When official channels get hacked

Real project accounts on X, Discord and Telegram are regularly compromised to post fake airdrops. How these attacks work and how to protect yourself even when the source looks genuine.

Last reviewed 2026-10-27 · 2 min read

On this page
  1. How accounts get compromised
  2. Warning signs of a hijacked announcement
  3. What to do
  4. If you run a project or community

"It was posted by the official account" is not proof that a link is safe. Project accounts, founders' accounts and Discord servers are compromised regularly, and the attackers use them for exactly one thing: posting a fake claim or mint link to the largest possible audience.

How accounts get compromised

  • Phishing the team. Fake press or partnership emails, fake "copyright violation" notices and fake platform security warnings that steal login credentials or session cookies.
  • SIM swaps on accounts protected only by SMS. See SIM-swap protection.
  • Malicious bots or integrations in a Discord server with too many permissions, or a compromised moderator account.
  • Malware on a team member's computer that steals session cookies, bypassing passwords and 2FA.

Warning signs of a hijacked announcement

  • A surprise airdrop or mint with no prior mention on the website, blog or docs.
  • Heavy urgency: "only the next 2 hours", "limited supply".
  • Comments or replies turned off, or users being banned for questioning it.
  • The link uses a new domain, not the project's usual one.
  • Messages from several channels at once, such as every Discord channel suddenly showing the same link.
  • Unusual writing style for that project.

What to do

  1. Wait. Real airdrops are not first-come, first-served in minutes. If it is genuine, it will still be there after you check.
  2. Cross-check on other official channels. If the Discord says "airdrop live", check the website, the docs and the X account, reached through your own bookmarks.
  3. Check the domain against your bookmark of the project's site.
  4. Never connect your main wallet, even if you are convinced.

If you run a project or community

  • Protect team accounts with security keys, not SMS.
  • Keep Discord bot and moderator permissions minimal, and limit who can post in announcement channels or use @everyone.
  • Publish your official domains and policy ("we will never DM you", "we only announce claims on X, the blog and the website") so users know what to expect.
  • Prepare an incident plan: who can lock the server, how to post a warning on other channels quickly.