How to Recover a Hacked YouTube Account

September 4, 2026 · 6 min read · by Jan Oršula

Recovering a hacked YouTube channel starts in a place most people don't expect: your Google account, not YouTube. A channel doesn't have its own login. It sits on top of the Google account that created it. So whoever controls the Google account controls the channel. That single fact sets the order of every step below: get the Google account back first, then evict the attacker, then repair the channel. Rush straight to YouTube and you'll spin in circles while the intruder still holds the keys.

The angle here is sequence. Hacked-channel panic makes people try everything at once. Do these in order and each step makes the next one possible.

Step 1: Recover the Google account first

Go to accounts.google.com and try to sign in. Two things can be true:

1. You can still log in. The attacker got in but hasn't changed your password yet. Move fast: change the password right now, and skip to Step 2.
2. You're locked out. Use the "Forgot password?" link and work through Google's account recovery flow. It asks for old passwords, a recovery email or phone, and the rough date you last got in. Answer from a device and location you've used before if you can. A familiar signal makes recovery far more likely to succeed.

If the attacker already swapped your recovery email and phone, keep going through the recovery form anyway. Google can still verify you on other signals. YouTube also runs a dedicated "hacked channel assistant" chat in the Help Center for channels that were taken over. Use it if the standard flow stalls, and note that recovery help is limited to incidents within roughly the last nine months, so don't sit on it.

One warning that saves people from a second robbery: Google does not offer phone or live-chat "account recovery agents." Anyone in your comments or DMs offering to restore your channel for a fee, or asking for your password, is running the follow-up scam. Recovery only happens through the official flow.

Step 2: Revoke the attacker's access

Getting back in isn't the same as being alone in your account. A competent attacker leaves a way back: a live session, a linked app, or a second manager on the channel. Close all three.

• Sessions and devices. In your Google account, open Security and review where you're signed in. Sign out every device and browser you don't recognize.
• Third-party app access. Look at "Your connections to third-party apps and services." Revoke anything you didn't authorize. This is the quiet backdoor most people miss. A malicious app with account access can undo your recovery minutes later.
• Channel managers and owners. In YouTube Studio under Settings, open Permissions (for a Brand Account channel) and remove any manager or owner that isn't you. Attackers often add themselves here so that even a password reset doesn't lock them out.

Only once every stray session, app, and manager is gone should you consider the account yours again.

Step 3: Reset the password and turn on 2-Step Verification

Set a new, unique password you've never used elsewhere, then turn on 2-Step Verification in your Google security settings. Use an authenticator app or a passkey rather than SMS where you can, since SIM-swap attacks make text codes the weakest of the strong options. This is the step that actually keeps the account. A password alone can be phished again next week; a second factor means a stolen password isn't enough.

Step 4: If the channel was changed, deleted, or you still can't get in

Sometimes you recover the Google account and find the channel renamed, its videos hidden, or the whole thing gone. Report it through YouTube's hacked-channel path rather than starting a fresh channel. If it was deleted, recovery is time-sensitive and tied to that same nine-month window. For a channel that lived on a Brand Account, the recovery path runs through the Brand Account's owners and managers, which is another reason Step 2's permissions cleanup matters: the person who "owns" the Brand Account is who YouTube will restore it to.

While you wait, screenshot everything: the changed channel name, any videos the attacker posted (fake crypto livestreams are the usual payload), and the dates. That record speeds up support and helps if the attacker used your channel to scam your audience.

Step 5: Restore your branding and tell your audience

Once you're back in, put the channel name, handle, profile picture, banner, and links back. Delete anything the attacker uploaded or livestreamed. Then post a short community update (a pinned comment or a Community tab note) telling followers you were compromised and that any "giveaway" or crypto stream from your channel was not you. Your audience trusts your channel; close the loop before someone falls for the residue.

How creators get hacked in the first place

Most channel takeovers don't start with a password breach. They start with a fake brand deal. The creator gets a polished email offering a sponsorship, a rate that's a little too good, and an attached "brief," "contract," or "product demo" to download. The file is malware, usually an info-stealer that grabs the session cookies your browser uses to stay logged in. With those cookies, the attacker skips your password and your 2FA entirely, because they're impersonating a session you already authorized.

That's why 2FA alone isn't a complete defense, and why the reflex matters more than any setting:

• Treat unsolicited sponsorship emails as suspicious by default. Real brands rarely need you to download and open an executable, a password-protected archive, or a "special viewer" to read a brief.
• Never open a "contract" or "asset" from a link or attachment on the machine you're logged into YouTube on. Scan it, or open it somewhere isolated.
• Keep your recovery email and phone current, so the official flow actually reaches you.
• Be deliberate about what you automate and connect. Fewer third-party tools with account access means fewer backdoors. Our note on what not to automate in social media covers where connecting an app buys you convenience at the cost of a new attack surface.

A takeover is also a live example of why a written social media crisis plan earns its place: knowing in advance who posts the "this wasn't us" message turns a scramble into a checklist. And once you're back, the ordinary work resumes: the channel still lives or dies on whether people click, which is its own craft in YouTube titles and thumbnails. Recovery gets you the keys back; the fundamentals still decide what happens next.

Frequently asked questions