Calamity Discord Server Compromised in Crypto Scam After Owner Is Deceived

The Discord server for Terraria's long-running Calamity mod was reportedly compromised on October 9, 2026, exposing a community that had counted more than 250,000 members to a cryptocurrency promotion. The incident prompted an urgent warning from the former Calamity mod team and subreddit moderators, who told users to leave the server and avoid interacting with any crypto-related posts.

For a community already dealing with the fallout from Calamity's discontinued development and serious allegations surrounding its past, the server takeover was another damaging chapter. The hijacking appears to have exploited the trust attached to a familiar gaming community name: an announcement ping initially created the impression that there could be news about the dormant mod, only for the server to begin circulating links tied to a cryptocurrency named after Calamity.

Within roughly an hour, warnings began spreading elsewhere in the community. Moderators of the Calamity subreddit published an "Emergency PSA" urging members to get out of the Discord and not engage with the token being promoted there. The warning was blunt, reflecting the immediate concern that users could mistake the messages for a legitimate announcement from the mod's team.

A large abandoned community became a target

Calamity is one of the better-known mods built for Terraria, the popular sandbox action game. Over many years, the project accumulated a major following and its Discord became a central gathering place for players looking for updates, support, build discussions, and general community conversation. That size made the server valuable in its own right, even after the mod ceased active development.

For useful background on this topic, read ECC: Redline Draws Warzone Comparisons as NetEase's New FPS Divides Players.

The development team announced in August that it was ceasing work on Calamity. The project remained unfinished after that decision. With no expectation of routine official news, a server-wide notification on October 9 may nevertheless have drawn attention precisely because it suggested activity in a community that had been largely quiet.

That is an important part of why compromised social spaces can be effective tools for scammers. A large Discord server does not just offer a large audience; it offers an audience that already shares an interest and recognizes the server's name. A message posted from a familiar official-looking channel can seem more credible than the same message delivered through an unknown account, even if the promotion itself has no connection to the game, mod, or people who originally operated the community.

In this case, the crypto messages were reportedly posted repeatedly during the period in which the attackers controlled the server. The token was then described as having been pumped and dumped once the scam was identified. As with many token schemes, rapid activity and visibility can create pressure for people to act before they have time to verify whether a promotion is real. Community members were specifically advised not to click through or participate.

How the reported takeover happened

Posts shared after the incident said the server owner had been deceived by two people posing as former Calamity moderators. The previous owner later confirmed that account of the compromise in a separate post. By impersonating people with an apparent prior connection to the moderation team, the individuals allegedly convinced the owner to hand over the access needed to take control of the server.

One of those users subsequently identified themselves as "Kata," a name associated with alleged compromises of numerous prominent Discord servers over the last two years. The situation illustrates a persistent problem for volunteer-run game communities: security often depends as much on social verification as it does on passwords, permissions, and technical safeguards.

Even an experienced server owner can be vulnerable when someone claims to be a former colleague, moderator, developer, or platform representative. The most damaging attacks do not always begin with malware or a stolen password. They can begin with a convincing request made at the right moment, especially in communities where staff roles have changed repeatedly or where projects have become inactive.

Calamity's circumstances may have made that kind of impersonation especially difficult to assess. The mod had a lengthy and contentious recent history, including allegations that developers were owed several thousand dollars in wages and two separate sets of accusations involving the endangerment of minors. Those allegations, along with the August decision to end development, had already fractured confidence around the project. The Discord breach did not create those earlier disputes, but it added another reason for community members to be cautious about claims made under the Calamity name.

A former moderator wipes the server

After the fraudulent promotion was exposed, a former moderator said they were able to wipe the server because the attackers had overlooked their administrative permissions. The moderator described being able to "nuke" the server, removing its channels and messages. While that action erased the content the attackers had been using to promote the token, it also meant the sprawling community space was effectively stripped down in the process.

At the time of the reported aftermath, one channel remained: #announce. Messages in that channel from one of the apparent attackers claimed that no additional crypto content would be posted and suggested that the wrong people had been given permissions. Those statements should not be treated as a trustworthy resolution. When a server's ownership or administrative access has been compromised, any message posted through that server may be unreliable until control is independently restored and verified.

The community response appears to have been swift. Tens of thousands of users reportedly left the server over the following two days. For many members, departure was the safest and simplest response while it remained unclear who controlled the server, which accounts retained access, and whether further attempts at deception might follow.

What Calamity players should do next

Anyone who was in the Calamity Discord during the incident should assume that announcements made there on or after October 9 could have been posted by unauthorized users. Leaving the server, as the community warnings advised, reduces the chance of seeing future malicious posts presented as official news.

• Do not buy, trade, or connect a crypto wallet to any token promoted through the compromised server.
• Do not trust direct messages claiming to offer recovery help, compensation, special access, or a new official invite. Scammers frequently use a public breach to identify and target worried members.
• Do not reuse Discord passwords. If an account password has been shared elsewhere, change it and enable two-factor authentication.
• Review connected apps and authorized devices. Remove unfamiliar integrations or sessions from Discord and any linked services.
• Be wary of replacement communities. New servers and social accounts can adopt familiar names, logos, and moderator identities very quickly.

Players should also be careful not to confuse a Discord server's community identity with the security of every message sent through it. Discord roles, channel names, and old branding can all remain visible after a takeover. Those familiar elements do not prove that the person posting has authorization from a development team or former staff.

A warning for mod communities beyond Calamity

The Calamity breach is a particularly visible example of a wider issue affecting gaming communities. Mods can outlive their active development, but their Discords, subreddits, and social accounts often remain populated with players who are still looking for patches, forks, revival efforts, or simply a place to talk. That lingering audience can make inactive communities attractive targets.

Volunteer teams can reduce the risk by auditing permissions regularly, removing administrative access from dormant accounts, requiring multiple people to approve ownership changes, and confirming sensitive requests through an independent communication channel. A request from a supposed former moderator should be checked through known contact details rather than the account that initiated the request. Server owners should also keep a clear, verified method for communicating emergencies outside the Discord itself.

For players, the core lesson is simpler: unexpected financial promotions in a game community deserve skepticism, especially when they arrive with urgency, promises of an early opportunity, or claims that a familiar fan project has suddenly launched a token. A mod's name, a server-wide ping, and a recognizable avatar are not proof that a crypto offer is legitimate.

The Calamity Discord's future remains uncertain after its channels were wiped and a large portion of its membership departed. What is clear is that the server's scale and reputation were leveraged in an attempt to push a crypto scheme, and that former staff and community moderators moved quickly to warn users. Until there is a verifiable restoration of control, Calamity players should treat the Discord as compromised and seek updates with extreme caution.