Before a Staff Laptop Gets Hacked, Set a Standard for Discord Moderator Accounts

On the evening of 29 October 2026, about $6.36 billion left a major crypto exchange's wallets across ten blockchains, most of it in about 20 minutes, according to TRM Labs (2026). Days later, Help Net Security (2026) reported that the exchange had first traced the way in to a single DevOps engineer's compromised laptop. The scale has nothing to do with a community server. The shape does. Every Discord server has a handful of people whose accounts can delete, ban and post on its behalf, and the way to secure those accounts is to make a short account standard a condition of holding any staff role, then decide in advance who does what if one is taken anyway.

Why the staff account is the weak point

A server's defenses usually point outward. AutoMod catches bad words and links, verification slows down fresh accounts, anti-raid tools stop floods of joins. All of that assumes the danger comes from members. A taken staff account is not a member. Discord grants powers to accounts, so an intruder signed in as your moderator holds your moderator's powers, and the filters you built treat their actions as trusted.

What they can do depends on the role. A moderator account can ban and time out members and delete messages. An admin account can delete channels, rewrite roles, add bots and create webhooks, the automated posting addresses that let tools post into a channel. A webhook created during a takeover can keep posting a fake claim link long after the account itself is removed, which is why the cleanup has to look for them by name.

The fix starts with the people who hold the powers, not with another bot.

Turn the setting on, then close the gaps around it

Start with the one switch Discord gives you. Two-factor authentication (2FA) adds a second code on top of the password, generated by an authenticator app on the person's phone. Once the owner has it on their own account, Discord lets them require it server wide. As Discord's Safety Center puts it, checked in November 2026, the requirement means every moderator and administrator must have 2FA on their own account to take administrative actions such as deleting messages. It lives in the server's Safety Setup. Give the team a few days to set up their apps first, then switch it on.

That one setting leaves four gaps, and the Security Alliance (SEAL) Discord guide, a security nonprofit's checklist last updated in October 2026, covers each of them.

The first gap is phone numbers. A number saved as a backup sign-in method can be moved to a stranger's SIM card by anyone who talks a mobile carrier into it. SEAL recommends removing it, switching off SMS backup and keeping the backup codes offline.

The second gap is ownership. SEAL describes a separate "cold" owner account with its own fresh email and 2FA, set up on a clean device and used only for owner actions like adding bots. The person who runs the server day to day works from a different account. If the daily account falls, the owner account still sits above it and can take its powers away.

The third gap is reach. SEAL suggests limiting Administrator to two or three trusted people, giving bots only what they need, and watching Administrator, Manage Webhooks, Manage Server, Manage Roles and Manage Channels closely. Each extra admin is one more laptop that can hand over the whole server.

The fourth gap is the session that is already open. 2FA checks people at sign-in. Malware on a computer that is already signed in may let an intruder act inside that session without ever facing the code. Shorter lists of admins, a cold owner account, and a regular sweep of signed-in devices are what limit that case.

Habits for the people holding the keys

Settings decay without habits. Three habits carry most of the weight.

The first is a monthly sweep. Each staff member opens their user settings, reviews the list of signed-in devices, logs out of anything they do not recognise or no longer use, and removes apps they authorized once and forgot. SEAL lists both checks, and together they take a couple of minutes. Put the sweep on the moderation calendar with a reminder, so it survives busy weeks.

The second is a firm rule about direct messages. Staff never message a member first. Say it in the server where members will see it, and repeat it whenever something goes wrong. Once the rule is public, any account that opens a conversation as "Support" is fake by definition, and members can act on that without having to judge how convincing the message looks. SEAL also suggests an AutoMod rule that blocks words such as Support, Bot, Admin, Tech and Helpdesk in member names, which keeps the most obvious copycats out.

The third is the handover, in both directions. When someone joins the staff team, the role is the last thing they receive: they set up the authenticator app, remove the phone number, save the backup codes and read the pinned rule first, and a lead confirms each item before granting anything. When someone leaves, their roles come off the same day, along with any bots or webhooks they added that nobody else owns. Former staff accounts that still hold powers months later are one of the quieter risks in a server, because nobody is watching them and nobody would notice them being used. A short list in a private staff channel, with each person's name, their role and the date their account was last checked, keeps both directions easy to maintain and gives the monthly sweep somewhere to be recorded.

A pinned notice can carry the direct message rule for members. Here is a version to adapt:

Our staff will never send you the first message.
If an account messages you claiming to be staff, support or a moderator, it is not us. Do not click its links and do not share any codes.
Report it in #support-tickets and we will deal with it.
Staff accounts in this server: [list the role names your team uses]

The half hour after a takeover

Assume one account will be taken someday despite all of this, and plan for it while everyone is calm. The response has four moves, and each one needs an owner whose name is written down before it is needed.

Someone removes the role. That person's highest role has to sit above the taken account's role, because a member can only manage roles below their own. The cold owner account always qualifies, which is one more reason to keep it.

Someone pauses DMs and invites. Discord's Help Center describes Security Actions, which pause invites and pause DMs between members who are not friends, for a length of time you choose. The same page explains Activity Alerts, which flag unusual activity such as abnormal numbers of joins or DMs to members holding Administrator, Kick Members, Timeout Members, Ban Members or Manage Server. Pausing DMs stops the taken account, and anyone copying it, from working through members one by one.

Someone warns members. One short post in announcements, from a trusted account, naming the taken account and repeating the no first message rule. A single clear post tends to calm a server faster than a stream of updates from several staff members.

Someone reads the audit log. They look for deleted channels, changed roles, new bots and new webhooks tied to that account, undo what they can, and delete every webhook it created. SEAL suggests sending audit log events to a private staff channel at all times, which makes this step faster and often surfaces the takeover in the first place.

When the dust settles, the account owner changes their password, logs out of all known devices, removes unknown authorized apps and checks the device. The role returns only when the account meets the standard again.

Personal accounts hold the keys to every server setting, and checking them costs a few minutes a month. danieljeong.org