Crypto Exchange Hack Communications: 3 Incidents Compared
By Kyle Porter, Executive Vice President & Managing Director.
Updated November 11, 2026
Crypto exchange hack communications compared: how Coincheck, WazirX and Bybit told users what was lost, what was safe and when withdrawals would resume.
A crypto exchange hack response works when it answers three questions in the first hour: what was taken, are customer funds safe, and when can users withdraw. Coincheck in 2018, WazirX in 2024 and Bybit in 2025 each lost hundreds of millions of dollars, yet their communications differed in speed, voice and proof. This guide compares the three and gives communications teams a plan.
Updated November 8, 2026. This is a communications review, not legal or investment advice. Incident details come from press reports and company statements, and attributions of attacks are reported claims. Virgo PR does not represent any exchange discussed here.
Contents
How do the three exchange hack responses compare?
The three responses differ most in how quickly they promised users a path back to their money. Coincheck held a press conference the day it detected the theft and promised reimbursement two days later. Bybit put its chief executive on a livestream within hours and showed independent proof of reserves within two days. WazirX suspended withdrawals and faced criticism over slow updates and a plan that spread the loss across users. The table summarizes the public record.
ExchangeDateReported lossFirst public responsePath to users stated
CoincheckJan 26, 2018About 58 billion yen of NEMSame-day press conferenceReimbursement of about 46.3 billion yen announced Jan 28 WazirXJul 18, 2024More than $230 millionStatement on X, withdrawals suspendedLoss-sharing plan reported later BybitFeb 21, 2025About $1.4 to $1.5 billion of EtherCEO post and livestreamWithdrawals open; proof of reserves published Feb 23
What did Coincheck do in 2018?
Coincheck moved to a face-to-face apology and a reimbursement promise within two days. The hackers gained access at about 2:57 a.m. on January 26 and the theft was not detected until 11:25 a.m., according to an Australian Computer Society report. The same day the company held a press conference in Tokyo, where its chief operating officer said 523 million NEM tokens, worth about 58 billion yen, had been sent from its address, as reported by Citi FM.
Executives bowed in apology at that press conference, per Kyodo photographs, and the company suspended deposits and withdrawals for all currencies except bitcoin, as covered by Security Affairs. On January 28 it announced it would use its own funds to reimburse about 46.3 billion yen, roughly 90% of the loss, to around 260,000 customers, according to The New Daily. AFP reported in March 2018 that the company said procedures for all affected accounts had been completed. Japan's financial regulator issued a business improvement order on January 29.
What worked: a same-day, in-person explanation, a precise token count and a firm compensation commitment within 48 hours. What to note: the gap of several hours between the intrusion and detection shaped the story, and the regulator's order showed that communication does not replace controls.
What did WazirX do in 2024?
WazirX announced the theft on X and suspended withdrawals, then spent months managing user frustration. Its statement said a cyberattack on one of its multisig wallets had caused a loss of funds exceeding $230 million, as reproduced by Outlook Money. Its custody provider, Liminal, said in a separate statement that its own system had not been breached, according to Business Today.
Blockworks reported that the exchange described the event as a force majeure event beyond its control, and that customers said withdrawals had already been suspended before the incident, per its coverage of the statement. A later reported plan would let users access 55% of their assets while the remaining 45% was converted to locked tokens, according to a Mudrex explainer. The same source described backlash over slow updates and the loss-sharing proposal.
What worked: an early public statement and an offer of a bounty to recover funds, as the founder described in posts covered by CoinGape. What to note: legal framing such as force majeure, an unclear timeline for users and a plan that shared the loss all drew criticism. The shared-blame framing can read as distance from customers.
What did Bybit do in 2025?
Bybit put its chief executive on camera within hours and kept withdrawals open. Ben Zhou posted on X on February 21, 2025 and held a livestream in which he said only one Ethereum cold wallet was affected, other wallets were secure and withdrawals were open, according to Ledger Insights. About 401,000 ETH, worth roughly $1.4 to $1.5 billion, was reported stolen, per The Record.
The company arranged a bridge loan and said it had reserves to cover the loss. CoinDesk reported total outflows of more than $5.5 billion, including over $4 billion in withdrawals described as a bank run, as covered in its report on the outflows. A proof-of-reserves audit by Hacken on February 23 found an in-scope reserve ratio above 100%, according to The Daily Hodl. Bybit also announced a bounty of up to 10% of recovered funds, reported by Coin360.
What worked: a visible leader, a direct message that withdrawals were open, independent verification and a bounty. What to note: even a strong response faced a surge of withdrawals, which shows that confidence takes proof as well as words.
What patterns separate strong responses from weak ones?
-
Lead with the user question. What was lost, what is safe and when can I withdraw were answered fastest by Bybit and Coincheck.
-
Use a visible leader. Coincheck's apology and Bybit's livestream gave users a person to believe.
-
Commit to remedy early. Coincheck's reimbursement promise within 48 hours replaced speculation with a plan.
-
Bring independent proof. Bybit's third-party reserve audit gave users evidence beyond the company's word.
-
Avoid distancing language. WazirX's force majeure framing was criticized in coverage.
-
Publish a timeline and keep to it. Slow, irregular updates fed frustration at WazirX.
What should an exchange prepare before an incident?
-
Name the spokesperson and the approver. Decide who speaks and who clears statements before anything happens.
-
Draft the first three messages. Prepare an acknowledgment, a status update and a user guide with blanks for facts.
-
Pre-arrange verification. Line up an auditor who can publish a proof-of-reserves result quickly.
-
Plan the remedy options. Decide in advance whether the company can fund reimbursement or needs a loan, and how to describe it.
-
Set an update cadence. Commit to regular updates on a fixed schedule, even when there is nothing new.
-
Coordinate with regulators and counsel. Align the public message with legal and regulatory notices.
-
Prepare the aftermath. Plan withdrawal communications, security changes and a post-incident report.
Teams can find the wider approach in Virgo's guides to crypto and Web3 PR and crypto PR cost, and in the ranking of the best crypto PR agencies.
What mistakes make an incident worse?
-
Staying silent while users see rumors on social media.
-
Using legal language before saying what users need to know.
-
Promising a restart date that cannot be met.
-
Sharing numbers that change without explaining why.
-
Blaming a partner before the facts are established.
-
Skipping a post-incident report that explains what changed.
Frequently asked questions
What should an exchange say first after a hack?
It should say what happened, which assets are affected, whether other funds are safe and what happens to withdrawals, then promise a time for the next update.
Should an exchange reimburse users after a hack?
That is a business and legal decision, but Coincheck's early reimbursement promise is often cited as a calming step. It requires the company to have the funds.
Why did Bybit publish a proof-of-reserves report?
An independent audit gives users evidence of solvency, which matters when withdrawals surge after an incident.
Is a CEO livestream a good idea?
It can help because users see a person, but it needs facts, preparation and counsel. A vague livestream can increase panic.
What does force majeure language signal to users?
It can read as distancing the company from responsibility. In WazirX's case, coverage noted the phrase alongside criticism of its communications.
How often should updates be sent after an incident?
Set a fixed cadence, such as daily at first, and keep to it even when there is little new, so users do not fill silence with rumors.
Editorial disclosure and research notes
Facts come from the linked press reports and company statements and were not independently audited. Figures differ across sources, and attributions of the attacks were reported by the outlets cited. Observations labeled as what worked or what to note are editorial judgments. Virgo PR publishes this guide and also offers crypto communications services. This page is not legal or investment advice. Research assembled November 8, 2026.
Follow us
LinkedIn
