Key Takeaway:
On 4 October 2026 an attacker broke into Double Counter, a popular Discord bot that checks new members for alt accounts and VPNs, and copied data tied to about 28 million Discord accounts: usernames, IP addresses with approximate location and internet provider, a browser fingerprint, and about a million email addresses. Discord itself wasn’t hacked and no passwords were exposed. A leaked IP address can’t reveal your street address or let someone into your devices on its own, but together with your Discord username it’s enough for targeted phishing, harassment attempts or an attack on your home connection. Check Have I Been Pwned for your email, treat any message about “re-verifying” with suspicion, and if you’re worried, getting a new IP address is often as simple as restarting your router.
What Happened
Double Counter is a moderation bot that server owners add to Discord to stop people from joining with second accounts, to block raids and to keep out VPN users. According to Dexerto, it’s used in more than 600,000 communities. Its owner, Tellter, published a detailed incident report on 5 October 2026.
- When: the attacker started probing an old server on 3 October and was inside Double Counter’s systems for most of 4 October (UTC). The data was copied in about 25 minutes that afternoon.
- How much: about 12 GB copied from one database, covering roughly 28 million accounts.
- What else the attacker did: used the bot’s own login to post invites to the attacker’s server in about 50 large communities, and ran up $7,316 of charges on a company card belonging to another Tellter product. The company says the small charges to two customers have been refunded.
- Discord’s response: Discord told Dexerto it was “not a breach of Discord” and that it had “disabled new installs of the app” while the investigation continues.
- Regulator: Tellter says it notified France’s data protection authority, the CNIL, on 5 October.
What Was Exposed
The company couldn’t download a full list of what left its systems, so it is treating whole categories as exposed even where only part was copied. These are its own figures:
| Data | Accounts (approx.) | Status |
|---|---|---|
| Discord user ID and username | 28 million | Partly copied, treated as exposed |
| IP address and approximate location (including city and internet provider) | 27 million | Partly copied, treated as exposed |
| Browser fingerprint (a hash of the user-agent, used to spot alts) | 25 million | Copied |
| Email address | 1 million | Copied |
| VPN detection logs | 15 million | Not copied |
| Discord passwords, payment card numbers | — | Not held by Double Counter, so not exposed |
Have I Been Pwned added the breach on 7 October with 274,922 email addresses, along with usernames, names and locations. That’s fewer than the million the company says were copied, so not finding your address there doesn’t completely rule you out. The company has also warned its advertisers and API customers to expect phishing.
Why a Discord Bot Had Your IP Address
Discord doesn’t share members’ IP addresses with bots. Double Counter gets them a different way: when you join a server that uses it, the bot sends you a verification link, and you open it in your browser. That web page sees what every website sees, your IP address and browser details, and by the company’s own description it compares them along with cookies and other fingerprinting signals to decide whether you’re a second account or using a VPN.
That’s the part of this story worth remembering beyond Discord. A “verify you’re human” step is often also a data-collection step: it records the connection you used and enough about your browser to recognise you again. If you want to see how much a single page can read without asking, our What This Website Already Knows About You page shows it live, and stores none of it.
🔍 What Someone Can Do With Your Leaked IP Address
An IP address on its own is less dangerous than it sounds, but in this leak it’s linked to a Discord username, and that combination is what matters.
| They can | They can’t |
|---|---|
| See your approximate city and your internet provider, and tie them to your Discord name | Find your street address from the IP. Only your provider knows which customer had it, and it doesn’t hand that out without a legal order |
| Write convincing phishing: “we noticed a login from [your city]”, fake Discord or provider support, fake “re-verify your account” links | Log in to your Discord account. Double Counter never had members’ passwords |
| Flood your home connection with traffic (a DDoS) to knock you offline, a known problem in gaming communities | Get into your computer or phone just by knowing the address. They’d need something on your network that’s exposed to the internet and vulnerable |
| Scan your connection for open ports and exposed devices | Use it forever. Most home connections get a new IP address from time to time, so a leaked address may already be out of date |
For the full picture, see What Can Someone Do With Your IP? Can They Hack You? and how accurate IP location really is.
🛡️ What to Do Now
- Check your email on Have I Been Pwned. Search your address at haveibeenpwned.com. If “Double Counter” appears, expect phishing that uses your name or username.
- Treat any “re-verify” message with suspicion. Double Counter says members don’t need to change anything on their Discord account. Don’t follow verification links sent by DM, and don’t join servers advertised in unexpected Double Counter messages. If a server asks you to verify, start from the server’s own verification channel.
- See whether your IP address has changed. Open our IP address checker. If you verified with Double Counter months ago, there’s a fair chance your address is already different. If you’re worried about harassment or attacks, restarting your router often gets you a new address on a home connection. It doesn’t always; some providers keep the same address for weeks. Why does my IP address keep changing? explains why.
- Close anything your connection exposes. Run our port scanner on your own connection. On a typical home line, little or nothing should answer. How to Check Open Ports explains what to do if something does.
- Turn on two-factor authentication on Discord. Your password wasn’t leaked, but phishing aimed at your Discord account is the most likely next step, and two-factor authentication stops a stolen password from being enough.
If you run a server that uses Double Counter: the company asks admins to delete any Double Counter message posted on 4 October between 12:00 and 16:30 UTC that invites people to another server, and to check the audit log for anything the bot did in that window.
How the Attacker Got In
The way in wasn’t Double Counter’s main systems. It was a server the company had retired but never switched off. A data-analysis tool was still running on it and reachable from the internet, and the attacker exploited it, probing from rotating VPN addresses for about a day first. On that forgotten server were two saved credentials, and those opened the door to the company’s live cloud systems, its database and the bot’s own login.
The lesson applies at home too: the device you forgot about is the one nobody updates. An old router in a cupboard, a camera you stopped using, a port you forwarded years ago for a game server. If it’s still connected, it’s still a way in.
Does a VPN Help Next Time?
A VPN would have meant the bot recorded the VPN server’s address instead of your home one. The catch is that blocking VPN users is one of Double Counter’s main features, so many servers that use it won’t let you verify through a VPN at all. The more realistic protection is knowing what a verification page collects, and deciding which communities are worth handing your connection details to. How to hide your IP address covers the options and their limits.
FAQ
Was Discord hacked?
No. The breach was at Double Counter, a separate company whose bot runs on Discord. Discord says it wasn’t a breach of Discord, and it has stopped new installs of the bot while the investigation continues.
Was my Discord password leaked?
No. Double Counter never receives Discord passwords, so they couldn’t be in the stolen data. The bot’s own login token was stolen and has since been replaced.
How do I know if my data was in it?
If you ever completed a Double Counter verification when joining a Discord server, assume your username, IP address and approximate location were exposed. For your email address, check Have I Been Pwned, keeping in mind it doesn’t hold every copied address.
Can someone find my house from the leaked IP?
Not from the IP alone. It points to your provider and roughly your town or city. The danger is combining it with other things you’ve shared publicly, like your real name, photos or the school or club you mention in chats.
Should I stop using servers with verification bots?
Not necessarily: they do stop real spam and raids. But treat verification like signing up for something. The page records your connection, and the company behind it now holds that data, as this breach shows.
The Short Version
A Discord moderation bot leaked IP addresses, rough locations and usernames for about 27 million accounts, plus around a million email addresses. Your password and Discord account are safe. Expect phishing, don’t re-verify through links in messages, check your email on Have I Been Pwned, and if it worries you, get a new IP address by restarting your router and close any open ports.
Sources
- Double Counter — Security incident, October 2026 (incident report, published 5 Oct 2026)
- Dexerto — Discord disables new bot installs after hack exposed millions of users’ IP addresses (updated 7 Oct 2026)
- Have I Been Pwned — Double Counter breach (added 7 Oct 2026)
- Double Counter — how the bot’s verification works (company’s own description)