cluster b crypto crisis case study about the ftx collapse explained
A crypto crisis response works when detection is fast, user funds are guaranteed, and the CEO speaks publicly within hours. This page gives a crisis communications plan template for exchanges and protocols, built from the Ronin, Wormhole and Bybit hacks, with the first-45-minutes checklist, spokesperson roles and case studies.
What Do the Ronin, Wormhole and Bybit Hacks Teach?
The three incidents teach three separate lessons: detection speed, a credible guarantee on user funds, and visible senior leadership.
Incident
Date
Loss
Communications lesson
Ronin bridge (Axie Infinity)
March 2022
About $600 million
Detection delay of roughly six days set the ceiling on response speed
Wormhole bridge
February 2022
About $320 million
Jump Crypto replenished the funds within days, and a credible backstop was the message
Bybit
February 2025
About $1.5 billion
A fast, senior, continuous response kept the brand alive
Ronin (March 2022): what does slow detection cost?
Slow detection costs the company its ability to communicate at all. The Ronin bridge supporting Axie Infinity lost roughly $600 million in an exploit the FBI later attributed to North Korea's Lazarus Group. The defining communications problem was the timeline, because the breach went undetected for roughly six days. A company cannot communicate a crisis it has not detected, so detection speed sets the ceiling on response speed. Six days of silence, even unintentional silence, reads to the market as concealment.
Wormhole (February 2022): what does a strong backstop look like?
A strong backstop is a credible, specific and immediate guarantee that user funds are whole. The Wormhole bridge lost roughly $320 million, and Jump Crypto, the firm behind the project, replenished the stolen funds within days. That commitment was communicated clearly and early. In a hack, the single most powerful message is that guarantee, and everything else is secondary.
Bybit (February 2025): what is the modern standard?
The modern standard is a fast, senior, specific and continuous response. Bybit lost roughly $1.5 billion in the largest crypto theft on record, which the FBI attributed to Lazarus Group. The chief executive addressed the public directly and quickly, including a live-streamed session. The exchange confirmed it would honor all withdrawals, secured bridge financing to cover the gap, and restored reserves within days. The hack was historic, and the brand survived it.
What Is the Crypto Hack Crisis Playbook?
The crypto hack crisis playbook has five steps, in this order.
Hour one: confirm before you speak, but speak fast. Acknowledge that an incident is under investigation before you have all facts, because silence is read as concealment. Never speculate on attribution, amount or method before they are confirmed. The first statement says that the company is aware, is investigating, treats customer funds as the priority, and will follow up on a stated timeline.
Lead with the funds question. Users have exactly one question: is my money safe. Answer it first and specifically. "Funds are SAFU" worked for Binance because a real insurance fund backed it, and a guarantee is only worth communicating if it is real.
Put the senior executive forward, visibly. The chief executive should communicate a crisis of this magnitude on camera, repeatedly. Delegating it to a press statement signals that the company does not grasp the severity. Bybit's live-stream was the message, not theater.
Coordinate the four-way table. Hack communications must move in lockstep with security, legal, exchange and listing partners, and, where stolen funds touch sanctioned actors, policy and law enforcement. A statement that contradicts the security team's findings or the legal team's exposure assessment does more damage than silence.
Build the infrastructure before the crisis. Prepare a dark site, a statement library, a pre-cleared executive spokesperson, a decision tree for detection-to-disclosure timing, and a tested coordination protocol. The exchanges that survive hacks wrote the playbook on a calm day.
What does a crypto crisis communications plan template look like?
A crypto crisis communications plan template covers four phases, a first-45-minutes checklist, seven response layers and named spokesperson roles. Crypto is a high-velocity crisis category: token price and customer withdrawals respond to communications in seconds, the community on X, Reddit, Telegram and Discord acts as a permanent adversarial press, several regulators claim jurisdiction, and the founder is often the brand.
What are the four phases of a crypto crisis?
Phase
What it looks like
Typical length
Latent
A balance sheet hole, an unexploited vulnerability or a sealed subpoena exists but is undisclosed
Sometimes hours
Acute
A withdrawal pause, exploit notice, SEC complaint or founder post, with token price and withdrawals reacting in real time
First 4 to 72 hours
Managed
Statements are out, regulators are engaged and the technical or financial response is structured
Two to twelve weeks
Residual
Bankruptcy proceedings, enforcement actions, customer claims and litigation
Often two to four years for the major 2022 and 2023 collapses
What should a crypto company do in the first 45 minutes?
Activate the crisis team: CEO, general counsel, chief compliance officer, chief information security officer for exploits, head of communications, and a treasury lead for balance sheet questions.
Engage outside securities, criminal defense and, if collapse is plausible, bankruptcy counsel, so privilege is set up in the first hour.
Establish the technical and financial facts the company can independently verify before communications moves ahead of them.
List the audiences: customers, tokenholders, employees, regulators, the X, Reddit, Telegram and Discord community, trade press, mainstream financial press and counterparties.
Draft a conservative holding statement. Hedging that reads as evasion is damaging with the crypto community.
Brief customer support and business development, because the frontline fields questions within minutes.
Monitor the community and on-chain analysts such as Arkham, Nansen and Lookonchain, who often hold parallel evidence.
What are the seven response layers?
Layer
Channel and purpose
Official statement
Brand site and X account together, with X as the primary channel in the acute phase
Customers and tokenholders
Email, in-product notices and a status page covering withdrawal status, fund safety and timeline
Regulators
SEC, CFTC, OFAC, FinCEN, state and international authorities, with disclosure duties that differ by jurisdiction
Community
X Spaces, Reddit AMAs and Discord, since founder absence is read as bad faith
Press
Trade press first, then mainstream financial press
Counterparties
Exchanges, custodians, banking partners and market makers, because pull-back can hurt more than customer outflow
AI engines
The crisis narrative becomes the answer in ChatGPT, Claude, Perplexity, Gemini and Google AI Overviews for later queries about the platform
Who should speak for a crypto company in a crisis?
Issue
Lead spokesperson
Existential threat to the company
Founder or CEO
Regulatory and litigation matters
General counsel
Technical exploits
Chief information security officer
Solvency and reserves
CFO or treasury lead
Spokespeople also need native fluency on X, Discord and Telegram. Traditional media training is necessary but not enough.
Recovery in crypto is rare, and most major collapses do not recover under the original brand. Companies that survive tend to follow three practices: verifiable on-chain transparency such as proof of reserves and third-party attestations, sustained regulatory engagement with proactive licensing, and a direct rebuild of the community through founder presence and product transparency.
What Do the Ronin, Wormhole and Bybit Hacks Teach?
The three incidents teach three separate lessons: detection speed, a credible guarantee on user funds, and visible senior leadership. IncidentDateLossCommunications lesson Ronin bridge (Axie Infinity)March 2022About $600 millionDetection delay of roughly six days set the ceiling on response speed Wormhole bridgeFebruary 2022About $320 millionJump Crypto replenished the funds within days, and a credible backstop was the message BybitFebruary 2025About $1.5 billionA fast, senior, continuous response kept the brand alive
Ronin (March 2022): what does slow detection cost?
Slow detection costs the company its ability to communicate at all. The Ronin bridge supporting Axie Infinity lost roughly $600 million in an exploit the FBI later attributed to North Korea's Lazarus Group. The defining communications problem was the timeline, because the breach went undetected for roughly six days. A company cannot communicate a crisis it has not detected, so detection speed sets the ceiling on response speed. Six days of silence, even unintentional silence, reads to the market as concealment.
Wormhole (February 2022): what does a strong backstop look like?
A strong backstop is a credible, specific and immediate guarantee that user funds are whole. The Wormhole bridge lost roughly $320 million, and Jump Crypto, the firm behind the project, replenished the stolen funds within days. That commitment was communicated clearly and early. In a hack, the single most powerful message is that guarantee, and everything else is secondary.
Bybit (February 2025): what is the modern standard?
The modern standard is a fast, senior, specific and continuous response. Bybit lost roughly $1.5 billion in the largest crypto theft on record, which the FBI attributed to Lazarus Group. The chief executive addressed the public directly and quickly, including a live-streamed session. The exchange confirmed it would honor all withdrawals, secured bridge financing to cover the gap, and restored reserves within days. The hack was historic, and the brand survived it.
What Is the Crypto Hack Crisis Playbook?
The crypto hack crisis playbook has five steps, in this order. Hour one: confirm before you speak, but speak fast. Acknowledge that an incident is under investigation before you have all facts, because silence is read as concealment. Never speculate on attribution, amount or method before they are confirmed. The first statement says that the company is aware, is investigating, treats customer funds as the priority, and will follow up on a stated timeline. Lead with the funds question. Users have exactly one question: is my money safe. Answer it first and specifically. "Funds are SAFU" worked for Binance because a real insurance fund backed it, and a guarantee is only worth communicating if it is real. Put the senior executive forward, visibly. The chief executive should communicate a crisis of this magnitude on camera, repeatedly. Delegating it to a press statement signals that the company does not grasp the severity. Bybit's live-stream was the message, not theater. Coordinate the fou
What does a crypto crisis communications plan template look like?
A crypto crisis communications plan template covers four phases, a first-45-minutes checklist, seven response layers and named spokesperson roles. Crypto is a high-velocity crisis category: token price and customer withdrawals respond to communications in seconds, the community on X, Reddit, Telegram and Discord acts as a permanent adversarial press, several regulators claim jurisdiction, and the founder is often the brand.
What are the four phases of a crypto crisis?
PhaseWhat it looks likeTypical length LatentA balance sheet hole, an unexploited vulnerability or a sealed subpoena exists but is undisclosedSometimes hours AcuteA withdrawal pause, exploit notice, SEC complaint or founder post, with token price and withdrawals reacting in real timeFirst 4 to 72 hours ManagedStatements are out, regulators are engaged and the technical or financial response is structuredTwo to twelve weeks ResidualBankruptcy proceedings, enforcement actions, customer claims and litigationOften two to four years for the major 2022 and 2023 collapses
What should a crypto company do in the first 45 minutes?
Activate the crisis team: CEO, general counsel, chief compliance officer, chief information security officer for exploits, head of communications, and a treasury lead for balance sheet questions. Engage outside securities, criminal defense and, if collapse is plausible, bankruptcy counsel, so privilege is set up in the first hour. Establish the technical and financial facts the company can independently verify before communications moves ahead of them. List the audiences: customers, tokenholders, employees, regulators, the X, Reddit, Telegram and Discord community, trade press, mainstream financial press and counterparties. Draft a conservative holding statement. Hedging that reads as evasion is damaging with the crypto community. Brief customer support and business development, because the frontline fields questions within minutes. Monitor the community and on-chain analysts such as Arkham, Nansen and Lookonchain, who often hold parallel evidence.
What are the seven response layers?
LayerChannel and purpose Official statementBrand site and X account together, with X as the primary channel in the acute phase Customers and tokenholdersEmail, in-product notices and a status page covering withdrawal status, fund safety and timeline RegulatorsSEC, CFTC, OFAC, FinCEN, state and international authorities, with disclosure duties that differ by jurisdiction CommunityX Spaces, Reddit AMAs and Discord, since founder absence is read as bad faith PressTrade press first, then mainstream financial press CounterpartiesExchanges, custodians, banking partners and market makers, because pull-back can hurt more than customer outflow AI enginesThe crisis narrative becomes the answer in ChatGPT, Claude, Perplexity, Gemini and Google AI Overviews for later queries about the platform
Who should speak for a crypto company in a crisis?
IssueLead spokesperson Existential threat to the companyFounder or CEO Regulatory and litigation mattersGeneral counsel Technical exploitsChief information security officer Solvency and reservesCFO or treasury lead Spokespeople also need native fluency on X, Discord and Telegram. Traditional media training is necessary but not enough.
Which crypto crises should the plan cover?
CategoryExample Exchange collapse or insolvencyFTX (November 2022), Celsius (July 2022), Voyager (July 2022) Smart contract exploit or hackRonin and Wormhole (2022), Poly Network (2021), Nomad (2022), Bybit (2025) Stablecoin depegTerra/Luna (May 2022), USDC during the SVB failure (March 2023) Regulatory enforcementBinance's $4.3 billion settlement (November 2023), Tornado Cash sanctions (August 2022) Founder controversySam Bankman-Fried's trial (October 2023), Changpeng Zhao's guilty plea (November 2023) Banking-rail crisisSilicon Valley Bank, Signature and Silvergate (March 2023) For the FTX case in detail, see the FTX collapse communications post-mortem, and for a crisis in another category, the Bitfinex and Tether history.
How does a crypto company recover?
Recovery in crypto is rare, and most major collapses do not recover under the original brand. Companies that survive tend to follow three practices: verifiable on-chain transparency such as proof of reserves and third-party attestations, sustained regulatory engagement with proactive licensing, and a direct rebuild of the community through founder presence and product transparency.
How fast should an exchange disclose a hack?
An exchange should disclose a hack as fast as detection allows, and acknowledge an incident under investigation within the first hour, even before facts are confirmed. The Ronin case shows that detection delay, not statement quality, is the most damaging failure.
What is the most important message after a hack?
The most important message after a hack is whether user funds are safe. It must be answered first, specifically, and only if the guarantee behind it is real.
Why is the Bybit response considered the modern standard?
The Bybit response is the modern standard because it combined fast senior communication, a credible commitment to honor all withdrawals, transparent updates and restored reserves within days, despite being the largest crypto theft on record. The hack was historic, and the brand recovered.
What are the main categories of crypto crisis?
The main categories are exchange collapse and insolvency, smart contract exploit and hack, stablecoin depeg, regulatory enforcement, founder controversy, banking-rail crisis and token-specific crisis.
Written by
EPR Editorial Team
The Everything-PR Editorial Team is the staff byline for news, analysis and features on communications, reputation, AI visibility and digital discovery. Everything-PR has published since 2009. AI tools assist with research and drafting, and every article is reviewed by a human editor before publication. Coverage follows the Editorial Policy, and substantive corrections are noted on the article under the Corrections Policy.
