There’s currently a Roblox security exploit that is targeting a large number of legitimate content creators and players on the platform.
Right now, a specific bad actor on Twitter (attached screenshots in replies for evidence) is actively abusing the European Union Digital Services Act (DSA) reporting form to force-reset user accounts. The exploit specifically targets any username that contains the suffix "YT", which includes my own Roblox account TallCowYT (I want my username back…) They’ve been targetting a lot of people who have YT in their username, such as those in the star program, people with verified checkmarks, game developers, content creators, limited holders, and ordinary users just to cause trouble.
How the vulnerability is currently being executed:
1. The bad actor/actors use a VPN to mimic an EU location so the specialized DSA reporting options become visible to them.
2. They select severe, fast-track reporting categories (like child endangerment or severe legal violations) and falsely argue that the "YT" suffix is an unregulated redirect forcing minors to off-site platforms.
3. Because the DSA requires swift action under threat of massive compliance fines, Roblox’s automated sorting filters appear to be erring on the side of caution. The bots scan the target name, detect the literal "YT" string matching the complaint, and immediately issue an "Inappropriate Username" strike which force-resetting the victim to a generic Roblox username reset as well as them losing their user.
4. Once the name is reset, they may use an automated script to immediately claim or flip the freed username.
Here’s some suggested patches/fixes for this vulnerability that Roblox could possibly implement:
1. Implement stricter backend validation checks on the DSA form to verify genuine EU user sessions.
2. Add an automated filter exception that protects accounts if they have ID verified or have matching YouTube/Twitch social links bound directly to their Roblox profile metadata.
3. Prevent usernames force-reset by DSA reports from entering the public availability pool until a human administrator completes a manual review.
4. Whitelist the “YT” suffix in Roblox usernames since this has been a problem for years!! (And give everyone an option to restore their usernames)
If anyone at Roblox could fix this problem and/or help me get my username back then I would really appreciate it!! (I’ve had it since 2023 and it’s tied to a whole year of etoh webhooks and much more…)
Please like and retweet to spread awareness!!
@Roblox_RTC@Roblox@KreekCraft@SharkBloxYT
@DrewVento Acting like men wouldn't have that fate on a much bigger scale lmao, the ugliest men ever always go for women out of their league where it looks like the guy got a make-a-wish
@DrewVento Acting like men wouldn't have that fate on a much bigger scale lmao, the ugliest men ever always go for women out of their league where it looks like the guy got a make-a-wish
i just got reminded how ass roblox giftcards are from the giftcard site i straight up bought one and i jsut did NOT get the code, had to have premium urgently so i bought another one and it worked that time thankfully 😭