A hacker known as Kata took over the Calamity Discord server on October 9 and used its 250,000-plus members to promote a cryptocurrency, which was then pumped and dumped. Calamity is a decade-old mod for Terraria, and its Discord community was one of the largest built around the game.
The trouble started with a server-wide ping. Development on the mod stopped in August, so some members read the alert as a sign that Calamity might be coming back. Instead, the channels filled with links to a crypto coin named after the server.
How Kata got into the Calamity Discord server
According to a post on the r/CalamityMod subreddit, two users posing as former moderators tricked the server’s owner into handing over access. The previous owner later confirmed that account in a separate post.
After the scam came to light, one of the two users revealed themselves as Kata. According to Kotaku, Kata has hacked dozens of popular Discord servers over the past two years.
The spam ran for about an hour. Then the subreddit’s moderators put up an “EMERGENCY PSA” warning that the Calamity Discord server had been compromised. Their message was blunt: “If you are in the discord server, LEAVE THE DISCORD SERVER. If you are still in the discord server, DO NOT ENGAGE IN THEIR CRYPTO.”
Once the community knew about the scam, the coin’s backers pumped and dumped it almost immediately.
A former moderator wiped the server
The hackers missed one detail: a former moderator still held admin permissions. That moderator used them to “nuke” the Calamity Discord server, deleting every channel and its message history.
Even so, Kata and a second account kept hold of what remained. Kotaku suggests the second account is either an alt of Kata’s or a friend. The only surviving channel, #announce, carries messages from one of the hackers claiming that “no crypto slop will be posted” and that “some wrong people got permissions.”
Members do not appear convinced. Tens of thousands of users left the Calamity Discord server in the two days after the takeover.
A mod with a troubled recent history
The crypto scam is the latest problem for a project that has been in decline for several years. Calamity has faced two separate rounds of allegations about “endangering minors.” There is also an ongoing claim that its developers were never paid “several thousand” dollars in wages.
In August, following the second wave of child endangerment allegations, the team announced it was “ceasing all development” on Calamity. That left the mod unfinished, and it is the reason the October 9 ping gave some players hope of a return before the scam began.
The takeover did not rely on a technical exploit. According to the subreddit post and the previous owner, the attackers only needed the owner to believe that two strangers were trusted former staff. That single handover gave them the power to ping a quarter of a million accounts at once.