Anti-nuke watches the audit log for destructive administrator actions — deleted channels, deleted roles, mass bans, new webhooks, added bots. When one account does too many of them too quickly, Defendr removes that account's dangerous roles, times it out and posts a card with the whole story. The server owner is never stopped; other bots are, because a compromised bot is the usual way a server is destroyed. Defendr's own role has to sit above the administrator roles, otherwise Discord refuses to remove them.
Example
A moderator account deletes four channels in a minute and loses its Administrator role before it reaches the fifth.