Identify who can speak and redirect users
Assign a community owner and inventory server owners, moderators, announcement publishers, bots, webhooks and connected applications. Record who can change roles, invite integrations, edit official links or publish to high-visibility channels. Discord documents role hierarchy and channel permissions; review effective permissions with a test member instead of relying only on how a role is named.
Maintain a canonical page for official domains, support channels and verification instructions. State what legitimate support will never request, such as a seed phrase, private key or payment to unlock an account. Give users a way to verify a moderator through an existing channel without requiring a wallet connection. A pinned message can be changed by a compromised administrator, so keep an independently controlled reference as well.
Reduce account, bot and publishing authority
Discord supports security keys and other MFA methods and warns about backup-code recovery. Enroll strong authentication for high-impact operators and store recovery material independently. Give bots only the permissions needed for their job, restrict who can install or reconfigure them and rotate their tokens when ownership changes. A bot that can post announcements does not automatically need administrator privileges.
Our procedure is to require a second review for changes to wallet links, claims, downloads and payment instructions. Verify the exact destination through an established source, not a shortened link or an image of an address. Keep support staff from downloading unknown archives onto the devices used for server administration. Separate community automation from treasury and deployment credentials.
Contain a malicious announcement
On a suspicious post, preserve message identifiers, timestamps, author or webhook identity and the linked destination without interacting with a potentially malicious wallet flow. Use an independent administrator to restrict affected publishing paths and revoke the compromised session, token or integration. Determine whether the attacker changed roles, invites, other links or connected services before removing only the visible message.
Publish a concise correction through verified channels, stating what happened, which links were affected and what users should do. Distinguish clicking a link, connecting a wallet and signing an approval because their implications differ. Do not promise that a disconnect reverses an on-chain authorization. Direct affected users toward verified information, and avoid collecting unnecessary sensitive evidence in public channels.
Rehearse without alarming the community
Use a private test server to simulate a compromised moderator and bot. Post an obviously synthetic test link, confirm monitoring reaches the responder and time the restriction and credential-revocation process. Test role hierarchy and a bot’s ability to modify more privileged roles. Verify that a backup administrator can publish a correction when the primary operator is unavailable.
Review community permissions after staffing and bot changes. Archive obsolete campaign channels, revoke unused webhooks and expire temporary elevated roles. Maintain an incident contact list outside the platform. The exercise passes when the team can preserve evidence, stop further publishing and guide users through clear independently verifiable information without inventing an urgent new trust request.
Controls to take away
- Community publishing authority can become a wallet attack path.
- A correction should reduce new trust requests during an incident.
- Wallet disconnection and on-chain approval revocation are different actions.
Take this to your next review
Working checklist
Use this as a starting point, then assign owners and record evidence in your team's own system. Checks here reset when you leave or reload this note.
0 of 5 reviewed
Sources & further reading
The references below support this note. Adapt the procedures to your systems, access model and recovery requirements.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.