When a Discord raid or scam hits, minutes matter. Use this practical incident response playbook to detect, contain, and recover fast without losing community trust.
Web3 communities face high stakes on Discord because attackers target the places where wallet owners and announcements live. A single compromised role or webhook can broadcast a fake mint, wallet connect prompt, or airdrop to tens of thousands of holders in seconds. The result is lost funds, damaged brand trust, and long recovery cycles if you do not act quickly. A clear Discord incident response plan reduces time to detect and contain, limits message reach, and protects core assets like announcement channels and verification flows. Set measurable goals such as under two minutes to acknowledge, under five minutes to contain, and under thirty minutes to recover essential functions. Treat Discord with the same rigor you give smart contracts, treasuries, and web infrastructure.
Define a small on call team with clear responsibilities so there is no scramble during a crisis. Name an Incident Lead to own decisions and timeline, a Technical Lead to manage permissions, bots, and integrations, a Moderation Lead to coordinate channel actions and reports, and a Communications Lead to handle member updates and partner outreach. Publish an internal escalation matrix with backups, response hours, and direct contacts across time zones. Enforce least privilege for all staff and require hardware key based 2FA for owners and moderators, then turn on the server setting that requires 2FA for moderation actions. Prepare a break glass role with the exact permissions needed to lock channels, manage webhooks, and remove compromised integrations, and store its activation steps in a secure playbook. Keep a private war room channel for responders and a separate read only status channel where only the Communications Lead can post verified updates.
You cannot respond fast if you do not see trouble early, so wire up signals and agree on what is critical. Watch for join spikes, mass mentions, new webhook creations, new OAuth2 grants, and sudden invite floods through the Audit Log and Server Insights. Monitor AutoMod hits, anti spam bot dashboards, and reports in ticket channels, and ask mods to escalate anything that includes wallets, QR codes, or external links that were not planned. Classify severity the moment you see it, such as P0 for a malicious message in announcements or a compromised staff account, P1 for a fast moving DM scam wave tied to your brand, and P2 for localized spam or phishing attempts in low risk channels. During triage, confirm scope by checking audit entries for role changes, webhook creations, and integration edits in the past 30 minutes. Capture evidence with message links, user IDs, and screenshots with UTC timestamps so you can investigate later without holding up containment.
Containment is about stopping spread, not solving root cause, so move quickly and focus on channels of highest trust. If announcements or updates are compromised, remove send permissions from all roles in those channels except your Incident Lead role, and turn off Mention Everyone for every role that holds it. Revoke or delete suspicious webhooks from the Integrations panel, then temporarily disable webhook creation by removing Manage Webhooks from all non critical roles. Lock public channels by denying Send Messages to @everyone, enable slowmode on busy chat channels, and revoke Create Instant Invite from public roles so fresh invites cannot be abused. Set verification level to Highest and require a verified phone temporarily to slow new joins if a raid is underway, then review AutoMod to block mention spam and suspicious links with aggressive actions like timeouts and message deletion. If a bot is implicated, immediately remove its Administrator permission or kick it, and rotate OAuth tokens before re adding it with the minimum required scope.
Once spread is contained, remove the attacker’s footholds and get safe operations back online. Delete malicious posts, clear pins from affected channels, and purge recent messages that reference a fake campaign, then post a verified update that the link was fake and no wallet connection is required. Audit roles that can post in announcements and grant mention permissions only to the Communications Lead role, then use channel overrides to keep threads open for questions while protecting the parent channel. Review every active webhook and integration token for provenance, rotate keys for bots that post announcements, and uninstall any unverified or unused apps. Require staff who were targeted to reset passwords, revoke all sessions in Discord settings, and confirm 2FA on a hardware key, then review their device hygiene. When you reopen channels, do it in phases, first announcements and support, then general chat, and keep stricter verification in place for at least 24 hours while monitoring.
Members judge you by clarity and speed, so set a single source of truth and repeat it across your surfaces. Post a short status in your verified announcements channel and on your official site to confirm you are aware, that staff never DM for wallet keys, and that all real links live on your domain. Do not paste scam links in your updates, even to warn people, since quoting them can backfire if users skim. Use a branded short link on your domain that forwards to a living status page so you are not forced to drop raw URLs into Discord while you are still cleaning. Mirror the update to Twitter or another public feed and pin it, then ask partner communities to echo the same language to counter impersonation. Set expectations for the next update time, for example every 30 minutes until resolved, and provide a safe support path through tickets or a temporary form that does not request wallet secrets.
Hold a blameless review within 48 hours to capture what happened and how to prevent a repeat. Write a clear timeline from first signal to containment to recovery, and map root causes to controls such as role misconfigurations, webhook exposure, bot admin scope, or weak staff authentication. Track hard numbers, including mean time to acknowledge, mean time to contain, number of malicious messages removed, members who clicked, and tickets opened. Turn findings into specific actions, like removing Administrator from all bots, splitting announcement permissions from team wide roles, enforcing server 2FA for moderation, and creating an allowlist for official domains in AutoMod. Update your playbook steps, canned messages, and access lists, then schedule a drill that mirrors the incident so the team can practice the improved flow. Share a short public postmortem if appropriate to rebuild trust, highlight the fixes, and restate safe link practices.
Strong Discord incident response starts before anything breaks, so prepare resources you can use at full speed. Build a lightweight runbook with the first ten minutes scripted, including who flips which permissions, where to delete webhooks, what channels to lock, and who posts the first status update. Create pre written messages for incidents involving fake mints, compromised staff, DM scam waves, and bot abuse, and store them in a secure notes system that the Communications Lead can access. Keep an inventory of bots with owners, scopes, and reason for access, and verify that none hold Administrator unless there is a documented, reviewed exception. Schedule quarterly drills that simulate a compromised announcement and a DM scam wave, and practice across time zones so the entire team knows how to detect, contain, and recover. Finally, audit your server layout with security in mind, including a minimal announcement pathway, strict role based access to integrations, and a support flow that does not expose members to open DMs.
Build a fast, clear Discord incident response plan for Web3 communities. Set roles, detection, containment, recovery, and comms to stop raids and scams fast.