted spam, scam links, or offensive content that you need to remove quickly. Scroll back to the period when you lost access, which could be anywhere from a few hours to a few days. Take note of every post that was not made by you, including replies, quote tweets, and retweets. Do not engage with them yet—just catalog what exists so you know the scope of the cleanup.
You can also check your notifications tab for any replies or mentions that the attacker made. If they sent DMs, those will need a separate review. X does not have a simple log of actions taken while your account was compromised, so you have to reconstruct the timeline manually. Write down the date and time range of the incident. This will be critical for bulk deletion later. If the attacker changed your profile name or bio, note that too, as it may help identify other actions they took.
Delete Tweets in Bulk
The fastest way to remove the attacker's posts is to delete everything from the time window when you lost control. You can do this by hand if there are only a handful of posts, but if the attacker spammed hundreds of tweets, manual deletion will take hours due to X's rate limits. A bulk deletion tool like TweetSweep can delete posts from a specific date range, which lets you clear the compromised period in one session. You will need to authorize the tool with your account, but it uses X's official API and does not require your password. The deletion process respects X's 50-post-per-15-minute rate limit, so expect it to take time for large volumes.
If you prefer to do it manually, use X's advanced search with the date range and the from:yourhandle operator. This will show you all posts from that period. Delete each one individually by clicking the three-dot menu and selecting Delete. Be aware that if the attacker posted a reply, deleting that reply also removes it from the other user's conversation thread. There is no undo button for deletion once it completes. After you finish, double-check that no posts remain from the incident by revisiting your timeline for that date range.
Secure Your Account First
Before you start deleting tweets, secure your account to prevent the attacker from logging back in. Change your password immediately to something strong and unique. Next, revoke all third-party app access by going to Settings and Privacy, then Security and Account Access, and finally Connected Apps. Remove any apps you do not recognize, because the attacker may have connected a bot to your account. Enable two-factor authentication, preferably with an authenticator app rather than SMS, because SIM swapping is a common hack method. This step is non-negotiable—if you delete tweets before securing the account, the attacker could return and post more.
Check your email associated with the X account. If the attacker changed the email address, you will need to revert it through X's account recovery process. Also review your login history under Security to see if any suspicious logins occurred from unusual locations or devices. If you find any, log them out remotely. Once your account is secure, you can proceed with deletion knowing the attacker no longer has access. Do not skip this step even if you are in a hurry to delete embarrassing content.
What Cannot Be Undone After Deletion
Deleting tweets made by the attacker is permanent. Once deleted, those posts vanish from your profile, search results, and X's servers. However, they may still exist elsewhere. Anyone who took a screenshot of the post before deletion can share it indefinitely. Quote tweets made by others referencing the attacker's post will remain, though the original tweet will show as a broken link. Third-party caches like the Wayback Machine or Google Cache may have archived the post. Those are outside X's control and must be handled separately by requesting removal from Google or the site hosting the cache.
Additionally, if the attacker sent DMs promoting scam links, those messages remain visible to the recipients unless you delete them individually. X does not offer a way to bulk-delete DMs. You have to delete each conversation manually. Also, if the attacker used your account to follow or unfollow people, that action is not reversible through deletion. You will need to manually re-follow anyone they unfollowed, or remove accounts they followed that you do not want. This cleanup takes time but addresses what deletion cannot fix.
Report the Incident to X Support
After you have cleaned up the tweets and secured the account, you should report the hack to X support. This is especially important if the attacker posted illegal content like threats or private information, because reporting creates a record that may matter if law enforcement gets involved. Go to the X Help Center and submit a report under the hacking category. Explain what happened, what the attacker posted, and what steps you have taken. X may issue a warning or permanent suspension if they deem the compromised activity a violation—you can appeal and explain it was not you.
Reporting also helps in case the hacker used your account to attack others. X may roll back some actions if you provide a clear timeline. However, do not expect them to delete the posts for you—that is your responsibility. Keep a copy of the report confirmation for your records. If the attacker posted your personal information, also consider reporting it to the platform where it may have been shared. The report does not guarantee a quick response, but it is an important step for your account's long-term safety.
Prevent Future Hacks
Once your account is clean and secure, take steps to prevent this from happening again. Do not reuse passwords across services. Use a password manager to generate and store unique passwords. Enable login alerts so you get notified whenever someone logs into your account from a new device. Review your connected apps regularly and remove any you no longer use. Be cautious of phishing links in DMs, even if they appear to come from friends—hackers often use compromised accounts to spread malware to followers.
Consider using an account restoration security key if you are a high-profile user. X allows physical security keys for two-factor authentication, which are nearly impossible to bypass remotely. Also, log out of X on devices you do not own, like shared computers or phones. A habit of basic security hygiene—unique passwords, two-factor authentication, and cautious clicking—makes a hacked tweet incident much less likely to repeat. The cleanup you just did was time-consuming; prevention is the easier path.