During a crypto incident, social posts move faster than evidence. A withdrawal halt, exploit rumor, or chain outage can produce contradictory explanations in several languages. A disciplined timeline helps readers protect themselves without amplifying an unverified allegation. The method below separates observations, statements, and inferences; it is useful for a family account or editorial desk and does not attempt to identify blame before the facts are established.
Open an incident log
Create fields for UTC timestamp, source, exact wording, entity, network, transaction ID, screenshot hash, and confidence. Start with what you observed: a failed withdrawal, a public block, an official status notice. Do not write “hacked” until a credible source supports that description. Keep original files read-only and note who collected each item. This avoids a later translation silently changing the chronology.
Prioritize primary notices
Check the service status page, signed announcement, official domain, chain explorer, and regulator communication. Social accounts can point to a notice but may be impersonated. Compare the account handle, domain, and publication time. If an official page is edited, save the version and record the change. A primary notice can still be incomplete; describe its scope and the questions it leaves open.
Verify public identifiers
For an on-chain claim, check transaction IDs, contract addresses, block height, and affected network. For a platform claim, record legal entity, product, region, and terms version. A similar token or chain can lead investigators to the wrong record. Never send a “verification payment” to an unknown address. An identifier that cannot be reproduced is a lead, not proof.
Separate status from cause
“Withdrawals paused” is an operational status. “Because of an exploit” is a causal explanation that needs evidence. Keep both as separate timeline entries and mark confidence. A service may pause for maintenance, compliance review, liquidity, or security response. Avoid filling the gap with the most repeated theory. Ask what observation would confirm or falsify each explanation, then wait for a source.
Protect affected people
Tell users to secure email, revoke suspicious sessions, preserve logs, and use official support. Do not request seed phrases, passwords, or full identity files in a public chat. Redact addresses and personal data before sharing an incident report. Affected users may face emotional pressure; a calm instruction to pause can prevent secondary scams that promise recovery for an upfront fee.
Publish a measured update
A useful update states the last verified time, what changed, which sources were checked, and what remains unknown. Add a correction history when new evidence changes the timeline. Do not declare funds safe because one transaction succeeded, and do not declare an entity insolvent from a rumor. The record should let another reader reproduce the check and understand the limits of the conclusion.
Operational worksheet
Hash each original screenshot or export and keep the hash beside its UTC collection time. Make separate columns for observation, official statement, third-party report, and inference. When a source is edited, record both versions and the change time; do not silently replace the earlier wording. Verify a contract address or transaction ID through an independent explorer before associating it with an incident. In a public update, state the last verified fact and a clear next check rather than repeating a dramatic headline. Protect victims by removing seed phrases, passwords, identity numbers, and unnecessary addresses. A measured timeline helps support teams and readers coordinate without turning a rumor into an irreversible accusation.
Add a correction record whenever a source retracts or narrows a claim. Distinguish “not observed” from “did not happen”; an investigator may simply lack access. Keep victims’ identities out of the public timeline unless they consent and disclosure is lawful. Evidence discipline is especially valuable when a translated rumor reaches a new audience.
Use UTC consistently and preserve the source language for key quotations. A correction should explain what changed and why the earlier wording was withdrawn.
Record the reviewer, source version, and confidence before publication.