Discord server hacked or nuked: what to do now

What this is about

Channels are gone, roles deleted, scam links in the chat. Usually there's a hijacked account behind it, yours or a team member's, or a bot with too many permissions.

Discord doesn't restore deleted channels, roles or messages, and neither can support.

How to do it in Discord

The steps apply to Discord on a computer and in the browser.

1. Get your account back

If your own account is affected, start here. If you can't log in at all, open a ticket with Discord at dis.gd/hackedaccount (opens in a new tab).

1. If Discord emailed you that your email address was changed, use the link in that email to get it back.

2. Open User Settings, click Change Password and set a new password.

3. Under Devices, click Log Out All Known Devices.

4. Switch on Multi-Factor Authentication, for example with Enable Authenticator App or a security key.

5. Under Authorized Apps, remove every app you don't recognise with Deauthorize.

2. Lock the attacker out

1. Click your server's name at the top left and choose Security Actions. Pause Invites and Pause DMs stop both for a period you choose.

2. Open Server Settings › Audit Log. Use Filter by User and Filter by Action to find out who deleted, banned or changed permissions.

3. Take that account's roles away: right-click the member › Roles › untick. This only works for roles below your own highest role.

4. Under Server Settings › Roles, check the permissions of @everyone. If @everyone suddenly has Administrator, switch it off.

5. Open Server Settings › Integrations › Bots and Apps. It shows who added which bot when.

6. Kick every unknown bot from the server by right-clicking it in the member list. Its role goes with it.

7. In the webhooks section, delete every webhook you don't recognise with Delete Webhook. A webhook lets someone post in a channel without an account.

If the attacker's role is above yours, or the owner's own account is hijacked, only the owner or Discord can help.

3. Rebuild the server

Create what was deleted again, see Discord: restore a deleted channel or role. The audit log often shows the old names. If you have a server template, its link shows the old setup as a preview (Back up your Discord server with built-in tools). Messages don't come back.

4. Report it to Discord

• Hacked account: open a ticket at dis.gd/hackedaccount (opens in a new tab). You need a separate account for Discord's help center, not your Discord account.

• Scam messages: right-click the message › Report Message.

• Suspicious bots: report them to Discord's Trust & Safety team.

5. Prevent it next time

• Under Server Settings › Safety Setup, switch on Require 2FA for moderator actions. Moderators without 2FA then can't ban, kick or delete messages. Only the server owner can do this, with 2FA on their own account.

• Give Administrator and Manage Server to very few people, see Discord moderator permissions without Administrator.

• Don't open links or files from unknown sources. "Free Nitro" is a scam, and Discord staff never contact you about support by direct message.

How to tell it worked

No new deletions show up in the audit log, and Integrations only lists bots and webhooks you know.

With Fylgra

Fylgra can only help if the Backups & Templates module was already running on your server before the attack. It alerts you and helps you rebuild, but it doesn't take anyone's permissions away or stop anything.

If many channels or roles are deleted or many members are banned within a short time, or @everyone gets dangerous permissions, Mass deletion protection reports an incident: above the tabs of Backups & Templates, in the #🚨backup-alarm channel and by direct message to the server owner.

Then click Restore everything in the notice. Fylgra creates a State before the incident backup, the server just before the first deletions, even if your last backup is older. In the preview, only what the incident caused is preselected, never anything that would give someone more permissions than today. Deleted roles go back to their members, except accounts that deleted things during the incident, and bots.

The limits:

• Restore everything works for up to 24 hours after the mass deletion.

• Channels come back empty and with a new ID. Fylgra doesn't bring back messages, bans or server settings.

• The "Fylgra" role needs View Audit Log in Discord. Fylgra doesn't know about anything it didn't record.

More in schutz-massenloeschungen, alles-wiederherstellen and stand-vor-dem-vorfall.