In crypto a crisis moves faster than in any other industry, because the audience is awake in every timezone, the evidence is public on chain, and the people affected can lose money while you are deciding what to say. The first hours of a crypto PR crisis response determine most of the outcome.
This is a working crypto PR crisis response sequence for the first forty eight hours, whether the event is an exploit, a depeg, an accusation, a departure or a leak.
1. Establish the facts before saying anything substantive
Get one person to hold the confirmed facts: what happened, when, what is affected, what is not, and what is still unknown. Nothing goes out that is not on that list.
The most damaging statements in crypto incidents are early reassurances that turn out to be wrong. “Funds are safe” said before it is known is the sentence that converts an incident into a credibility failure.
2. Acknowledge within the hour
A short first message: we are aware, we are investigating, here is what to do right now, next update at a stated time. Two sentences and a time commitment.
Silence is read as either absence or concealment, and it hands the narrative to whoever is talking. The acknowledgement does not require answers, only presence.
3. Tell people what to do
If users should revoke approvals, stop depositing, avoid a contract or move funds, that instruction belongs in the first message, above any explanation. Protecting people is more urgent than describing what happened.
Include the exact address or interface concerned. During an incident, scam accounts publish fake recovery instructions within minutes, and a clear official instruction is what people compare them against.
4. Lock down the channels
Restrict posting in community channels, pin the official statement, and have moderators removing impersonation accounts. An incident is the peak moment for wallet-drainer links because attention is high and judgement is low.
Repeat that the team never sends the first direct message. This is where that rule earns its place, and the moderation setup for it is in how to moderate a crypto Discord.
5. Speak with one voice on a schedule
One named person communicates. Everyone else, including engineers replying helpfully in a side channel, stops. Contradictory messages from a team under pressure do more damage than the pause would have.
Then hold to the update schedule you announced, even when the update is that there is nothing new. Missing a stated update time is read as the situation being worse than described.
6. Handle media directly rather than avoiding them
Reporters will write the story with or without you. Give a factual statement quickly, offer someone who will answer questions, and correct inaccuracies in the first coverage before it is repeated by everyone else.
Declining to comment during a crypto incident is generally read as confirmation. A short accurate statement is almost always better than none, and the pitching mechanics are in how to pitch a crypto journalist.
7. Publish the full account within forty eight hours
A written post covering the timeline, the technical cause, the exact scope, what has been done, what happens to affected users, and what changes to prevent a recurrence.
This document becomes the reference every later article and every assistant summarising the event will draw from. Publishing it late means the permanent record is written by other people from incomplete information.
8. Follow through in public
Whatever was promised, report on it: the audit commissioned, the compensation paid, the process changed. A follow-up two weeks later saying what was actually done is the part that repairs standing, and it is the part most teams skip once attention has moved on.
Projects recover from incidents routinely. What they do not recover from is a promise made during one and quietly abandoned afterwards.
Who does what in the first hour
Four roles cover most incidents: someone who owns the decision, someone who holds the facts, someone who writes and posts, and someone who runs the community channels. One person can hold two of them in a small team, but nobody should hold all four, because the person deciding whether to pause a contract cannot also be answering a hundred messages. Write the names down now and keep a deputy for each.
The decision owner needs stated authority to publish without waiting for a founder who is asleep in another timezone. That authority is the single most useful thing the plan contains, and the only time it can be granted is in advance. Without it the first hour is spent assembling the people who are allowed to approve a sentence, while the story is already being written elsewhere.
Holding statements you can adapt
Keep short drafts for the events that are actually likely: a contract exploit, a depeg, a partner failure, an accusation against the team, a data leak, a key compromise, an outage. Each draft says what is known, what is being done, what the reader should do now, and when the next update comes. Leave the specifics blank and fill them in at the time.
Draft them when nothing is happening and have legal read them then rather than during the event. A statement reviewed in advance can be edited and published in twenty minutes; the same statement written from scratch under pressure takes hours and arrives after the community has settled on its own explanation of events.
A crypto PR crisis response channel order
Decide the publication order in advance and keep it fixed: the channel your users treat as authoritative goes first, the rest follow within minutes, and every one of them points back to a single canonical post. Splitting the announcement across channels with slightly different wording produces three versions to compare and someone will read the differences as an attempt to say different things to different audiences.
One page on your own domain should carry the running account, updated in place with timestamps rather than replaced. Social posts scroll away and chat messages get buried, but a linkable page is what journalists cite, what partners forward internally, and what any later summary of the event draws from. Post the link everywhere and repeat it in every update.
Telling partners before they read it
Exchanges, custodians, market makers, auditors, integrators and large holders should hear from you before they see the public post, even if the notice is one line. A partner who learns of your incident from a third party has to assume they are not in your loop, and the first thing they do about it is protective: halting deposits, pulling an integration, or freezing a relationship you will want back.
Keep that contact list current with names, direct channels and out-of-hours routes, and test it once a year by actually sending something. Contact lists rot faster than anyone expects, and finding out during an incident that the exchange contact left the company six months ago costs the hours when the message mattered most.
Tell your own team at the same time, in one message, with the line on what they may and may not say. Staff answering questions from friends, investors and former colleagues are a communication channel whether you treat them as one or not, and a team that learns the scope of an incident from a public post assumes it was not trusted with it.
Legal review without going silent
Counsel will push towards saying less, which is correct about admissions of liability and wrong about the timeline and the protective instruction. Agree the division in advance: facts, scope, timing and what users should do are communications decisions; characterisations of fault, compensation commitments and anything touching regulators go through legal. That agreement is what keeps review from turning into an hour of silence per sentence.
Give legal a target turnaround rather than an open queue, and put one lawyer on the incident rather than a firm. Where a review genuinely cannot be completed in time, publish the part that is already cleared and say the rest is coming. Partial and prompt beats complete and late in every incident anyone remembers.
Moderating the community under load
Brief the moderators as a group before they start, not individually as questions arrive. They need the confirmed facts, the lines they must not go beyond, the canonical link, and a private channel to escalate anything unusual. Moderators improvising answers during an incident is how a team ends up publicly contradicting itself without a single official statement being wrong.
Expect volume that the normal rota cannot absorb and plan the extra cover in advance. Slow mode, temporary restrictions on links and images, and a pinned instruction repeated every hour do more than any amount of individual replies. The one message that has to keep repeating is that nobody from the team will ever write first, because that is the sentence standing between your users and the drainers who arrive with them.
Users who lost money
Open a dedicated route for affected users on the first day and say what it is for, what information you need from them, and how long a reply will take. People who have lost funds will otherwise fill every public channel, which is understandable and also makes the channels unusable for the safety instructions everyone else needs to see.
Answer each of them individually even before you know what can be done, because silence towards someone who has lost money is the detail they will repeat for years. Keep a record of every case with the amount claimed and the evidence supplied, since that file becomes the basis of any later compensation process and reconstructing it from chat history is close to impossible.
Tracking what is being said
Assign someone to watch the channels where the narrative forms rather than trying to read everything. What matters is a short list of recurring claims, updated every few hours, with a note on which are accurate, which are wrong, and which you simply cannot answer yet. That list drives the next update far better than sentiment impressions do.
Correct factual errors in the places they appear while they are still small, and ignore opinion however unpleasant. Arguing with commentary during an incident produces a second story about the argument, and it consumes the attention of the people who should be fixing the first one.
Keep one internal log of every claim, question and correction with the time it appeared, maintained by the same person. It costs little during the event and it is what the incident report, the media follow-ups and the internal review are all built from afterwards. Reconstructing the sequence a week later out of four chat applications is the task nobody volunteers for and everybody ends up doing.
When the facts change midway
The scope of an incident usually moves, and it moves in the wrong direction more often than not. Say so directly in the next scheduled update, state what changed and why the earlier figure was wrong, and do not let a revised number appear quietly in a later post as though it had always been there. Readers forgive a correction and do not forgive noticing one you tried to slip past them.
This is why early statements should describe what is confirmed rather than what is expected. Phrasing such as the investigation continuing and the figure being provisional is not evasive when it is true, and it leaves room for the number to move without every previous statement becoming a broken promise.
Promises that bind you later
Compensation language written under pressure becomes an obligation people hold you to for years. Before committing to make anyone whole, establish the total exposure, the funds available, the treatment of users who traded through the event, and who is excluded and why. If those answers do not yet exist, commit to a date for the compensation plan instead of to the plan itself.
Write the eventual policy as a published document with the criteria, the evidence required, the deadline for claims and the payment method. Claims handled case by case in private messages create inconsistency that surfaces later, when two users compare what they were offered and one of them posts the comparison.
Be careful with the word temporary. A pause described as brief that lasts a week, or withdrawals described as resuming shortly that do not, costs more credibility than the original event. Where the timing is genuinely unknown, say that it is unknown and give the time of the next update instead, which is a commitment you can actually keep.
The review after it ends
Within a fortnight, sit down with everyone involved and go through the timeline against the plan: what was noticed and when, where the delays were, which channel worked, what the moderators were asked most, and which prepared drafts turned out to be useless. Record the answers while people still remember the order in which things happened.
Then change the plan. Almost every incident review produces the same short list of fixes: a contact nobody could reach, an approval that took too long, a channel with no owner, and a statement template that did not fit the event. Those repairs take an afternoon in calm conditions and are worth more than any amount of rehearsal of the parts that already worked.
Preparing your crypto PR crisis response before it happens
Decide now who speaks, who can publish without approval, which channel is authoritative and how the team reaches each other outside normal hours. Write it on one page. The decisions are simple in advance and impossible at three in the morning.
Also decide what would trigger the plan. Teams routinely lose the first six hours arguing about whether the situation qualifies, which is time spent while the story is being written elsewhere.
Statement drafting, media handling and community coordination during an incident are covered on our crypto PR page.