The account was accessed without authorization for approximately 30 minutes, during which time posts appeared promoting a cryptocurrency "memecoin" tied to the Pokémon brand.
The unauthorized messages were removed once the company regained control of the account.
In an official message relayed via news outlets including Kotaku, The Pokémon Company said the X handle had been "temporarily compromised" and that the posts promoting a cryptocurrency were not created or approved by the company.
The statement noted the posts had been removed and apologized for any confusion, adding that the company appreciated followers' patience while it resolved the incident.
Rewritten for clarity: The Pokémon Company said its X account was accessed without authorization and used to publish promotional posts for a cryptocurrency.
Those posts were not produced or sanctioned by Pokémon, have since been deleted, and the company apologized for the confusion while thanking followers for their patience.
The incident underscores ongoing security risks for official social accounts tied to major entertainment and gaming brands.
Pokémon is a long-running franchise that began in 1996 and is managed by The Pokémon Company, which was formed by Nintendo, Game Freak, and Creatures in 1998.
The series has a deep connection with Nintendo platforms: recent mainline entries such as Pokémon Scarlet and Violet launched on Nintendo Switch on November 18, 2022, and the franchise frequently features in Nintendo Direct presentations, eShop releases, and competitive events like the Pokémon World Championships.
For players and fans: if you saw the unauthorized posts while they were live, avoid interacting with links or requests that appeared in those messages.
The Pokémon Company removed the content and has restored normal operations for the account.
News outlets continue to monitor official channels for any follow-up details.
This report is based on The Pokémon Company's public statement and coverage from established news sources.
No further claims about the identity of the attackers or additional impacts have been made public by the company.