In crypto a crisis moves faster than in any other industry, because the audience is awake in every timezone, the evidence is public on chain, and the people affected can lose money while you are deciding what to say. The first hours determine most of the outcome.
This is a working sequence for the first forty eight hours, whether the event is an exploit, a depeg, an accusation, a departure or a leak.
1. Establish the facts before saying anything substantive
Get one person to hold the confirmed facts: what happened, when, what is affected, what is not, and what is still unknown. Nothing goes out that is not on that list.
The most damaging statements in crypto incidents are early reassurances that turn out to be wrong. “Funds are safe” said before it is known is the sentence that converts an incident into a credibility failure.
2. Acknowledge within the hour
A short first message: we are aware, we are investigating, here is what to do right now, next update at a stated time. Two sentences and a time commitment.
Silence is read as either absence or concealment, and it hands the narrative to whoever is talking. The acknowledgement does not require answers, only presence.
3. Tell people what to do
If users should revoke approvals, stop depositing, avoid a contract or move funds, that instruction belongs in the first message, above any explanation. Protecting people is more urgent than describing what happened.
Include the exact address or interface concerned. During an incident, scam accounts publish fake recovery instructions within minutes, and a clear official instruction is what people compare them against.
4. Lock down the channels
Restrict posting in community channels, pin the official statement, and have moderators removing impersonation accounts. An incident is the peak moment for wallet-drainer links because attention is high and judgement is low.
Repeat that the team never sends the first direct message. This is where that rule earns its place, and the moderation setup for it is in how to moderate a crypto Discord.
5. Speak with one voice on a schedule
One named person communicates. Everyone else, including engineers replying helpfully in a side channel, stops. Contradictory messages from a team under pressure do more damage than the pause would have.
Then hold to the update schedule you announced, even when the update is that there is nothing new. Missing a stated update time is read as the situation being worse than described.
6. Handle media directly rather than avoiding them
Reporters will write the story with or without you. Give a factual statement quickly, offer someone who will answer questions, and correct inaccuracies in the first coverage before it is repeated by everyone else.
Declining to comment during a crypto incident is generally read as confirmation. A short accurate statement is almost always better than none, and the pitching mechanics are in how to pitch a crypto journalist.
7. Publish the full account within forty eight hours
A written post covering the timeline, the technical cause, the exact scope, what has been done, what happens to affected users, and what changes to prevent a recurrence.
This document becomes the reference every later article and every assistant summarising the event will draw from. Publishing it late means the permanent record is written by other people from incomplete information.
8. Follow through in public
Whatever was promised, report on it: the audit commissioned, the compensation paid, the process changed. A follow-up two weeks later saying what was actually done is the part that repairs standing, and it is the part most teams skip once attention has moved on.
Projects recover from incidents routinely. What they do not recover from is a promise made during one and quietly abandoned afterwards.
Preparing before it happens
Decide now who speaks, who can publish without approval, which channel is authoritative and how the team reaches each other outside normal hours. Write it on one page. The decisions are simple in advance and impossible at three in the morning.
Also decide what would trigger the plan. Teams routinely lose the first six hours arguing about whether the situation qualifies, which is time spent while the story is being written elsewhere.
Statement drafting, media handling and community coordination during an incident are covered on our crypto PR page.