# Bluesky Account Hacked: How to Recover It > Bluesky account hacked? Reset your password by email, report it to support@bsky.app, remove unknown app passwords and turn on two-factor sign-in. - URL: https://www.awarexone.com/research/bluesky-account-hacked-recovery - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-23 - Topics: Bluesky, Hacked account, Account security - Related service: Social media problem solutions: https://www.awarexone.com/all-types-of-social-media-problem-solutions ## Short answer Start with Bluesky's password reset: tap Forgot on the sign-in screen and use the code sent to your account email. If the email never arrives or was changed, report the compromise to support@bsky.app. Once you are back in, delete app passwords you do not recognise, turn on two-factor sign-in and warn your followers about any posts you did not make. ## Summary - Bluesky's Terms of Service say that if you believe your account has been compromised, you should report it to support@bsky.app. - Bluesky's password reset sends a reset code to your account email, so access to that inbox is the key to getting back in. - Once you are back in, delete app passwords you do not recognise and turn on two-factor sign-in under Privacy and Security. - Bluesky's safety team says it will never DM you about verification and would never ask for your password about moderation, so treat those messages as scams. - If you use your own domain as your handle, check its settings too, because the handle depends on a record held by your domain. You open Bluesky and your password no longer works. Or you are still logged in, but there are posts on your profile you never wrote, replies sent to strangers, or a message in your DMs from "Bluesky staff" asking you to verify your account. Something is wrong, and you want to know what to do first. The short answer: try Bluesky's password reset first, because it sends a code to the email on your account. If that email is no longer yours or nothing arrives, report the compromise to Bluesky support by email. Once you are back in, clean up app passwords, turn on two-factor sign-in and check your handle. This guide covers the recovery order, what to do if you cannot get the reset email, how to lock the account down, how custom domain handles fit in, the verification DM scam that Bluesky has warned about, and the limits of what support can do. Last checked: 23 October 2026. ## What Should I Do First When My Bluesky Account Is Hacked? Work through these steps in this order. Each one builds on the one before, and the early steps cut off the person who got in. 1. Try the password reset from the sign-in screen and set a new, unique password. 2. If the reset email does not arrive, or the email on the account has been changed, email support@bsky.app and include the email address you signed up with. 3. Once you are in, open Settings, then Privacy and Security, and delete any app passwords you do not recognise. 4. Turn on two-factor sign-in in the same Privacy and Security area. 5. Check the email address on the account and your handle are still yours. 6. Delete posts you did not make and warn your followers from your own account. 7. Change the password on your email account too, if you think it was also exposed. ## How Do I Reset My Bluesky Password? Bluesky's [password reset help page](https://blueskyweb.zendesk.com/hc/en-us/articles/15835263959565-Password-Reset) says: "Click 'Forgot' on the sign-in screen. You will receive an email with a reset code." You then enter that code and choose a new password. Pick one you have not used anywhere else, so a leak from another site cannot be reused against you. Because the code goes to your account email, the reset depends on you still being able to open that inbox. Check your spam or junk folder before deciding it has not arrived. The same help page says that if you do not receive the email, you can contact support@bsky.app. Bluesky's [Terms of Service](https://bsky.social/about/support/tos) also say: "If you believe your Bluesky Account has been compromised, report it to us at support@bsky.app." Bluesky's [support page](https://bsky.social/about/support) gives the same address for help. ## What If I Cannot Access the Email on My Account? This is the hardest situation. If someone changed the email on your Bluesky account, or you lost access to the inbox you signed up with, the reset code will not reach you. Bluesky's help pages do not set out a separate recovery form for this case, so your route is the support email. When you write to support@bsky.app, include the details that help show the account is yours. Keep it short and factual. - Your Bluesky handle and the link to your profile. - The email address you originally signed up with. - Roughly when you noticed the problem and what changed, such as the email, password or handle. - Screenshots of posts or messages you did not make. - Whether you use your own domain as your handle. Never put your password or any login code in the email. Bluesky support does not need them, and its safety team has said Bluesky would never ask for your password about moderation decisions. Bluesky does not publish a reply time, so keep your evidence together while you wait. ## How Do I Lock My Bluesky Account Down Once I Am Back In? Bluesky's safety team set out the key checks in a [post from @safety.bsky.app](https://bsky.app/profile/safety.bsky.app/post/3m5mhtiz33c2b) in November 2025, written after it saw an increase in phishing and social engineering attempts. It pointed people to two settings. | Setting | Where to find it | What to do | | --- | --- | --- | | Two-factor sign-in | Settings, then Privacy and Security | Turn it on so a password alone cannot open your account | | App passwords | Settings, then Privacy and Security, then App Passwords | Delete any you do not recognise or no longer use | | Account email | Your account settings | Confirm the address is yours and you can open it | | Handle | Settings, then Account, then Handle | Check it is the handle you chose | App passwords let other apps and services sign in to your account. If an attacker created one, it could give them a separate way in, which is why Bluesky's safety team advises deleting ones you do not recognise. Only create new app passwords for tools you trust, and remove them when you stop using the tool. ## What If I Use My Own Domain as My Handle? Bluesky lets you use a domain you own as your handle. Its [guide to verifying your account](https://bsky.social/about/blog/4-28-2023-domain-handle-tutorial) explains that you set this through Settings, Account, Handle and the option for your own domain, by adding a record to your domain's settings. That record is what links the handle to your account. So if your handle was a custom domain, check it after a hack. Confirm the handle on your profile still shows your domain, and log in to your domain provider to make sure the record still points to your account and nobody else has changed it. If your domain provider account was also accessed, secure that first, since the handle relies on it. ## Watch for the Bluesky Verification DM Scam Hacked accounts and scam messages go together. In the same [@safety.bsky.app post](https://bsky.app/profile/safety.bsky.app/post/3m5mhtiz33c2b), Bluesky gave a clear verification scam warning: "We will NEVER DM you about account verification. Messages from 'Bluesky staff' or services offering to get your account verified through DMs are scams. Report and block immediately." The post also said that DMs about moderation are scams, that Bluesky would never ask for your password, payment or card details about moderation decisions, and that official Bluesky accounts carry blue checkmarks. A message asking you to log in through a link, share a code or pay to keep or verify your account fits this pattern. > Warning: **Signs of a verification DM scam.** The sender says they are Bluesky staff or moderation, offers to verify your account, warns your account will be removed, asks for your password, a code or payment, or sends a login link. Bluesky says it does not DM you about verification. Report and block the sender. Real verification is set by Bluesky and trusted verifiers, as its post on [a new form of verification](https://bsky.social/about/blog/04-21-2025-verification) explains, and it does not arrive as a DM offer. If you clicked a link from one of these messages and entered your details, reset your password straight away and follow the steps above. ## Warn Your Followers and Clean Up If the attacker posted or sent messages from your account, people may have trusted them because they came from you. Post from your account once you have it back, saying it was accessed and that you did not send those messages. Ask people not to click any links or send money or codes. Our guide on [a hacked account messaging friends](https://www.awarexone.com/research/hacked-account-messaging-friends) covers what to tell contacts. For the wider first steps after any account is taken, our guide to [the first 24 hours after a hack](https://www.awarexone.com/research/hacked-account-what-to-do-first-24-hours) sets out the order for email, phone and other accounts. ## What Bluesky Support Can and Cannot Do Bluesky controls account access and decides what it can restore. Its help pages set out the password reset and the support email, but they do not promise a result or a timeline. No outside service can reset your account or override Bluesky's checks. Be careful with anyone who offers to recover your Bluesky account for you in replies or DMs, especially if they want your password, codes or money. Our guide on [spotting fake recovery services](https://www.awarexone.com/research/account-recovery-scams-how-to-spot-fake-recovery-services) explains how these offers work. ## When a Case Review Makes Sense If the email on your account was changed and support has not replied, or your custom domain and email were both affected, a review can help you put the evidence in order and decide what to fix first. SocialSafe by AwareXone is a Malaysia-based service, independent of Bluesky, that helps you use official recovery routes. We never ask for your password or login codes and we cannot change Bluesky's decisions. See our [social media problem solutions](https://www.awarexone.com/all-types-of-social-media-problem-solutions) and how we work on our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### How do I reset my Bluesky password? Tap Forgot on the sign-in screen. Bluesky sends a reset code to your account email, which you enter before choosing a new password. ### Who do I contact if my Bluesky account was hacked? Bluesky's Terms of Service say to report a compromised account to support@bsky.app. ### What if the reset email never arrives? Check spam first. Bluesky's help page says to contact support@bsky.app if you do not receive the email. ### Should I delete my app passwords? Bluesky's safety team advises deleting app passwords you do not recognise, under Settings, Privacy and Security, App Passwords. ### Does Bluesky DM people about verification? No. Bluesky's safety team says it will never DM you about verification and that such messages are scams. ### Can AwareXone get my Bluesky account back for me? No outside service can recover it directly. AwareXone can help you use Bluesky's official reset and support routes without asking for your password. ## Official sources - [Official: Password Reset - Bluesky (read 23 October 2026)](https://blueskyweb.zendesk.com/hc/en-us/articles/15835263959565-Password-Reset) - [Official: Terms of Service - Bluesky (read 23 October 2026)](https://bsky.social/about/support/tos) - [Official: Support - Bluesky (read 23 October 2026)](https://bsky.social/about/support) - [Official: Post by @safety.bsky.app on Bluesky (read 23 October 2026)](https://bsky.app/profile/safety.bsky.app/post/3m5mhtiz33c2b) - [Official: How to verify your Bluesky account - Bluesky (read 23 October 2026)](https://bsky.social/about/blog/4-28-2023-domain-handle-tutorial) - [Official: A New Form of Verification on Bluesky - Bluesky (read 23 October 2026)](https://bsky.social/about/blog/04-21-2025-verification) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.