What should you tell your community in the first hours after a hack?

AmaZix — Tue, 03 Nov 2026 00:00:00 +0000

Tell them what you know, what you don't, and when the next update comes. Pin one status message that says whether deposits and withdrawals are paused and why. Warn that the team never DMs first and that no compensation form exists unless it appears there. Keep one official channel as the source of truth.

Key takeaways

The first status message covers what happened, what is paused and why, whose loss it is if confirmed, and when the next update comes.
Pin one message, edit it as facts change, and name a single official channel for updates.
Post on a stated cadence even when nothing has changed; silence is when fake official posts spread.
Put a 'we never DM first, no compensation form unless it is here' line in the status message itself.
The AI agent answers repeated questions from the pinned update; humans take individual funds, accounts and judgement calls.

What goes in the first status message?

Four things: what happened in plain words, what is paused and why, whether users' funds are affected or covered, and when and where the next update will appear. Mercado Bitcoin's first statement in November 2026 said it had identified and contained a security incident in one of its systems¹, and called its pause of deposits and withdrawals temporary and preventive¹. Binance explained its withdrawal pause by saying securing the environment was the top priority², and its CEO said the company, not users, would absorb the financial impact².

Say what you do not know yet; do not guess the cause, the attacker or the size of the loss. Keep price and market talk out of the message and out of moderator replies.

Pin the message in every channel and edit it as facts change; do not post contradicting versions. A worked template:

Status, [date, time, timezone]. We identified a security incident affecting [system] and have contained it. [Deposits and withdrawals] are paused as a precaution while we secure the environment. [Only if confirmed: losses are covered by the project, not users.] We do not yet know [cause or scope] and will not guess. Our team never DMs first. There is no refund or compensation form unless it is linked in this message. Next update: [time] on [channel].

Element	What to say	What to avoid	Public example
What happened	Identified and contained, or under investigation	Guessing the cause or attacker	Mercado Bitcoin¹
What is paused and why	A preventive pause, with the reason	An open-ended "soon"	Mercado Bitcoin, Binance¹²
Whose loss it is	Only what is confirmed	Promises you cannot keep	Binance²
Where and when updates come	One named channel, a stated cadence	Parallel unofficial posts	Mercado Bitcoin named X for updates¹
Scam warning	We never DM first; no compensation form unless pinned	Linking anything off-channel	IC3, KyberSwap³⁴

How often should you update, and where?

Commit to one official channel and a stated cadence, and post even when nothing has changed. Mercado Bitcoin named X as its channel for updates¹; name yours in the pinned message so members know where to look.

Each update should answer the question members are asking at that moment: is it contained, when do withdrawals reopen, what happened once they did. After reopening, Binance gave a factual update: withdrawal volumes had declined and were stabilising after an initial spike². Silence between updates is when rumours and fake "official" posts fill the gap.

Why do impersonators show up right after a hack?

Because worried members are looking for help, and scammers offer it first: fake support DMs, fake refund forms and look-alike accounts. After its 2023 breach, KyberSwap told users that circulating reimbursement claims were scams⁴ and warned that phishing links may appear in replies to its posts⁴. The FBI's IC3 has warned that crypto owners are increasingly targeted by scammers impersonating exchange support or security³, and that legitimate support does not initiate unsolicited contact³.

AmaZix's HAIMDALL moderation data, as of 3 November 2026, records 4,271 all-time bans under its impersonators rule and 1,949 under its suffixes rule, which catches display names imitating a known account. These are all-time totals, not a post-hack spike: the threat is standing, and a public incident gives it a fresh pretext.

What should moderators and the AI agent do in the chat meanwhile?

The AI agent answers the repeated questions from the pinned facts only; humans take anything about individual funds, accounts or judgement calls. "Are my funds safe?" and "when do withdrawals reopen?" should get the same answer every time, quoted from the latest pinned update.

Hand off to a human:

individual balance or account questions
anyone who reports clicking a link or signing a transaction
press and partner messages
anything the pinned update does not cover

Discord warns that an attacker holding a compromised account can damage the servers it moderates, for example by mass-banning members⁵. Check 2FA on every admin and moderator account before the chat gets busy. Remove impersonators and look-alike display names fast, and repeat the "we never DM first" line in replies.

How KAI handles this

KAI by AmaZix is an AI agent that answers the repetitive questions of Web3 communities 24/7 on Telegram, Discord and Twitch, in the project's own voice and from its own documentation, and hands anything that needs judgement to human moderators. During an incident, add the pinned status update to that documentation so the agent answers from the same facts as your team.

HAIMDALL, KAI's moderation layer, applies fixed, auditable rules rather than AI judgement to remove spam, phishing links, message floods, coordinated raids and accounts impersonating your team. See how it works for Web3 communities and on the community AI page.

Frequently asked questions

What should the first message after a hack say?

What happened in plain words, what is paused and why, whether users' funds are affected or covered if that is confirmed, and when and where the next update will appear.

Should we say what caused the hack?

Not until it is confirmed. Say what you do not know yet rather than guessing the cause, the attacker or the size of the loss.

How often should we post updates?

On a stated cadence in one named official channel, even when the update is that nothing has changed.

Why warn about impersonators in the status message?

Scammers impersonating support and offering fake compensation arrive once a hack is public. A pinned 'we never DM first' line gives members a rule to check against.

What should the AI agent answer during an incident?

Only the repeated questions covered by the pinned update, quoted consistently. Individual balance or account questions, anyone who clicked a link and anything not covered go to a human.

KAI by AmaZix blog