Crisis PR built around a verifiable incident record

Which incident facts belong in the first record?

The first artifact is an incident record with 6 fields: timeline, confirmed facts, open questions, source documents, affected audiences and approval owners. It gives the team one working reference before any public wording is cleared.

For an exploit report, the source set may include technical findings and the team’s current public messages. For a delisting notice, include the platform’s exact wording and any details the project may share. For FUD, record the claim itself and the evidence available to assess it. Do not treat a circulating claim as a confirmed event.

We flag missing evidence and identify which reviewer can resolve each open point. The record also distinguishes what is known from what the team is still investigating. This structure helps prevent an early statement from sounding more certain than the evidence supports.

Send the record with the people authorized to review it. Our FUD response guide covers community messaging when the immediate issue is a disputed public claim. For the wider communications context, see PR and media.

How should a holding statement mark unknowns?

A holding statement needs 3 clear elements. It states what the project can confirm at this stage, what remains under review, and where readers can find the next approved update. It should acknowledge the issue without supplying an unverified explanation.

We draft from the incident record, not from assumptions about cause or impact. The wording names the project’s current action in plain language. It can say that a reported issue is under review, for example, if that is what the responsible team has confirmed. It should not imply a resolution or finding that has not been established.

Before approval, check each factual sentence against its source. Confirm any attributed quote with the named speaker. Ask the technical or legal reviewer to check claims within their remit. Keep unresolved questions visible in the working copy rather than quietly removing them.

A concise first statement can be followed by a fuller explanation when the team has substantiated more detail. We keep that distinction clear in the drafts, so stakeholders can tell what is current and what remains open.

Where should each approved update appear?

A channel map has 4 columns: audience, destination, message owner and approval route. It shows where the approved statement belongs and who handles follow-up in each place.

A project may need a primary statement on its website, a shorter X post, a Telegram update and direct replies for partners or media. Short versions should preserve the main statement’s meaning. They can link readers to the project’s source of truth rather than introducing a separate explanation.

We also record questions that do not yet have an approved answer. That gives support teams and spokespeople a consistent way to handle requests without filling gaps differently. The map identifies who can correct a published message and who prepares the next update.

For a separate formal announcement, press release distribution may fit when the facts and format support it. Crisis updates should remain clearly attributable to the project. They should not be presented as independent reporting. The publication record captures the approved wording and where it appeared.

What artifacts make up the crisis response package?

The response package collects the incident record, approved language and publication details in one handover. Its contents reflect the event and the audiences that need information, rather than a fixed set of generic messages.

Typical outputs include:

• Incident record: confirmed facts, sources and open questions.
• Holding statement: a concise first public update.
• Channel copy: selected short versions that retain the approved meaning.
• Talking points: guidance for founders, community staff, support or media replies.
• Approval map: reviewers, publishing owners and the source of truth.
• Follow-up draft: language for later updates when additional facts are confirmed.

The client supplies relevant platform notices, technical or legal guidance, existing public statements and approval contacts. We identify gaps and mark claims that need confirmation. An exploit response needs a different evidence set from a delisting notice or a dispute over a public claim.

If persistent search results or negative coverage become a separate concern, online reputation management is a related service. It addresses a different communications need from the immediate incident update.

How does an incident brief move to publication?

The response follows 5 checkpoints: intake, ownership, drafting, channel review and publication record. Each checkpoint has a clear input, so the team can see what is ready and what still needs review.

At intake, we log the timeline, available evidence and audiences affected. Next, the client names technical, legal and executive reviewers, plus the person authorized to approve public wording. We draft the holding statement and supporting copy from the confirmed facts. Unresolved points stay marked for review.

The reviewers check claims within their responsibilities. We then adapt approved language for the selected channels and compare each version with the main statement. The client publishes through its own channels or coordinates publication with us. We retain the final approved copy and its publication location for follow-up.

A useful kickoff message includes the incident record, source files, current public messages and approval contacts. For a later paid media format, consider sponsored articles in crypto media only when it suits the message and disclosure. The team agrees scope and working cadence at kickoff.

What remains outside the communications team's control?

The communication record can show what the project said and when; it cannot determine a platform’s listing decision. An exchange or other platform controls its own review, notice wording and decision timing. During a reported exploit, public claims also need to match what the responsible technical investigation can substantiate.

That boundary shapes the work. We verify the supplied notice, prepare the project’s approved response and keep unknowns visible. We do not present an unconfirmed cause as fact. Before publication, the client checks that the statement reflects current information and that sensitive technical, wallet or user details have clearance for disclosure.

If evidence changes, update the source of truth and route revised wording through the agreed reviewers. Then publish a correction or follow-up through the relevant channels. This leaves a clear record without implying that communications work can change another party’s decision.

To begin, send the incident timeline, available source material, current public messages and names of the reviewers. We will organize the record and confirm the drafting scope with your team.

How it works

1. Send the incident recordShare the timeline, available evidence, relevant notices and current public messages. Mark what is confirmed and what remains open.
2. Name reviewers and ownersIdentify technical, legal and executive reviewers, plus the person authorized to approve publication. List the audiences that need an update.
3. Draft the first statementWe prepare concise wording from verified facts. Open questions remain marked for confirmation.
4. Review channel versionsWe adapt approved facts for selected channels and check each version against the main statement.
5. Publish and recordThe client publishes through its channels or coordinates publication with us. We retain the approved copy and prepare follow-up language as facts change.