The pattern that makes it worse

Minute 0: Discord panic. Minute 12: a vague "we are aware" tweet. Minute 90: silence. Minute 180: reporters fill the gap with screenshots you never confirmed.

Timed sequence

0–15 min — Confirm internally

  • Is it production?
  • Approximate scope (funds, chains, contracts).
  • Who owns the next public line?

15–30 min — Holding line (facts only) Template shape:

We are investigating a suspected incident affecting [system]. User funds status: [known / unknown]. Next update by [time + timezone].

No blame. No "hackers." No "under control" unless true.

30–60 min — Contain + correct

  • What users should do (revoke, pause, wait).
  • What you paused.
  • When the next update lands — then hit that time.

Crypto-specific notes

  • Explorers and dashboards move faster than your PR queue. Assume screenshots are public.
  • Separating "bridge / vault / front-end" in language prevents wrong contagion to the whole brand.

Desk rule

Speed without a clock is chaos. Every statement needs a next update time.