Holding Statement Templates for Web3 Crises: Hacks, Exploits, Depegs and Rug Pull Allegations

A holding statement is the first thing you publish when something goes wrong and you don't yet have all the facts. It's not your full postmortem. It's not a denial. It's proof of life: you're aware, you're moving, and you're not hiding.

The templates on TextExpander, PRLab, Workshop and every other generic source cover "product recall" and "environmental incident." None of them are built for a protocol whose TVL just dropped 60% on-chain in real time while Crypto Twitter is already writing your obituary.

This post gives you five pre-mapped holding statements for the crisis types I see most often in Web3. Each one comes with channel-specific variants so you're not copy-pasting the same paragraph into Discord and your status page and hoping for the best.

---

Why generic holding statement templates don't work in Web3

The standard enterprise template runs something like: "We are aware of an issue. We are investigating. We will share more soon." That's fine when you're a bank dealing with a customer data breach.

It fails in Web3 for three reasons.

First, your community is already on-chain. They can see the attacker wallet draining funds before you've finished your internal triage call. By the time you post the generic "we are investigating" statement, the community has read the Etherscan transaction and filled every gap with speculation. Your holding statement has to acknowledge the on-chain reality, not pretend it doesn't exist.

Second, you have five channels running simultaneously. X, Discord, Telegram, your blog and your status page each have different audiences, different character constraints and different trust registers. A Discord pin from a mod reads differently from an X thread from the founder. You need channel-specific language, not one blob of text.

Third, rug pull allegations are a category that doesn't exist in enterprise PR. The reputational accusation can hit before any technical failure. Your holding statement has to function as a denial and an evidence commitment at the same time.

"It takes years to build reputation and credibility! One wrong move and boom, everything's into the ashes!" Shilika Jain on X, 19 May 2023

I wrote that during Ledger's 2023 recovery key controversy. The principle holds for every crisis type below.

---

The anatomy of a Web3 holding statement

Every holding statement, regardless of incident type, needs four things:

1. Acknowledgment — what happened, stated plainly, without euphemism
2. Action — what your team is doing right now
3. Authority — where the community should go for official updates (your X handle, your Discord announcements channel, your status page)
4. Timeline — a specific time by which you will say more

What it does not need: root cause, attribution, blame, compensation details, legal conclusions. None of that belongs in a holding statement. You do not have it yet, and if you speculate in the first statement, you'll spend the next 48 hours correcting yourself.

One more thing: once the holding statement is published, lock down individual team member accounts. No one on the team posts anything until the full update is ready. Founder tweets during a live crisis almost always make it worse. Centralize all messaging on the project account.

---

Crisis type 1: Smart contract exploit

What it looks like: On-chain analytics (PeckShield, Chainalysis, Rekt News) flags anomalous fund movements. Your TVL is dropping. Users are asking what's happening. You are mid-triage and don't know scope yet.

Time pressure: 60 minutes from internal confirmation to public statement. Not 2 hours. Not "when we know more." Sixty minutes.

Holding statement template:

We are aware of an ongoing incident affecting [protocol name] on [chain]. Our team is actively investigating the affected contracts and we have [paused contract functionality / halted deposits and withdrawals] as a precaution while we assess the situation. We are working with [security partner name, or "our security partners"] to determine scope. Do not interact with the protocol until further notice. We will publish a full update at [specific time, e.g., 18:00 UTC]. All official updates will come from this account and our Discord announcements channel only.

X variant (280 characters): Cut to the first two sentences and the update time. Pin it. Do not add context in replies yet.

Discord variant: Post the full template in #announcements with @everyone. Lock the general channel or activate slowmode to stop speculation from drowning out the update. Mods should sticky a message: "Please wait for the official update at [time]. Do not share unofficial links."

Status page / blog: Post the holding statement as-is. Add a timestamp. This becomes the canonical reference every journalist and analytics account links to.

Telegram: Mirror the X variant exactly. Pin it. Tell the moderators to direct all questions to the status page link.

---

Crisis type 2: Hot wallet compromise

What it looks like: A hot wallet tied to the treasury, operations or a team member is drained. This might be a phishing incident, a compromised private key or a SIM swap. Funds are gone. The question is whether the protocol itself is at risk.

The communication challenge: You need to separate "hot wallet compromise" from "smart contract exploit" clearly and quickly, or the community treats them as the same thing. One threatens protocol security; the other is a contained loss.

Holding statement template:

We are aware that [treasury hot wallet / team operational wallet] address [0x...] has been compromised and drained of [amount, if known]. This is an isolated incident affecting a single hot wallet. The [protocol's smart contracts / cold storage / main treasury multisig] are not affected and remain secure. We have immediately [revoked permissions / moved remaining assets / notified exchange partners to flag the attacker address]. We are working with [security firm] on attribution and will file a report with [relevant authorities]. Full update by [time] at [status page URL].

What to stress: The word "isolated." If it genuinely is isolated, say it early and say it clearly. If you're not sure yet, don't say it. "We have no evidence of broader contract exposure" is acceptable if it's accurate.

Channel note: For a hot wallet compromise, the status page and blog carry more weight than Discord. The technical audience you need to reassure is reading on-chain data and will want a link to the specific wallet addresses and your technical statement. Get the blog post up fast.

---

Crisis type 3: Oracle failure or manipulation

What it looks like: A price feed is manipulated or fails, triggering incorrect liquidations, inflated collateral values, or a flash loan attack. Users have lost funds through no fault of their own. The mechanism is technical and hard to explain quickly.

The communication challenge: Most of your community doesn't understand what an oracle is. You're trying to explain a technical failure to people who are watching their balances drop. Don't lean on jargon in the holding statement. Explain the effect first, the mechanism second.

Holding statement template:

We have identified an issue with the price feed used by [protocol name] that caused [brief effect: incorrect liquidations / inflated collateral ratios / unauthorized borrowing]. We have paused affected markets to prevent further impact. No user action is required at this time. Do not attempt to interact with [specific pool/function]. We are working with [oracle provider name, or "our oracle provider"] and [security firm] to understand the full scope. Affected users will be identified and we will communicate a remediation path in our full update at [time]. All official communication is on this account and at [status page URL].

What not to do: Don't name the oracle provider as the cause until you have confirmed it. "A price feed issue" is accurate without assigning blame before you've verified the technical report.

X variant: Lead with the effect and the pause. "We have paused [markets] due to a price feed issue. No action needed. Update at [time]." Two sentences. People will read the rest in the linked blog post.

---

Crisis type 4: Stablecoin depeg

What it looks like: Your stablecoin, or a stablecoin you're relying on as collateral, has broken peg. Price is at $0.85 and falling. Redemption queues are building. The community wants to know if this is a Terra/Luna situation.

The communication challenge: Every depeg looks like a potential death spiral to people who lived through May 2022. Your holding statement has to address the mechanism of the depeg and the state of reserves, even if preliminary.

Holding statement template:

[Token name] is currently trading below peg at approximately $[price]. We are aware of the situation and are actively monitoring [peg mechanisms / redemption queues / collateral ratios]. [Insert one factual sentence about current collateral status, e.g., "Current protocol reserves stand at $X, covering Y% of outstanding supply as of this statement."] This is not a Terra-type algorithmic failure. The peg mechanism is [brief description, e.g., "backed by overcollateralized on-chain assets"]. We have [activated redemption / paused new mints / contacted market makers] to support the peg. Full technical update at [time]. Official updates only via [channels].

Why the Terra reference matters: You have to say it. "This is not a Terra-type failure" sounds defensive in any other industry. In Web3 after May 2022, not saying it is worse. Your community is already thinking it. Address it in the holding statement.

Status page: Post the collateral ratio number and update it every 30 minutes until the peg recovers or you've published the full update. Real-time numbers calm people more than any amount of reassuring language.

---

Crisis type 5: Rug pull allegation

What it looks like: A wallet analytics account or crypto journalist posts a thread alleging insider token dumps, back-door contract functions, or suspicious liquidity removals. You're not down bad on-chain, but the allegation is spreading fast and the token is already dumping on sentiment.

The communication challenge: This is a reputational crisis, not a technical one. Your holding statement is a denial and an evidence commitment rolled into one. It has to sound like a team that has nothing to hide, not a team reading from a legal script.

"founders are naturally born FUD-fighters." Shilika Jain on X, 27 Feb 2023

True. But fighting FUD effectively requires discipline. Emotional denials make things worse. What works is evidence, fast.

Holding statement template:

We are aware of the allegations circulating about [token/project]. Our team is actively reviewing the specific claims and we take this seriously. We will publish a full response with on-chain evidence, including complete team wallet histories and vesting contract addresses, by [specific time, e.g., 6 hours from now]. All official updates will come from this account and our Discord announcements channel only. Legal counsel is engaged. We are not going anywhere.

What to avoid: Emotional denials. Attacking the accuser by name. Technical detail you haven't verified. Promises you can't keep within the stated window.

X variant: Post this verbatim. Pin it. Founder account goes quiet until the full response is ready.

Discord variant: Post the holding statement in #announcements. Do not delete critical comments — doing so accelerates distrust faster than almost anything else.

The follow-through: The holding statement buys you 4 to 6 hours. You need to use that window to assemble the on-chain proof bundle: team wallet addresses, vesting contract transactions, full token distribution data. Publish it as a full blog post with linked Etherscan entries, then thread it on X. The holding statement is only as good as the evidence you publish after it.

---

The decision matrix: which template, when

---

Three mistakes that turn a holding statement into a liability

Publishing too late. Every hour of silence is an hour the community fills with speculation. If you wait until you have the full picture, Rekt News and Crypto Twitter have already written the story for you.

Over-lawyering the language. Legal teams write holding statements that protect against liability but communicate nothing. The result is a statement that reads as evasion. Lawyers should review your holding statement, not write it. Communicators write it.

Inconsistent channel versions. The Discord says one thing, the X thread says another, the blog contradicts both. Message fragmentation is itself a crisis amplifier. One canonical statement, distributed verbatim (with format-appropriate edits for character count), across every channel simultaneously.

---

Pre-build these before you need them

The worst time to write a holding statement is during the crisis.

The right time is in a quiet week before any launch. Identify your top 3 to 5 reputational risk scenarios, draft a holding statement for each, get legal to review them, and store them somewhere your entire team can access in under two minutes at 2am on a Sunday.

If you want a senior operator to do that with you, including mapping your specific protocol's risk register and building the full channel response plan, that's exactly the kind of work I do on a fractional retainer.

"comms is so underrated in web3 but that's everything! how you communicate w your community, stakeholders, customers, retail users, airdrop hunters, journos is literally everything!" Shilika Jain on X, 3 Jun 2025

Crises don't give you prep time. The preparation is the work.

---

Book a 30-min teardown with Shilika to map your protocol's top risk scenarios and build pre-approved holding statement templates before you need them. Book here