Discord Account Hacked? How to Recover It and Protect Your Servers

If your Discord account was hacked and you can still log in, change your password immediately, which logs out other sessions, then turn on two-factor authentication, remove unknown devices and deauthorize apps you don’t recognize. If you’re locked out, secure your email first, try a password reset, and contact Discord through its official support site. Then warn your friends and check any servers you own or moderate, because hacked Discord accounts are widely used to spread scams.

Discord takeovers often happen through stolen login sessions rather than stolen passwords, which is why some of the fixes differ from other platforms. This guide covers each step in order.

Signs your Discord account was hacked

• Friends say you sent them links to “free Nitro”, a game to test, a “vote for my project” page or a QR code.
• Messages appear in your DMs or servers that you didn’t send, often mass-sent to every friend.
• Your username, display name, avatar or bio has changed.
• Discord emailed you about a login from a new location, or a password or email change you didn’t make.
• You’ve been removed from servers, or servers you own have new admins, new bots or deleted channels.
• Unfamiliar devices appear in your account’s device list, or unknown apps in your authorized apps.

Why Discord hacks work differently

Many Discord takeovers use a stolen session token: a piece of data that keeps you logged in. If malware, a fake “game” download, a browser extension or a malicious QR code grabs that token, an attacker can use your account without knowing your password and without triggering two-factor authentication.

Changing your password generally invalidates existing sessions, so it is the single most useful thing you can do if you still have access. If the token was stolen by malware on your computer, though, the attacker can steal the new one too. That’s why cleaning your device matters as much as the password.

Step 1: If you can still log in

1. Change your password right away to a strong, unique one. This logs out other sessions in most cases.
2. Review your devices in Discord’s settings and log out any you don’t recognize, or all other devices.
3. Turn on two-factor authentication with an authenticator app, and add a security key or passkey if Discord offers it on your device. Save your backup codes somewhere offline.
4. Deauthorize apps in your authorized apps list that you don’t use or don’t recognize.
5. Check your email and phone on the account are yours.
6. Scan your computer for malware with reputable security software, remove unfamiliar browser extensions, and uninstall anything you downloaded from a Discord link recently.

Step 2: If you’re locked out

1. Secure your email first. Change its password, turn on two-factor authentication and check for forwarding rules or recovery details you didn’t set. Our guides to a hacked Gmail account and Microsoft account recovery cover the most common providers.
2. Look for Discord’s security emails in your inbox, spam and trash. If the email on your account was changed, Discord typically notifies the previous address, and that message may help you secure the account.
3. Try a password reset from Discord’s login screen. If the reset reaches your email, set a new password and follow Step 1.
4. Contact Discord support. If the reset goes to the attacker, submit a request through Discord’s official support site (support.discord.com) explaining that your account was compromised. Include your username, the original email address and when you lost access.
5. Clean your device before you log back in, so a new session isn’t stolen the same way.

Discord doesn’t publish a fixed response time. Keep your ticket number and reply only through that official thread.

Step 3: Protect your friends and servers

Most of the damage from a Discord account hacked by scammers lands on the people who trust you. Messages from a known friend get clicked.

• Warn your friends and servers as soon as you’re secure, and message anyone who replied to the scam.
• Delete scam messages you can reach, and ask server moderators to remove any posted in their channels.
• If you own or moderate servers, check roles and permissions, remove unknown admins, review bots and integrations, check webhooks and the audit log, and restore any deleted channels or settings you can.
• Check payment details if you have a payment method saved, and review recent purchases or gifts.

Hey, my Discord was hacked yesterday and the messages about free Nitro and a game to test weren’t from me. Please don’t click them or download anything. If you did, change your Discord password, turn on 2FA and run a malware scan. Sorry for the hassle.

A worked example

This is an illustrative scenario, not a real client. A student who runs a small study server gets a DM from a friend asking him to “try my new game” and download a file. Nothing seems to happen when he runs it. That evening, dozens of his friends receive the same message from his account, and a new admin appears in his server.

1. Password: he still has access, so he changes his password immediately and logs out all other devices.
2. Device: he uninstalls the “game”, runs a full malware scan and changes the passwords saved in his browser, since the file may have stolen those too.
3. Two-factor: he turns on authenticator-app two-factor authentication and deauthorizes an app he doesn’t recognize.
4. Server: he removes the new admin, checks bots and webhooks, and posts a pinned notice.
5. Friends: he messages the friend whose account sent the original file, whose account had also been hacked.

Because the malware could have taken more than his Discord session, he also checks his email and other accounts for unusual logins.

How Discord accounts usually get hacked

• Fake game or software downloads that install token-stealing malware.
• Malicious QR codes, often presented as a way to claim Nitro or verify for a server. Scanning one can log the attacker in as you.
• Phishing pages that copy Discord’s login screen.
• Browser extensions and “client mods” from untrusted sources.
• Reused passwords leaked from other sites.

Protecting your reputation after a Discord hack

For most people, the reputational fallout is among friends and communities: people who were scammed through your account, or a server that banned you for spam. Handle it directly.

• Explain to server moderators what happened and ask whether a ban can be reviewed once your account is secure.
• Apologize to anyone affected without over-explaining, and point them to steps that protect them.
• Check whether your username was used elsewhere. If someone creates a lookalike account to continue the scam, report it and see our guide on what to do if someone is impersonating you online.

If you’re a creator or community leader and the hack spilled into public posts or search results, our social media reputation management service can help. For teens, our parental controls guide covers settings parents can review together.

Common mistakes to avoid

• Relying on two-factor authentication alone. Token theft bypasses it, which is why the password change and device cleanup matter.
• Logging back in on an infected computer. The attacker can steal the new session.
• Scanning QR codes from DMs or servers. Use QR login only when you started it yourself on Discord’s official site or app.
• Paying anyone for recovery. Only Discord can restore an account.
• Forgetting your servers. A hacked admin account can leave lasting changes behind.

Frequently asked questions

How did my Discord get hacked if I have two-factor authentication?

Most likely a session token was stolen through malware, a malicious QR code or a fake login page. A stolen session can work without your password or code. Change your password to invalidate sessions and clean your device.

How do I contact Discord about a hacked account?

Use Discord’s official support site, support.discord.com, and submit a request about a compromised account. Discord staff won’t contact you by DM to fix it.

Can Discord restore messages the hacker deleted?

Generally, no. Deleted messages and servers usually can’t be restored, so focus on securing the account and warning people. Server owners can rebuild channels and roles from their own records.

My account was disabled for spam the hacker sent. What now?

Contact Discord support, explain that your account was compromised and when, and ask for a review. Secure your email and device first so you can show the account is back under your control.