ESN Docs

Docs › Blog

Discord bot token leaked? What to do in the next 5 minutes

2 min readUpdated Nov 4, 2026

A leaked bot token lets anyone control your bot in every server it's in. Here is exactly what to do, in order, and how to make sure it doesn't happen again.

1. Reset the token right now #

Go to the Discord Developer Portal → your app → Bot → Reset Token. The old token stops working the second you reset it, which kicks out whoever has it. Copy the new one once and keep it out of chat.

If Discord already reset it for you (you may get a DM from the Discord system account saying your token was found online), you still need a new one, so do the same thing.

2. Put the new token where your bot runs #

Paste it into your .env file (DISCORD_TOKEN=...) on the server that runs the bot, then restart. On ESN: Files → edit .env → save → Restart. Check the console shows your "Logged in as" line.

3. Check what the attacker did #

  • Open each server's Audit Log (Server Settings → Audit Log) and filter by your bot. Look for bans, deleted channels, new webhooks, role changes and mass messages.
  • Check Integrations → Webhooks for webhooks you didn't make, and delete them. Webhooks keep working even after the token is reset.
  • If the bot had Administrator, check every role and channel permission it could have changed.
  • Tell your community if spam or scam links were sent under the bot's name.

4. Find how it leaked #

The usual places, from most to least common:

  • A public GitHub repo, often in an old commit. Deleting the file doesn't remove it from history. The reset fixes the old one; for the future, add .env to .gitignore before your first commit.
  • A screenshot or a code paste in Discord, a forum or a video.
  • A shared hosting project (a public Replit, Glitch or similar) where anyone could see the files.
  • A friend or old helper who had access to the code.
  • A malicious package or "token checker" tool you ran.

5. Make the next leak harmless #

  • Keep the token in .env only, never in code. .env goes in .gitignore.
  • Don't give your bot Administrator. Give it only the permissions it uses, so a stolen token can do less.
  • Put the bot's role below your staff roles.
  • Turn on 2FA on your Discord account so nobody can open the Developer Portal as you.
  • Run your bot on a private host instead of a public project page. On ESN Hosting your files stay on your own server, and only you and the subusers you add can see them.

The 60-second version #

  1. Reset Token in the Developer Portal.
  2. Paste the new token into .env and restart the bot.
  3. Check the Audit Log and delete unknown webhooks.
  4. Find and close the leak (GitHub, screenshots, public projects).
  5. Remove Administrator from the bot.

FAQ #

Can someone hack my Discord account with my bot token? #

No. A bot token controls the bot, not your personal account. But they can do anything the bot's permissions allow in every server it's in.

Will resetting the token break my bot? #

Only until you put the new token in .env and restart. Commands and settings stay the same.

Does deleting the GitHub repo fix it? #

No. Copies may already exist. Always reset the token; that is the only thing that makes the leaked one useless.

Host your bot 24/7 from $0.50/month →

Still stuck? Use the live chat on the panel or ask in the ESN Systems Discord. Last updated November 4, 2026.