Verify a decision

{"actor":"system:backfill","investigation_id":"42f52f58-fc81-40ce-b0d2-fd43cb8b9520","kind":"publish","page_slug":"calamity-mod-discord-crypto-pump-and-dump-takeover-october-2026","published_at":"2026-10-13T23:14:17.144Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Calamity Mod Discord Crypto Pump-and-Dump Takeover (October 2026)","sections":[{"content":"On October 9, 2026, the official Discord server for the Terraria Calamity Mod — one of the most popular Terraria mods, with over 250,000 members — was taken over by individuals allegedly including a threat actor publicly identified only as 'Kata.' According to reporting by Kotaku and corroborated by multiple gaming outlets, the takeover was accomplished entirely through social engineering: two users impersonated former moderators of the server and persuaded the server owner to grant them administrative access. No technical exploit of Discord's platform infrastructure has been reported. Once in control, the attackers sent a server-wide ping to the full membership — a message initially interpreted by some members as a sign that mod development, which had ceased in August 2026, might be resuming — and then flooded server channels with promotional links to a newly created cryptocurrency named after the Calamity server. According to Kotaku, the coin was allegedly pumped and dumped almost immediately after the community became aware of the scam, meaning its price was artificially inflated by the coordinated promotion before the operators sold their holdings, leaving any buyers at a loss. Specific token names, the blockchain on which the token was deployed, and verified financial loss figures have not been disclosed in any source reviewed for this investigation.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Hacker Steals Discord For Terraria Mod Calamity To Pump Crypto — Kotaku","type":"news_article","url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"credibility":2,"name":"Hacker hijacks Calamity Discord server for a crypto scam — SpawnPoint","type":"news_article","url":"https://spawnpoint.be/calamity-discord-server-hacked-crypto-scam/"},{"credibility":3,"name":"Pirat_Nation on X — summary tweet with sourced detail","type":"social_media","url":"https://x.com/Pirat_Nation/status/2109781912189309429"}]},{"content":"One of the two accounts involved in the social-engineering approach subsequently self-identified as 'Kata,' a handle associated with a pattern of Discord server hijackings reported across gaming communities. Kotaku describes Kata as having 'reportedly hacked dozens of popular Discord servers over the past two years,' and mentions prior takeovers including servers for the games Item Asylum and Forsaken. The attack method attributed to Kata across incidents is consistently social engineering rather than technical exploitation: the attacker allegedly approaches server owners or staff while impersonating trusted figures, persuading them to voluntarily grant administrative permissions. A commentary post on X (from the account @RobloxVoiceChat, a Tier 3 source) characterized the technique as 'basic script kiddie shit' — compromising admins via 'vulnerable passwords or malware' — but this characterization is not independently verified. No real-world identity, jurisdiction, or criminal record for the individual or individuals behind the 'Kata' handle has been established in any source reviewed for this investigation. All references to Kata as a single individual are unverified; the handle could represent a group or be shared.","heading":"Threat Actor: 'Kata'","severity":"high","sources":[{"credibility":2,"name":"Hacker Steals Discord For Terraria Mod Calamity To Pump Crypto — Kotaku","type":"news_article","url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"credibility":2,"name":"Calamity Discord Hacked: Fake Moderators Handed 250,000 Members to a Crypto Scammer — TalkEsport","type":"news_article","url":"https://www.talkesport.com/news/gaming/calamity-discord-hacked-crypto-scam/"},{"credibility":3,"name":"troy (@RobloxVoiceChat) on X — commentary on Kata's methods (Tier 3)","type":"social_media","url":"https://x.com/RobloxVoiceChat/status/1902641636946911556"}]},{"content":"This incident illustrates a documented and growing attack pattern: the seizure of large, trusted gaming community Discord servers — whose members are predominantly non-crypto-native — for the purpose of launching short-lived cryptocurrency pump-and-dump promotions. The technique exploits several structural vulnerabilities simultaneously. First, large Discord servers are often administered by small volunteer teams where administrative credentials are informally managed and social trust is high. Second, a server-wide ping from what appears to be an authoritative account carries implicit credibility with members who have no reason to expect the channel to be compromised. Third, gaming audiences targeted in this way have limited baseline familiarity with crypto scam patterns, reducing the friction for deception. The Calamity incident was made particularly effective by the timing: the mod had publicly ceased development in August 2026, meaning any server-wide communication could plausibly be interpreted as a major announcement. According to the SpawnPoint report, 'some members read the alert as a sign that Calamity might be coming back.' Broader Discord-based attack vectors in the same period have included invite-link hijacking and clipboard-hijacking malware distribution, documented by Check Point Research (June 2025) and CloudSEK (December 2025), though those are distinct technical methods from the social-engineering server takeover seen here.","heading":"Attack Vector: Gaming Community Discord Hijack for Crypto Fraud","severity":"high","sources":[{"credibility":2,"name":"Hacker hijacks Calamity Discord server for a crypto scam — SpawnPoint","type":"news_article","url":"https://spawnpoint.be/calamity-discord-server-hacked-crypto-scam/"},{"credibility":2,"name":"From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery — Check Point Research","type":"research","url":"https://research.checkpoint.com/2025/from-trust-to-threat-hijacked-discord-invites-used-for-multi-stage-malware-delivery/"},{"credibility":2,"name":"Discord Invite Link Hijacking Delivers AsyncRAT and Skuld Stealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/06/discord-invite-link-hijacking-delivers.html"}]},{"content":"Within approximately one hour of the initial server-wide ping, former moderators of the Calamity server — who had retained administrative privileges that the attackers had overlooked — took coordinated countermeasures. Moderators in the r/CalamityMod subreddit issued an 'EMERGENCY PSA' instructing members to 'LEAVE THE DISCORD SERVER' and to 'NOT ENGAGE IN THEIR CRYPTO,' according to multiple outlets citing the post. Separately, at least one former moderator used their retained admin access to 'nuke' the Calamity Discord server, deleting all channels and their message histories — a measure that simultaneously removed the scam content and destroyed the server's accumulated community resources. According to reporting in Kotaku and SpawnPoint, tens of thousands of members departed the server in the days following the incident. No statement from Discord Inc. regarding platform-level action (account suspension, server removal, or policy enforcement) has been reported in any source reviewed for this investigation.","heading":"Community Response and Mitigation","severity":"medium","sources":[{"credibility":2,"name":"Hacker Steals Discord For Terraria Mod Calamity To Pump Crypto — Kotaku","type":"news_article","url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"credibility":2,"name":"Hacker hijacks Calamity Discord server for a crypto scam — SpawnPoint","type":"news_article","url":"https://spawnpoint.be/calamity-discord-server-hacked-crypto-scam/"},{"credibility":2,"name":"Terraria's Popular Calamity Mod Discord Server Hacked in Cryptocurrency Scam — PakGamersHub","type":"news_article","url":"https://www.pakgamershub.com/terrarias-popular-calamity-mod-discord-server-hacked-in-cryptocurrency-scam/"}]},{"content":"The Calamity Mod is a large-scale expansion mod for the 2011 sandbox game Terraria, originally created by a developer known as Fabsol. By October 2026 its Discord server had accumulated over 250,000 members, making it one of the larger gaming-community Discord servers. The mod had ceased active development in August 2026 following allegations against its then-lead developer Ozzatron, described by Kotaku as accusations of 'endangering minors on Discord.' The remaining development team announced on approximately August 10, 2026 that they were collectively ceasing work due to what they described as an 'irrecoverably tainted reputation.' The shutdown, and the resulting absence of regular server activity, created the contextual conditions that made the October 9 server-wide ping particularly effective as a social-engineering lure. This background is relevant to understanding why a dormant but high-membership server presented an attractive target for a rapid pump-and-dump operation.","heading":"Background: Calamity Mod Context","severity":"low","sources":[{"credibility":2,"name":"Terraria Mod Devs Ask Users To Pull Donations Following Allegations — Kotaku","type":"news_article","url":"https://kotaku.com/devs-of-popular-decade-old-terraria-mod-ask-users-to-cancel-patreon-donations-following-allegations-of-its-lead-endangering-minors-2000723400"},{"credibility":2,"name":"Terraria Calamity mod shuts down after 10 years over tainted reputation — Dot Esports","type":"news_article","url":"https://dotesports.com/general/news/calamity-devs-pull-the-plug-on-terrarias-beloved-mod-after-troubled-past-controversy"},{"credibility":2,"name":"Decade-old Terraria mod shuts down after lead developer faces serious allegations — Dexerto","type":"news_article","url":"https://www.dexerto.com/gaming/decade-old-terraria-mod-shuts-down-after-lead-developer-faces-serious-allegations-3396883/"}]},{"content":"As of the investigation date (October 13, 2026), several material facts remain unverified or undisclosed across all sources reviewed. The specific name of the cryptocurrency token promoted during the attack has not been publicly confirmed in any Tier 1 or Tier 2 source. The blockchain on which the token was deployed has not been identified. No quantified financial loss figures — total market cap of the token at peak, estimated proceeds to the operators, or aggregate losses to purchasers — have been reported. The real-world identity of the individual or individuals operating under the 'Kata' handle has not been established. No law enforcement investigation, regulatory inquiry, or criminal charges have been reported. Discord Inc. has issued no public statement. The PakGamersHub report notes explicitly that 'the reported cryptocurrency scheme and the identities involved have not been independently confirmed' in that publication. The confidence score for this investigation reflects the absence of Tier 1 sourcing and the lack of verified on-chain or financial data.","heading":"Unresolved Questions and Limitations","severity":"medium","sources":[{"credibility":2,"name":"Terraria's Popular Calamity Mod Discord Server Hacked in Cryptocurrency Scam — PakGamersHub","type":"news_article","url":"https://www.pakgamershub.com/terrarias-popular-calamity-mod-discord-server-hacked-in-cryptocurrency-scam/"}]}],"sources_used":[{"credibility":2,"name":"Hacker Steals Discord For Terraria Mod Calamity To Pump Crypto — Kotaku","type":"news_article","url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"credibility":2,"name":"Hacker hijacks Calamity Discord server for a crypto scam — SpawnPoint","type":"news_article","url":"https://spawnpoint.be/calamity-discord-server-hacked-crypto-scam/"},{"credibility":2,"name":"Calamity Discord Hacked: Fake Moderators Handed 250,000 Members to a Crypto Scammer — TalkEsport","type":"news_article","url":"https://www.talkesport.com/news/gaming/calamity-discord-hacked-crypto-scam/"},{"credibility":2,"name":"Terraria's Popular Calamity Mod Discord Server Hacked in Cryptocurrency Scam — PakGamersHub","type":"news_article","url":"https://www.pakgamershub.com/terrarias-popular-calamity-mod-discord-server-hacked-in-cryptocurrency-scam/"},{"credibility":2,"name":"Terraria-Mod Calamity: Hacker kapert Discord-Server mit 250.000 Nutzern — Spielemagazin.de","type":"news_article","url":"https://www.spielemagazin.de/spiele/news/terraria-mod-calamity-hacker-kapert-discord-server-mit-250-000-nutzern/41059"},{"credibility":3,"name":"Pirat_Nation on X — incident summary","type":"social_media","url":"https://x.com/Pirat_Nation/status/2109781912189309429"},{"credibility":2,"name":"Terraria Mod Devs Ask Users To Pull Donations Following Allegations — Kotaku","type":"news_article","url":"https://kotaku.com/devs-of-popular-decade-old-terraria-mod-ask-users-to-cancel-patreon-donations-following-allegations-of-its-lead-endangering-minors-2000723400"},{"credibility":2,"name":"Terraria Calamity mod shuts down after 10 years over tainted reputation — Dot Esports","type":"news_article","url":"https://dotesports.com/general/news/calamity-devs-pull-the-plug-on-terrarias-beloved-mod-after-troubled-past-controversy"},{"credibility":2,"name":"Decade-old Terraria mod shuts down after lead developer faces serious allegations — Dexerto","type":"news_article","url":"https://www.dexerto.com/gaming/decade-old-terraria-mod-shuts-down-after-lead-developer-faces-serious-allegations-3396883/"},{"credibility":2,"name":"From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery — Check Point Research","type":"research","url":"https://research.checkpoint.com/2025/from-trust-to-threat-hijacked-discord-invites-used-for-multi-stage-malware-delivery/"},{"credibility":2,"name":"Discord Invite Link Hijacking Delivers AsyncRAT and Skuld Stealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/06/discord-invite-link-hijacking-delivers.html"},{"credibility":3,"name":"troy (@RobloxVoiceChat) on X — commentary on Kata methodology (Tier 3)","type":"social_media","url":"https://x.com/RobloxVoiceChat/status/1902641636946911556"}],"summary":"On October 9, 2026, a threat actor known as 'Kata' — reportedly linked to dozens of prior Discord server takeovers — used social engineering to obtain administrative control of the 250,000-member Terraria Calamity Mod Discord server, then immediately promoted a newly created cryptocurrency named after the server in an alleged pump-and-dump scheme. Former moderators issued an emergency warning and one wiped the server's channels before tens of thousands of members departed. No regulatory action or criminal charges have been reported as of the investigation date.","timeline":[{"date":"2026-08-10","event":"Calamity Mod development team announces cessation of all work following grooming allegations against lead developer Ozzatron, citing an 'irrecoverably tainted reputation.' Server goes dormant.","source":"Dot Esports","source_url":"https://dotesports.com/general/news/calamity-devs-pull-the-plug-on-terrarias-beloved-mod-after-troubled-past-controversy"},{"date":"2026-10-09","event":"Two users posing as former moderators allegedly persuade the Calamity Discord server owner to grant administrative access. One later self-identifies as 'Kata.'","source":"Kotaku","source_url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"date":"2026-10-09","event":"Attackers send a server-wide ping to 250,000-plus members. Channels are subsequently flooded with promotional links to a newly created cryptocurrency named after the Calamity server.","source":"Kotaku","source_url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"date":"2026-10-09","event":"Approximately one hour after the initial ping, the r/CalamityMod subreddit issues an EMERGENCY PSA urging members to leave the server and avoid the cryptocurrency links.","source":"SpawnPoint","source_url":"https://spawnpoint.be/calamity-discord-server-hacked-crypto-scam/"},{"date":"2026-10-09","event":"A former moderator, whose admin permissions were overlooked by the attackers, 'nukes' the Calamity Discord server — deleting all channels and message history.","source":"Kotaku","source_url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"date":"2026-10-09","event":"The promoted cryptocurrency is allegedly pumped and dumped almost immediately after the community becomes aware of the scam. No quantified financial data has been reported.","source":"Kotaku","source_url":"https://kotaku.com/notorious-hacker-steals-250000-user-discord-server-for-infamous-terraria-mod-calamity-immediately-uses-it-to-pump-and-dump-a-crypto-coin-2000744152"},{"date":"2026-10-11","event":"Tens of thousands of members reported to have left the Calamity Discord server in the days following the incident. Multiple gaming outlets publish coverage.","source":"SpawnPoint / TalkEsport","source_url":"https://spawnpoint.be/calamity-discord-server-hacked-crypto-scam/"}]},"v":1}