Vitalik Buterin Flags Security Flaw in X’s Location Feature: ‘Easy to Fake’
TL;DR:
Vitalik Buterin warns X’s location feature is easy to fake, exposing users to privacy risks.
The country or region tag launched globally on November 22, but malicious actors could manipulate it.
Experts debate its use as an anti-spam tool versus the impracticality of manual verification, while X offers privacy toggles in sensitive countries.
Ethereum co-founder Vitalik Buterin has raised concerns about X’s new location feature, which allows profiles to display their country or region. While the platform promotes it as a transparency tool, Buterin warns that it is vulnerable to manipulation. Sophisticated users could easily fake their locations, exposing legitimate accounts to privacy risks and creating a false sense of authenticity.
Prediction about this “show which country the account is from” thing:
In the short term it will have lots of positive effects.
In the medium term, the sophisticated actors will find ways to pretend to be from countries that they are not. Lots of ways to rent individual people’s…
— vitalik.eth (@VitalikButerin) November 23, 2025
Location Feature: Promise vs. Risk
X rolled out its location feature globally on November 22, enabling users to see a country or region in the “About This Account” section. Designed to increase accountability, the feature aims to signal authenticity by showing where accounts operate. However, Buterin argues that the feature has a critical flaw: it can be bypassed with minimal effort. Within months, malicious actors could appear to originate from trusted countries like the U.S. or U.K. simply by renting phone numbers, IPs, or documentation.
The cryptocurrency community reacted swiftly. Developers and analysts criticized the feature as problematic if mandatory, emphasizing that voluntary data sharing differs from compulsory disclosure. Privacy experts highlighted that revealing country information could lead to targeted harassment, discrimination, or data leaks.
X product lead Nikita Bier stated that in countries with strict speech penalties, privacy toggles will be available. Critics argue, however, that this does not solve the systemic problem: the global visibility of user locations continues to carry inherent risks.
Some academics proposed the feature could serve as an anti-spam mechanism, increasing the cost of creating fake accounts. Buterin countered that manual verification at scale is impractical, limiting the feature’s effectiveness as a security measure.
Ultimately, X’s location feature has sparked a debate about authenticity versus safety online. Buterin’s warning urges platforms to consider whether showing user locations truly enhances trust or inadvertently opens new attack vectors. The discussion highlights the tension between transparency and privacy in the evolving social media landscape.
Filed under: News - @ November 24, 2025 2:23 pm