Discord nuke: protect your server from a hacked account or a rogue moderator

What is a Discord nuke?

A nuke is a server destroyed from the inside by an account with the permissions to do it. Unlike a raid, the attack doesn’t come from outside: it comes from a member of your team.

Three scenarios come up again and again: a rogue moderator or administrator, a hacked staff account, or a bot with too many permissions that gets compromised.

The first line of defence: permissions

• Give the Administrator permission to as few people as possible.
• Create moderation roles with only the permissions they need: manage messages, time out members…
• Keep “Manage Channels”, “Manage Roles” and “Ban Members” for trusted people.
• Put sensitive roles at the top of the hierarchy: a member can’t edit a role above their own.
• Require two-factor authentication for moderation actions.
• Only add well-known bots, and remove the ones you no longer use.

Why permissions aren’t enough

Even when set up well, permissions trust the role, not the person behind the account. If a moderator gets their account stolen, the scammer inherits all their rights. The audit log will tell you what happened, but only afterwards.

So you need a protection that judges behaviour: a legitimate moderator doesn’t delete ten channels in two minutes.

How an anti-nuke works

An anti-nuke counts each member’s sensitive actions over a period of time, and steps in as soon as a threshold is crossed.

If your server was nuked

• Remove the responsible account’s roles right away, or kick it.
• Check the audit log to list what was deleted or edited.
• Unban members banned by mistake from the ban list.
• Recreate the deleted channels and roles, then check their permissions.
• If the account was hacked, ask its owner to change their password and turn on 2FA before giving their roles back.

Frequently asked questions