A crypto crisis response works when detection is fast, user funds are guaranteed, and the CEO speaks publicly within hours. This page gives a crisis communications plan template for exchanges and protocols, built from the Ronin, Wormhole and Bybit hacks, with the first-45-minutes checklist, spokesperson roles and case studies.
Companion analysis: The regulatory dimension of any hack response sits in The 2026 Crypto Regulatory Landscape. The media-side coordination plays through the five-tier map in Crypto Media Outlets 2026. Community-surface monitoring during a crisis is covered in the Reddit and community layer of the Crypto & Web3 Citation Share Study. For the underlying response framework, see 5W Public Relations' crypto crisis communications playbook, which covers market crashes, regulatory scrutiny and post-hype trust rebuilding under one framework. For the stablecoin failure case, see Terra UST Depeg Communications, and for the rest of the section, the Crypto PR hub on agencies, media, regulation and AI visibility. The general discipline behind this plan is covered in the Crisis Management Guidebook.
What Do the Ronin, Wormhole and Bybit Hacks Teach?
The three incidents teach three separate lessons: detection speed, a credible guarantee on user funds, and visible senior leadership.
| Incident | Date | Loss | Communications lesson |
|---|
| Ronin bridge (Axie Infinity) | March 2022 | About $600 million | Detection delay of roughly six days set the ceiling on response speed |
| Wormhole bridge | February 2022 | About $320 million | Jump Crypto replenished the funds within days, and a credible backstop was the message |
| Bybit | February 2025 | About $1.5 billion | A fast, senior, continuous response kept the brand alive |
Ronin (March 2022): what does slow detection cost?
Slow detection costs the company its ability to communicate at all. The Ronin bridge supporting Axie Infinity lost roughly $600 million in an exploit the FBI later attributed to North Korea's Lazarus Group. The defining communications problem was the timeline, because the breach went undetected for roughly six days. A company cannot communicate a crisis it has not detected, so detection speed sets the ceiling on response speed. Six days of silence, even unintentional silence, reads to the market as concealment.
Wormhole (February 2022): what does a strong backstop look like?
A strong backstop is a credible, specific and immediate guarantee that user funds are whole. The Wormhole bridge lost roughly $320 million, and Jump Crypto, the firm behind the project, replenished the stolen funds within days. That commitment was communicated clearly and early. In a hack, the single most powerful message is that guarantee, and everything else is secondary.
Bybit (February 2025): what is the modern standard?
The modern standard is a fast, senior, specific and continuous response. Bybit lost roughly $1.5 billion in the largest crypto theft on record, which the FBI attributed to Lazarus Group. The chief executive addressed the public directly and quickly, including a live-streamed session. The exchange confirmed it would honor all withdrawals, secured bridge financing to cover the gap, and restored reserves within days. The hack was historic, and the brand survived it.
What Is the Crypto Hack Crisis Playbook?
The crypto hack crisis playbook has five steps, in this order.
Hour one: confirm before you speak, but speak fast. Acknowledge that an incident is under investigation before you have all facts, because silence is read as concealment. Never speculate on attribution, amount or method before they are confirmed. The first statement says that the company is aware, is investigating, treats customer funds as the priority, and will follow up on a stated timeline.
Lead with the funds question. Users have exactly one question: is my money safe. Answer it first and specifically. "Funds are SAFU" worked for Binance because a real insurance fund backed it, and a guarantee is only worth communicating if it is real.
Put the senior executive forward, visibly. The chief executive should communicate a crisis of this magnitude on camera, repeatedly. Delegating it to a press statement signals that the company does not grasp the severity. Bybit's live-stream was the message, not theater.
Coordinate the four-way table. Hack communications must move in lockstep with security, legal, exchange and listing partners, and, where stolen funds touch sanctioned actors, policy and law enforcement. A statement that contradicts the security team's findings or the legal team's exposure assessment does more damage than silence.
Build the infrastructure before the crisis. Prepare a dark site, a statement library, a pre-cleared executive spokesperson, a decision tree for detection-to-disclosure timing, and a tested coordination protocol. The exchanges that survive hacks wrote the playbook on a calm day.
What does a crypto crisis communications plan template look like?
A crypto crisis communications plan template covers four phases, a first-45-minutes checklist, seven response layers and named spokesperson roles. Crypto is a high-velocity crisis category: token price and customer withdrawals respond to communications in seconds, the community on X, Reddit, Telegram and Discord acts as a permanent adversarial press, several regulators claim jurisdiction, and the founder is often the brand.
What are the four phases of a crypto crisis?
| Phase | What it looks like | Typical length |
|---|
| Latent | A balance sheet hole, an unexploited vulnerability or a sealed subpoena exists but is undisclosed | Sometimes hours |
| Acute | A withdrawal pause, exploit notice, SEC complaint or founder post, with token price and withdrawals reacting in real time | First 4 to 72 hours |
| Managed | Statements are out, regulators are engaged and the technical or financial response is structured | Two to twelve weeks |
| Residual | Bankruptcy proceedings, enforcement actions, customer claims and litigation | Often two to four years for the major 2022 and 2023 collapses |
What should a crypto company do in the first 45 minutes?
- Activate the crisis team: CEO, general counsel, chief compliance officer, chief information security officer for exploits, head of communications, and a treasury lead for balance sheet questions.
- Engage outside securities, criminal defense and, if collapse is plausible, bankruptcy counsel, so privilege is set up in the first hour.
- Establish the technical and financial facts the company can independently verify before communications moves ahead of them.
- List the audiences: customers, tokenholders, employees, regulators, the X, Reddit, Telegram and Discord community, trade press, mainstream financial press and counterparties.
- Draft a conservative holding statement. Hedging that reads as evasion is damaging with the crypto community.
- Brief customer support and business development, because the frontline fields questions within minutes.
- Monitor the community and on-chain analysts such as Arkham, Nansen and Lookonchain, who often hold parallel evidence.
What are the seven response layers?
| Layer | Channel and purpose |
|---|
| Official statement | Brand site and X account together, with X as the primary channel in the acute phase |
| Customers and tokenholders | Email, in-product notices and a status page covering withdrawal status, fund safety and timeline |
| Regulators | SEC, CFTC, OFAC, FinCEN, state and international authorities, with disclosure duties that differ by jurisdiction |
| Community | X Spaces, Reddit AMAs and Discord, since founder absence is read as bad faith |
| Press | Trade press first, then mainstream financial press |
| Counterparties | Exchanges, custodians, banking partners and market makers, because pull-back can hurt more than customer outflow |
| AI engines | The crisis narrative becomes the answer in ChatGPT, Claude, Perplexity, Gemini and Google AI Overviews for later queries about the platform |
Who should speak for a crypto company in a crisis?
| Issue | Lead spokesperson |
|---|
| Existential threat to the company | Founder or CEO |
| Regulatory and litigation matters | General counsel |
| Technical exploits | Chief information security officer |
| Solvency and reserves | CFO or treasury lead |
Spokespeople also need native fluency on X, Discord and Telegram. Traditional media training is necessary but not enough.
Which crypto crises should the plan cover?
| Category | Example |
|---|
| Exchange collapse or insolvency | FTX (November 2022), Celsius (July 2022), Voyager (July 2022) |
| Smart contract exploit or hack | Ronin and Wormhole (2022), Poly Network (2021), Nomad (2022), Bybit (2025) |
| Stablecoin depeg | Terra/Luna (May 2022), USDC during the SVB failure (March 2023) |
| Regulatory enforcement | Binance's $4.3 billion settlement (November 2023), Tornado Cash sanctions (August 2022) |
| Founder controversy | Sam Bankman-Fried's trial (October 2023), Changpeng Zhao's guilty plea (November 2023) |
| Banking-rail crisis | Silicon Valley Bank, Signature and Silvergate (March 2023) |
For the FTX case in detail, see FTX Celebrity Endorsements: Lessons for Brands and Talent, and for a crisis in another category, the Bitfinex and Tether history.
How does a crypto company recover?
Recovery in crypto is rare, and most major collapses do not recover under the original brand. Companies that survive tend to follow three practices: verifiable on-chain transparency such as proof of reserves and third-party attestations, sustained regulatory engagement with proactive licensing, and a direct rebuild of the community through founder presence and product transparency.
Should a crypto company bring in outside crisis help?
Most companies that survive a major incident work with outside counsel and an experienced communications firm from the first hour, because the first 45 minutes cannot be improvised. Firms that specialize in the category are compared in the crypto PR company guide, which covers five crypto PR agencies and the checks to run before signing. For the wider field of crisis firms, see Top Crisis PR Firms 2026.
