Security notice: VaultCord-associated bot credentials

On November 1 (UTC), the RestoreCord team detected unusual, repeated requests to a Message Studio API endpoint. Our investigation identified a cluster of newly created accounts showing a consistent setup pattern and using credentials for Discord bots configured with VaultCord-related endpoints.

This notice concerns suspected abuse of RestoreCord's API using third-party bot credentials. Our team has found no evidence that RestoreCord's database or infrastructure was breached. The credential-exposure concern relates to bots associated with VaultCord (vaultcord.com). A compromise of VaultCord-held credentials or sharing by someone with access is under investigation. We believe a VaultCord breach is likely, but it has not been confirmed.

We are publishing this notice so potentially affected bot owners can take precautions while those questions remain unresolved.

What we observed

Our investigation identified 11 related RestoreCord accounts. 10 had each added 1 Discord bot and created 1 RestoreCord server record.

The 10 bot-onboarding accounts followed the same sequence:

Bot and server creation requests from 7 accounts presented curl user agents, and requests from 1 presented Postman. Those are indicators of programmatic API use. Combined with the repeated workflow, they strongly suggest coordinated, partly automated provisioning.

All 10 bot-onboarding accounts shared the same last IP in the account records. 9 of the wider 11-account cluster used Bravealias email addresses, while 2 used iCloud addresses. The repeated setup pattern, common IP, and credential relationships provide the meaningful account correlation; an email alias or API client alone is not evidence of wrongdoing.

How the bots connect to VaultCord

Using Discord, we found that all 10 bots had redirect URLs or interaction endpoints associated with VaultCord, including vaultcord.win, api.vaultcord.com, and novanode.win, a domain that redirects to VaultCord. These were application settings returned by Discord, including redirect URLs and interaction endpoints.

The common service configuration is a significant reason for investigating the source of this credential collection. It establishes a connection between the applications and VaultCord's service ecosystem. It does not establish who submitted the credentials to RestoreCord or whether their use was authorized by the application owners.

Why we are concerned about stored bot credentials

The central question is how a coordinated group of RestoreCord accounts obtained working credentials for multiple applications, owned by different Discord users, that all retained VaultCord-related configuration.

The most likely explanation, in our assessment, is access to VaultCord's database containing bot credentials. That could involve an external compromise, exposure of stored credentials, or disclosure or sharing by someone with legitimate access. Potential involvement by a staff member or owner is an investigation hypothesis, not an allegation that we have substantiated against a particular person.

Other credential sources and owner-authorized onboarding have not been ruled out. The existence of working tokens, different application owners, and a common service configuration does not independently prove that the tokens were stolen, that VaultCord's database was accessed, or that VaultCord staff or its owner carried out the RestoreCord activity.

The pattern makes a VaultCord breach likely and justifies precautionary action, but the breach has not been confirmed.

Traffic spike and suspected DDoS attempt

On November 1, the monitoring dashboard for restorecord.com recorded 75M+ requests and 400GB+ of bandwidth during the displayed 23:36–23:53 UTC window. The chart shows a sharp traffic burst around 23:42–23:43 UTC. Our team treated this as a suspected DDoS attempt. The service remained available, and we have identified no resulting damage.

This traffic burst coincided with the Message Studio API abuse involving accounts that had added VaultCord-configured bots. We are investigating those events together.

Traffic overview

Our request to VaultCord

We detected the activity early and suspended the automated accounts from our service. Our initial assessment has identified no resulting damage, and our team has found no evidence that RestoreCord's database or infrastructure was breached.

We ask VaultCord, its staff, owners, and anyone acting on its behalf to refrain from harassing RestoreCord or abusing our services. Any ongoing automated abuse must stop. Concerns or disputes should be raised through direct, responsible communication rather than disruptive requests against our infrastructure.

We also ask VaultCord to:

• Investigate how these bot credentials came to be used.
• Review access to its database and stored tokens.
• Establish whether the application owners authorized the onboarding.
• Provide a clear explanation to potentially affected users.

Precautions for VaultCord users

As a precaution, if you use VaultCord (vaultcord.com), we recommend rotating any bot token you supplied to the service and/or stopping your use of VaultCord. If you stop using the service, remove the integration and do not supply it with your replacement token.

1. 1Reset the bot token in the Discord Developer Portal. Resetting invalidates the previous token, so update your own bot runtime and only the integrations you trust and authorize.
2. 2Review the application's settings. Check its redirect URLs, interaction endpoint, webhook configuration, and ownership, and confirm that each one serves an integration you intended to use.
3. 3Pause or discontinue the VaultCord integration if you cannot obtain a satisfactory explanation of how credentials are stored, accessed, and protected. If you stop using the service, rotate the token and do not submit the replacement to it. Replacing a token and immediately supplying it to an unresolved source of exposure may not address the concern.
4. 4Review your own application records for unexpected changes or use, and preserve relevant timestamps and configuration before making changes where practical.

Switching to RestoreCord

Everyone switching from VaultCord to RestoreCord can receive 2 months of a RestoreCord Business subscription completely free. Contact support to claim it.

When you add your bot to RestoreCord, use a freshly reset token that you have not supplied to any other service.

What remains unresolved

We can document the related RestoreCord accounts, repeated provisioning, working bot credentials, Discord-reported ownership, and VaultCord-associated application configuration. We believe a VaultCord database breach is likely, but we cannot currently confirm it, identify a person who leaked or shared tokens, establish lack of owner authorization, or attribute the activity to VaultCord's owner or staff.

The detection of Message Studio traffic and the early-response, no-identified-damage assessment are statements from the RestoreCord team.

Our warning is based on the seriousness of a possible exposure of working bot credentials and the coordinated activity we observed. We consider a breach of the provider likely, but it is not confirmed, and this notice is a call for caution and investigation rather than a declaration that a breach or insider disclosure has been confirmed.