An hour-by-hour publishing plan for exchanges after a breach, built from what Binance and Mercado Bitcoin posted during hack week.
After a security incident, an exchange should confirm the breach within about two hours, publish attacker addresses once security verifies them, prove reserves with a snapshot users can check, and reopen withdrawals on a stated schedule.
Hack week tested that sequence twice. On 29 October 2026 Binance lost what it estimated at $6.3 billion from its hot wallets, then spent the next four days rebuilding trust in public with a reserve snapshot and a phased reopening.
On 2 November it was Brazil’s turn, when Mercado Bitcoin, the country’s largest crypto exchange, confirmed a breach of about $46 million (the figure comes from Arkham data). Both exchanges posted within hours. Their updates aged very differently.
The short answer
- Get the first post out within two hours. It should say what is paused and when the next update will come.
- Make attacker wallet addresses public as soon as your security team confirms them, because issuers can only freeze what they can see.
- In the first 72 hours, nothing reassures users like a proof-of-reserves snapshot they can check against their own balance.
- The CEO should post on X personally, with the same facts as the official account.
- Do not call an incident “contained” until on-chain data agrees with you.
- Regulatory clocks start at the same time as the public posts, so legal belongs in the war room from the first hour.
This guide is for exchange founders and the communications leads who will actually write the posts (it is not legal advice).
Key Takeaways
- Hack week showed that the order of disclosures decides how they are read: Binance followed its pause with a reserve proof and a phased reopening, while on-chain data contradicted Mercado Bitcoin’s early claim that its breach was contained.
- Attacker addresses give stablecoin issuers something to freeze, and Tether froze more than 4.5 million USDT linked to Mercado Bitcoin on the day the breach was disclosed.
- Write the holding statement, the address template, the reserve-proof process and the reopening criteria before anything happens, because none of them gets drafted well in the middle of an incident.
What is Blockchain App Factory’s 72-Hour Trust Clock?
Blockchain App Factory’s 72-Hour Trust Clock is a four-stage model that tells an exchange what to publish in each window after a security incident.
We built it from the public record of hack week, with Bybit’s 2025 response as the benchmark. Each stage has a time window, and each comes with posts that should already be drafted and approved before anything goes wrong.
- Confirm (hours 0 to 2): acknowledge the incident and say what is paused, with the time of the next update.
- Trace (hours 2 to 12): publish attacker addresses by chain and a first loss estimate, with the basis for it.
- Prove (hours 12 to 48): take a reserve snapshot users can check for themselves, and say who is covering the loss.
- Restore (hours 48 to 72): reopen withdrawals in phases and put a date on the post-mortem.
The sections below take the stages in order. After them come the regulatory deadlines, which run in parallel and do not wait for the comms team.
|
350,000 withdrawal requests Bybit processed within 12 hours of its February 2025 hack Source: Cointelegraph |
2.1% of Binance’s assets left in net outflows in the first hours after withdrawals reopened Source: The Block, citing Binance |
35,853 Mercado Bitcoin deposit addresses on Ethereum emptied on 2 November, with draining still running after the “contained” statement Source: Bitquery |
|
Would your exchange’s first post survive hack week? We draft and pre-approve incident statements with your security and legal teams before you need them. |
What should an exchange publish in the first two hours after a hack?
Post a short confirmation that says what is paused and when the next update will come, even if you have no loss figure yet.
Speed sets the frame. When Bybit was drained in February 2025, Ben Zhou posted on X within about 30 minutes and was live on a stream roughly an hour later, and he took questions on that stream while the trace was still running.
Binance was slower. AMBCrypto’s timeline puts its first acknowledgment about two hours after the drain began, which we would treat as the outer limit.
A missing number can wait for the next update; a wrong one has to be corrected in public, in front of everyone who screenshotted the first post. We made a similar case in our piece on crypto PR in a trust-driven market: credibility comes from statements people can check, and for an exchange under attack that record starts with the first post.
Say exactly what is paused
Binance halted deposits and withdrawals together. Within hours it posted again to say deposits were back, and each later change to service status got a post of its own. Copy that habit.
Promise the next update and keep the promise
A stated update time turns an open-ended crisis into a schedule people can plan around. Miss it, though, and you lose more trust than you would by turning up on time with little to report.
Point users to official channels only
Binance’s early posts asked users to rely only on official Binance channels. It costs one line. It also gives support staff a single answer for anyone who pastes a “refund” link into a ticket.
Keep unverified numbers out
If the loss estimate is still moving, say so, and say when it will firm up. Whatever figure you publish first is the one that runs in headlines for the rest of the week.
“When we prepare an exchange’s incident kit, the first thing we write is the post the CEO will publish if withdrawals stop. Security and legal sign it off in a calm week, because nobody agrees on wording at three in the morning.”
Arun Kamala Santhanath, Marketing Head, Blockchain App Factory
When should an exchange publish the attacker’s wallet addresses?
Publish them as soon as your security team confirms them, ideally inside the first 12 hours, because stablecoin issuers and other exchanges can only block funds they can identify.
Mercado Bitcoin’s second update did exactly this. It posted the destination addresses tied to the incident so security firms and anyone else watching could follow the money.
The payoff came quickly. The Block’s report notes that Tether froze more than 4.5 million USDT linked to the breach, which is money the attacker can no longer move.
None of this is new. After Bybit, an FBI public service announcement listed 51 Ethereum addresses tied to the theft and asked exchanges and node operators to block them; an exchange that publishes its own list early gets that kind of response moving sooner.
- Publish the addresses as copyable text grouped by chain, since a screenshot cannot be pasted into a block list. Mercado Bitcoin’s list covered EVM networks, Bitcoin, Solana, Stellar and Tron.
- Say why you are publishing. Mercado Bitcoin stated that the addresses were shared for identification and tracking only.
- Send the list to stablecoin issuers and your analytics provider before the public post goes up, or at the same moment.
- Keep updating it as funds move. Elliptic’s tracing, summarised by Bitcoin.com, found Binance hack funds spread across about 12,000 wallets in under four days.
How do proof-of-reserves snapshots fit into hack communication?
A reserve snapshot is the evidence behind the claim that user funds are safe, and it only works when each user can check their own balance against it.
Binance took its snapshot at 00:00 UTC on 31 October, two days after the theft. By 2 November it had finished the zero-knowledge proof for ten tokens and booked another snapshot for Wednesday.
The useful detail came from co-CEO Yi He, who explained on X that the proof takes about 40 to 50 hours to generate once a snapshot is done. Users knew in advance why they would be waiting, so the delay looked like process (and not like stalling). Security now sits inside the brand itself, which is the argument we made in crypto branding in a bear market.
- Name the tokens the snapshot covers, and the ones still pending.
- Explain how users check inclusion. Binance pairs a Merkle tree, which shows an account was counted, with a zk-SNARK that proves total coverage without exposing anyone’s balance.
- Put the time between snapshot and finished proof in the same post that announces the snapshot.
- Be honest about the limits. Roic.ai pointed out before the report landed that reserve proofs cover specified customer balances and do not establish complete liabilities or unrestricted liquidity.
What should the CEO post on X during a security incident?
The CEO should post plain, first-person updates that repeat the official account’s facts and add a personal commitment, without running ahead of the investigation.
Binance had two co-CEOs posting. Richard Teng put out a video update on 30 October with a withdrawal target of about 40 hours, tied to testing. Yi He told users the exchange would cover all hacking losses and sent them back to official channels.
Behind both sat the company’s second update, which Crypto Briefing summarised as four priorities: phased withdrawals, reserve verification, recovery of frozen assets and a technical report.
Label the cause as preliminary
Binance’s first update said its initial investigation pointed to a compromised DevOps engineer’s laptop. Later it said investigators had found additional points of breach. Because the first post said “initial”, the correction read as progress; without that word it would have read as a retraction.
Attach conditions to every target
Teng made the withdrawal target conditional on testing. So if a date slips, the explanation is already on record.
Keep outside voices on the same facts
Changpeng Zhao no longer runs Binance.com, yet he posted that, as a shareholder, he expected users to be covered in full. Founders and investors will post during your incident whether you ask them to or not. Brief them early.
Thank partners by name
Zhao also thanked Tether and Circle publicly for their freezes. A small courtesy, and it tells users the trace is producing results.
How should an exchange reopen withdrawals without triggering a run?
Reopen in phases by network and publish the flow numbers yourself before analysts do.
Binance started restoring withdrawals on Sunday, 1 November. In those first hours it recorded about $3.64 billion in net outflows and said volumes were stabilising after the initial spike.
That is a big number. Binance published it itself, with the note about stabilising volumes attached, so the first reading of it came from the exchange.
The day before, Teng had said Binance had replaced 90% of the stolen assets. Reopening after that update meant the first withdrawals tested a position the exchange had already put on record. Our guide to crypto exchange marketing strategies makes the same point about quieter periods: trust is earned in the product, then repeated in the messaging.
- Announce the order of networks and assets before you switch anything on.
- Publish withdrawal and deposit totals for the first hours, and state the time window they cover.
- Move withdrawals to newly generated wallets and add those wallets to the reserve list, as Binance did.
- Staff support for stuck transfers, and ask users to keep their request IDs.
Which regulatory clocks run alongside public communication?
Several notification deadlines start when you become aware of the incident or classify it, and your public posts have to match what you file.
For crypto-asset service providers in the EU, that means DORA. The AMF’s guidance on DORA sets out the initial notification and interim report deadlines summarised in the first two rows below.
| Rule | Who it covers | Clock | What it means for public posts |
| DORA initial notification | EU crypto-asset service providers | Within 4 hours of classifying an incident as major, no later than 24 hours after detection | Your first public post and your regulator filing will be compared. |
| DORA intermediate report | EU crypto-asset service providers | Within 72 hours of the initial notification | Impact figures in public updates should match the report. |
| GDPR Article 33 | Firms holding EU users’ personal data | Where feasible within 72 hours of awareness, if the breach poses a risk to individuals | Say plainly whether personal data was exposed. |
| SEC Form 8-K Item 1.05 | US public companies | Four business days after determining the incident is material | Listed parents of exchanges need disclosure counsel in the war room. |
How to read this table: the first three columns summarise the rules; the last column is Blockchain App Factory’s own assessment and not legal advice.
Mercado Bitcoin’s statement included a line saying customers’ personal information had not been exposed. If that is true for you, put it in the first post. It answers the data-breach question before anyone has to ask.
Which hack-week statements created new problems?
The statements that hurt were the ones that got ahead of the evidence, chiefly an early “contained” claim and an early single-cause explanation.
Mercado Bitcoin’s first post said it had identified and swiftly contained the incident. Bitquery’s on-chain investigation then found deposit addresses still being emptied at 15:44 UTC, more than two hours after that post went up.
From then on, every update the exchange published was read against Bitquery’s data. One word, used too early, did that.
| Statement | Risk | Safe to post when |
| “The incident is contained.” | On-chain data can contradict it within hours. | Outflows from every known address have stopped and keys are rotated. |
| “The attack was caused by [single cause].” | Forensics often find more entry points. | The post-mortem is complete and verified. |
| “User funds are safe,” with no backing named | It becomes a liability if reserves fall short. | You can name the fund or capital covering the loss. |
| “Withdrawals are paused while we verify. Next update at [time] UTC.” | Low, provided the update arrives on time. | Immediately. |
| “Our initial investigation suggests [cause].” | Low, since it signals more findings may follow. | Security has a working hypothesis. |
| “These are the attacker addresses on each chain.” | Low, and it speeds up freezes. | Security confirms the addresses. |
Risk ratings are Blockchain App Factory’s own assessment.
What should be in an exchange’s incident communication kit?
The kit is every document the Trust Clock needs, written and approved before an incident.
Go through the list below with your security and legal leads in the room. The media side of the same plan, from target outlets to spokespeople, is covered in our overview of crypto PR channels and campaign types.
- A holding statement for a hot wallet drain is approved by security and legal.
- One named person can publish it from the official account at any hour.
- The next-update time is a required field in the template.
- A per-chain address template exists in plain text.
- Contacts at stablecoin issuers and your analytics provider are current.
- Your reserve process states how long a snapshot takes to become a verifiable proof.
- Withdrawal reopening criteria are written down for each network.
- A named owner tracks every regulatory notification deadline.
And watch your drafts for these red flags:
- A draft says “contained” before on-chain outflows have stopped.
- The CEO and the official account give different loss figures.
- A founder or adviser posts updates outside the agreed facts.
- Updates arrive later than the time they promised.
How can an exchange build this playbook in 90 days?
Build it in four phases, and end each one with a decision your leadership signs off.
| Days 1 to 20 | Write the kit. Ships: holding statements for four likely incidents (hot wallet drain, vendor compromise, account takeover wave, social account hijack) and the per-chain address template. Decision: who may post without full sign-off. |
| Days 21 to 45 | Wire the channels. Ships: a status page with the official-channel list pinned on every account, plus a contact sheet for issuers and analytics firms. Decision: which partners get addresses before the public post. |
| Days 46 to 70 | Rehearse. Ships: a tabletop exercise run against the 72-hour clock, with regulatory deadlines tracked by their owner. Decision: whether your reserve proof can be produced within 48 hours. |
| Days 71 to 90 | Publish the baseline. Ships: a regular reserve snapshot cadence and a public page explaining how you will communicate during an incident. Decision: whether to commit publicly to update intervals. |
What is the next step for your incident communication plan?
Start with the document nobody writes well under pressure, which is the first post. Draft it this week. Then get security and legal to approve it, and pin your official-channel list on every account you run so users already know where updates will come from on the day it counts.
Blockchain App Factory’s crypto marketing agency builds incident communication kits for exchanges and Web3 platforms. A kit includes holding statements, channel plans, media relations support and community moderation during an incident. We do not run forensics or give legal advice, so your security firm and counsel stay in charge of what is true and what must be filed.
|
Is your first post approved before an incident happens? Get a 72-hour communications kit your security and legal teams have already signed off. |
Frequently asked questions
How should a crypto project communicate after a hack?
Confirm the incident within hours and tell users what is paused and when the next update will come. Attacker addresses and proof of backing follow as each one is verified, and every promised update has to arrive on time.
How soon should an exchange announce a security breach?
Aim for about two hours from detection. Bybit’s CEO posted within roughly 30 minutes of its 2025 theft, and EU-licensed firms under DORA owe regulators an initial notification within four hours of classifying an incident as major.
Should an exchange publish the hacker’s wallet addresses?
Yes, once security confirms them. Public addresses let stablecoin issuers and other exchanges block the funds, and Tether froze more than 4.5 million USDT linked to the Mercado Bitcoin incident the same day.
Does proof of reserves prove an exchange is solvent after a hack?
No. It shows that specified customer balances were backed at the moment of the snapshot, but it says nothing about complete liabilities or available liquidity, so exchanges should state which tokens it covers and when the next snapshot is due.
What should a CEO avoid saying after a crypto hack?
Avoid calling the incident contained before on-chain outflows stop, and avoid naming a single root cause before forensics finish. Binance first pointed to one compromised laptop and later said investigators had found additional points of breach.
What is Blockchain App Factory’s 72-Hour Trust Clock?
It is a four-stage disclosure model for exchanges after a security incident: Confirm, Trace, Prove and Restore. Each stage has a time window and a set of posts that should be drafted before the incident happens.
A note on this guide
This guide is written for exchange teams preparing for a security incident. Facts were checked on 3 November 2026, and the main third-party figures link to their original sources; none were audited by Blockchain App Factory. Loss and recovery figures are either the exchanges’ own statements or on-chain analysts’ estimates, and the text says which. Blockchain App Factory sells the crypto PR and marketing services described here.
Sources
Exchange incident reporting: The Block, Cointelegraph, Crypto Briefing, AMBCrypto.
On-chain and market analysis: Bitquery, Arkham Intelligence, Elliptic via Bitcoin.com, Roic.ai.
Regulation: AMF guidance on DORA, Commission Delegated Regulation (EU) 2025/301, GDPR Article 33, SEC Form 8-K Item 1.05.
Vimal J is the Head of Sales at Blockchain App Factory, with 10+ years of experience in sales, client strategy, and Web3 business growth. He helps startups, enterprises, and project founders choose the right blockchain solutions for their goals, bringing a practical market perspective to topics like token development, crypto launches, and Web3 adoption.
Article Reviewed by:
Arun Kamala Santhanath
Marketing Head, Blockchain App Factory
