1. Separate observed facts from early claims
Security incidents develop quickly. A service may pause withdrawals before it knows whether a contract, signing key, front end or account system was affected. An explorer can show transfers without proving who authorized them. Start the article with what the official operator and on-chain evidence actually establish, then label unconfirmed claims clearly.
Record the affected network, contract or account, transaction hashes and the time of each statement. Do not publish a private victim's identity merely because an address was mentioned in a chat. An address attribution needs stronger evidence than a social post.
2. A gross transfer is not always a net loss
Funds can move through several attacker-controlled addresses, bridges or exchange deposits. Adding every transfer can count the same assets repeatedly. Separate the initial unauthorized outflow, subsequent movements, assets still exposed and any independently confirmed returns. Use token units as well as a dated valuation if you report a fiat amount.
Valuation depends on price time, market and token liquidity. A thinly traded token's displayed price may overstate realizable value. Explain the method, and avoid presenting one estimated total as a precise accounting conclusion while facts are changing.
3. Frozen, seized and returned describe different states
An issuer or exchange can sometimes freeze an address or account within its control. Law enforcement may seize assets through a legal process. Neither state automatically means victims have received money. Return can require identity checks, court orders, claims processing or an allocation decision.
Use the exact authority and status in the source. Do not write “recovered” when the evidence says only “identified” or “blocked.” If a project announces an anticipated reimbursement, distinguish a funding plan from completed payments.
4. Root cause needs a scoped technical explanation
An initial statement may call an event a hack before an investigation identifies the cause. A smart-contract exploit, compromised administrator key, malicious upgrade and phishing attack require different remediation. Read the official postmortem, relevant code change and audit scope. A patch announcement does not prove that every affected deployment has been fixed.
Avoid publishing live exploit instructions when they add no educational value. Explain the failed control and practical protections at an appropriate level. Do not claim that an audit missed an issue unless the audit's version and scope actually covered the affected code.
5. Updates should preserve the correction trail
Keep a dated incident timeline with the original source, revised estimate and reason for change. If a number shrinks because overlapping transfers were removed, say so. Silent edits make later comparison difficult and can spread the old figure through summaries and translations.
Link to the official support or claims page reached from the operator's verified site. Warn readers through concrete facts: no legitimate investigation needs a wallet seed phrase, and a fee paid to a stranger does not unlock seized assets.
Worked example: three numbers that cannot be added
A report identifies 100 units leaving a contract, 70 of those units entering a bridge and 20 later frozen at a service. Adding them as 190 lost units would double-count movements. A careful article records a 100-unit initial outflow, traces 70 through a bridge and states that 20 are frozen rather than returned. It values the quantities at a stated time if a currency estimate is necessary.
The numbers are hypothetical and illustrate reconciliation, not an actual incident.
FAQ
Can a transaction hash prove who attacked a protocol?
It proves a recorded transaction on a particular network, subject to the chain's status. Attribution requires additional evidence. Avoid naming a person from address clustering alone, and rely on official investigative findings when reporting identity.
Practical record for this topic
Maintain an incident ledger that labels each number as observed, estimated, frozen, returned or disputed. Include the source timestamp and whether a transfer is gross or net of subsequent movements. When publishing a correction, preserve the old value in an editor’s note and explain the reconciliation. Translated editions should update together after a material correction, while local hotline or claims links should be checked for the reader’s jurisdiction.