Bluesky Account Hacked: How to Recover It

You open Bluesky and your password no longer works. Or you are still logged in, but there are posts on your profile you never wrote, replies sent to strangers, or a message in your DMs from "Bluesky staff" asking you to verify your account. Something is wrong, and you want to know what to do first.

The short answer: try Bluesky's password reset first, because it sends a code to the email on your account. If that email is no longer yours or nothing arrives, report the compromise to Bluesky support by email. Once you are back in, clean up app passwords, turn on two-factor sign-in and check your handle.

This guide covers the recovery order, what to do if you cannot get the reset email, how to lock the account down, how custom domain handles fit in, the verification DM scam that Bluesky has warned about, and the limits of what support can do.

Last checked: 23 October 2026.

#What Should I Do First When My Bluesky Account Is Hacked?

Work through these steps in this order. Each one builds on the one before, and the early steps cut off the person who got in.

1. Try the password reset from the sign-in screen and set a new, unique password.
2. If the reset email does not arrive, or the email on the account has been changed, email support@bsky.app and include the email address you signed up with.
3. Once you are in, open Settings, then Privacy and Security, and delete any app passwords you do not recognise.
4. Turn on two-factor sign-in in the same Privacy and Security area.
5. Check the email address on the account and your handle are still yours.
6. Delete posts you did not make and warn your followers from your own account.
7. Change the password on your email account too, if you think it was also exposed.

#How Do I Reset My Bluesky Password?

Bluesky's password reset help page says: "Click 'Forgot' on the sign-in screen. You will receive an email with a reset code." You then enter that code and choose a new password. Pick one you have not used anywhere else, so a leak from another site cannot be reused against you.

Because the code goes to your account email, the reset depends on you still being able to open that inbox. Check your spam or junk folder before deciding it has not arrived.

The same help page says that if you do not receive the email, you can contact support@bsky.app. Bluesky's Terms of Service also say: "If you believe your Bluesky Account has been compromised, report it to us at support@bsky.app." Bluesky's support page gives the same address for help.

#What If I Cannot Access the Email on My Account?

This is the hardest situation. If someone changed the email on your Bluesky account, or you lost access to the inbox you signed up with, the reset code will not reach you. Bluesky's help pages do not set out a separate recovery form for this case, so your route is the support email.

When you write to support@bsky.app, include the details that help show the account is yours. Keep it short and factual.

• Your Bluesky handle and the link to your profile.
• The email address you originally signed up with.
• Roughly when you noticed the problem and what changed, such as the email, password or handle.
• Screenshots of posts or messages you did not make.
• Whether you use your own domain as your handle.

Never put your password or any login code in the email. Bluesky support does not need them, and its safety team has said Bluesky would never ask for your password about moderation decisions. Bluesky does not publish a reply time, so keep your evidence together while you wait.

#How Do I Lock My Bluesky Account Down Once I Am Back In?

Bluesky's safety team set out the key checks in a post from @safety.bsky.app in November 2025, written after it saw an increase in phishing and social engineering attempts. It pointed people to two settings.

App passwords let other apps and services sign in to your account. If an attacker created one, it could give them a separate way in, which is why Bluesky's safety team advises deleting ones you do not recognise. Only create new app passwords for tools you trust, and remove them when you stop using the tool.

#What If I Use My Own Domain as My Handle?

Bluesky lets you use a domain you own as your handle. Its guide to verifying your account explains that you set this through Settings, Account, Handle and the option for your own domain, by adding a record to your domain's settings. That record is what links the handle to your account.

So if your handle was a custom domain, check it after a hack. Confirm the handle on your profile still shows your domain, and log in to your domain provider to make sure the record still points to your account and nobody else has changed it. If your domain provider account was also accessed, secure that first, since the handle relies on it.

#Watch for the Bluesky Verification DM Scam

Hacked accounts and scam messages go together. In the same @safety.bsky.app post, Bluesky gave a clear verification scam warning: "We will NEVER DM you about account verification. Messages from 'Bluesky staff' or services offering to get your account verified through DMs are scams. Report and block immediately."

The post also said that DMs about moderation are scams, that Bluesky would never ask for your password, payment or card details about moderation decisions, and that official Bluesky accounts carry blue checkmarks. A message asking you to log in through a link, share a code or pay to keep or verify your account fits this pattern.

Real verification is set by Bluesky and trusted verifiers, as its post on a new form of verification explains, and it does not arrive as a DM offer. If you clicked a link from one of these messages and entered your details, reset your password straight away and follow the steps above.

#Warn Your Followers and Clean Up

If the attacker posted or sent messages from your account, people may have trusted them because they came from you. Post from your account once you have it back, saying it was accessed and that you did not send those messages. Ask people not to click any links or send money or codes. Our guide on a hacked account messaging friends covers what to tell contacts.

For the wider first steps after any account is taken, our guide to the first 24 hours after a hack sets out the order for email, phone and other accounts.

#What Bluesky Support Can and Cannot Do

Bluesky controls account access and decides what it can restore. Its help pages set out the password reset and the support email, but they do not promise a result or a timeline. No outside service can reset your account or override Bluesky's checks.

Be careful with anyone who offers to recover your Bluesky account for you in replies or DMs, especially if they want your password, codes or money. Our guide on spotting fake recovery services explains how these offers work.

#When a Case Review Makes Sense

If the email on your account was changed and support has not replied, or your custom domain and email were both affected, a review can help you put the evidence in order and decide what to fix first. SocialSafe by AwareXone is a Malaysia-based service, independent of Bluesky, that helps you use official recovery routes. We never ask for your password or login codes and we cannot change Bluesky's decisions. See our social media problem solutions and how we work on our trust page.

#Frequently Asked Questions