A crypto post-mortem is the document that decides whether an exploit stays a hack story or turns into a story about the team’s response. Reporters read it for facts. Users read it for money. Both read it for signs of spin.
Google’s engineering book defines a post-mortem as a written record of an incident. It covers impact, actions taken, root causes and follow-up work to stop a repeat. It adds a rule that matters here. A post-mortem should be blameless, focusing on contributing causes without indicting any individual or team.
In a crypto post-mortem that rule has a PR payoff. A document that points at a person invites a fight. One that explains a failure invites a fix, and often a bit of respect.
What Readers Want From a Crypto Post-Mortem
MetronomeDAO’s account of the July 2023 Curve incident is a clean model. It opens with the date and time in UTC, says which pool was hit, and explains the cause in two sentences. Then come four labelled sections, including The Attack at a Glance and Timeline and Nature of Events.
The structure answers the questions in order. What happened, when, how much, what the team did, and what happens to holders. It also reports what the pool held at the time and how much was drained, which gives reporters numbers they can quote.
A Timeline With Timestamps in UTC
Write the timeline of a crypto post-mortem first. Use UTC, and say approximately where the time is approximate. Metronome notes that an earlier attack on another pool happened about 40 minutes before its own. Then it links the transactions so anyone can check.
It also admits what it doesn’t know. The post says it’s unclear whether one attacker worked with another or copied them. That sentence costs nothing and buys credibility. Teams that follow a first-hour response plan will already hold most of these timestamps in their own notes.
Root Cause in a Crypto Post-Mortem Without Blame
State the cause plainly and stop. For Metronome, the cause sat in a compiler flaw, and the post points readers to the official Vyper post-mortem for the technical depth. Linking to the primary source beats rewriting it badly.
Avoid adjectives about the attacker, avoid guesses about motive, and leave out any line that could read as passing the buck. Reporters will weigh the document against how they verify claims before publishing. Every statement needs a source or a hedge.
Losses, Recovery and Compensation
Every crypto post-mortem should give the loss figure and how it was measured. Say what has been recovered, what hasn’t, and what’s still unknown. If holders will be made whole, explain how, and by when. Metronome devoted a section to recapitalizing the pools, which tells users where they stand.
Promise only what the treasury and the community can deliver. A vague pledge to make everyone whole will be quoted back at the team for years. Handling a nine-figure DeFi loss in public shows how a clear account of money and next steps shapes the coverage.
Publishing the Post-Mortem in the Right Order
A short status note goes out within hours. The full crypto post-mortem comes when the facts are settled. Metronome’s was published on August 18, nearly three weeks after the exploit, which shows that waiting for accuracy is acceptable if the status updates continue.
Host it at a durable URL, not only inside a thread. Pin it, link it from the community channels, and add it to the press page. Send the link to reporters without an embargo, since there’s nothing to hold back. If you must brief a few first, agree the terms openly.
Edits should be dated. If a number changes, show the old one and the new one with a date. Quiet rewrites are how a clear document turns into a suspicious one.
Crypto post-mortem: publish check
Run these lines before the document goes live.
NCA helps teams draft the post-mortem and the status updates around it, with legal and security leads in the room. Reach the response team before an incident forces the work.