Incident response

A mod account got hacked. What now?

By ESN Systems, makers of ESN Guardian. Updated November 3, 2026.

When a moderator's account is taken over, every action it takes looks trusted. Here is what to do in the first five minutes, how to clean up after it, and how to set your server up so one stolen account can't do much.

Guardian is on every server at no cost. Setup takes about five minutes.

Add Guardian to Discord Grade your server first

How mod accounts get taken

Most staff accounts are not “hacked” in the movie sense. Someone scans a fake “scan to verify” QR code, runs a “game beta” file a friend sent, or logs in on a look-alike site. The attacker ends up with a working session on the account, roles and all. To your server, every action they take looks like it came from a trusted moderator, which is exactly why it is dangerous: Discord does not know the person behind the account changed.

Discord's own help article for the account owner is My Discord Account was Hacked or Compromised. This guide is for the server: what staff should do in the first minutes, and how to set things up so one stolen account can't wipe the place.

The first five minutes

Take the account's power away. A member above the hacked mod in the role list (or the owner) removes their staff roles. If the account is still acting, time it out or kick it. Don't wait to be sure. Roles can be given back in seconds; a deleted server can't be undone that fast.
Lock things down if damage is happening. If channels or roles are being deleted, or @everyone is being spammed, lock the server first and investigate second.
Read the audit log. Server Settings → Audit Log, filtered to the hacked account, shows what it changed: deleted channels, edited roles, new webhooks, new invites, bans and kicks.
Clean up what it created. Delete webhooks and invites the account made, and check for new bots it added. A webhook made by an attacker keeps working after the account is fixed (see webhook security).
Tell your staff in a private channel so nobody follows instructions from that account until the owner of it is back in control.
Help the moderator recover. They should change their password, turn on two-factor authentication, remove unknown devices and authorized apps, and follow Discord's article if they are locked out.

Set it up so one account can't do much

Fewer admins. Administrator overrides every channel permission (Discord's Setting Up Permissions FAQ explains how it works). Give moderators the specific permissions they need instead, and keep Administrator to the owner and one or two people.
Require 2FA for staff. Two-factor authentication doesn't stop a QR login, but it does stop a stolen password. Discord's guide: Setting up Multi-Factor Authentication.
Keep bots and staff below your security bot. A security bot can only act on members whose top role is below its own.
Use temporary power. If a mod needs ban rights for an event, give them for the event, not forever.

Guardian stops a hijacked staff account mid-attack and puts back what it changed.

Add ESN Guardian

What ESN Guardian does when a staff account turns

Anti-nuke limits per action. Guardian watches channel and role deletes, bans, kicks, unbans, de-roles, timeouts, nickname changes, webhooks and bot adds. When one account crosses a limit, Guardian stops that account, whether it is a new member or a moderator. The server owner and users you mark as trusted are never punished automatically.
Undo, not just stop. The nuke time machine (/antinuke timemachine) shows what an account did in the last 10 minutes, and lets staff undo one action or all of them. /rewind restores everything an actor changed in the last few minutes.
Trust that expires. /whitelist grant can give a moderator a specific power for a set time, with every grant logged.
2FA warnings. Guardian alerts if moderator 2FA gets turned off, and /hardening flags staff promotions on accounts without 2FA.
Hijacked bots too. Sentry learns how each bot normally behaves and steps in when one suddenly floods, pings or makes bulk changes, which is what a bot with a leaked token does.
Wrong call? One click. If Guardian acts on someone it shouldn't have, /casework undo reverses it.

Guardian logs every one of these actions to your security log with the reason, so the rest of your staff can see what happened while it happens.

After it's over

Check the security log and audit log together, and run /audit run to see what is still weak.
Give the moderator their roles back only once they confirm a new password and 2FA.
Look for the way in. If it was a QR code or a fake file, warn the rest of your staff about that exact trick; it usually comes back.

Sources: Discord's My Discord Account was Hacked or Compromised, Setting up Multi-Factor Authentication and Setting Up Permissions FAQ. Checked November 3, 2026.

Questions

What should I do first when a moderator's Discord account is hacked?

Remove the account's staff roles straight away (or time it out), lock the server if damage is happening, then read the audit log for everything it changed.

Can a hacked moderator account delete my server?

Only the owner can delete a server, but a moderator with the right permissions can delete channels and roles, ban members and create webhooks. That's why staff should have the specific permissions they need instead of Administrator.

Does two-factor authentication stop hacked mod accounts?

It stops logins with a stolen password, but not session theft such as the QR code login scam. Use 2FA, fewer admins and a security bot with per-action limits together.

Will ESN Guardian punish my own staff?

Only an account that crosses an anti-nuke limit is stopped. The owner and trusted users are never punished automatically, and /casework undo reverses a wrong call in one step.

Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo →