The same red screen can hide different emergencies
A 20% market decline is mainly a market-risk event. An unauthorized login is a security event. An exchange that cannot be reached is an access event. A major crisis can combine all three.
The first job is classification, because the wrong response can add damage. Selling everything is not useful if the real problem is a compromised account and the attacker still controls access. Resetting passwords does not solve a portfolio whose leverage is approaching liquidation.
Build the response in layers
Protect identity and access: if compromise is suspected, use a clean device where possible, secure authentication, preserve evidence and follow the provider’s official security route.
Measure market exposure: identify open positions, leverage, liquidation risk and assets that can actually be exited. Do not assume displayed prices are executable.
Map operational access: record which venues, networks and withdrawal routes are functioning and which are merely rumored to be available.
Separate confirmed facts from social-media claims: crisis information changes quickly. Timestamp every source and distinguish official status updates from interpretation.
A compound fictional scenario
Imagine a sharp market selloff while one exchange reports intermittent access problems and social media circulates an unverified “hack” claim. The trader has no evidence yet that the account itself is compromised.
The disciplined sequence is to preserve account security, verify the exchange’s official status, measure existing exposure and avoid creating new positions while access is uncertain. Only after the incident type becomes clearer should the response become more specific.
Crisis plans should exist before the crisis
During normal conditions, record emergency contacts, official support routes, account identifiers, custody map, liquidation thresholds and alternative access methods. The goal is not to predict the next crisis but to reduce the amount of thinking required while information is incomplete.
No-money practice
Run three tabletop cases: a 30% crash with normal exchange access, a confirmed account compromise with stable market prices, and a combined outage plus market crash. Write the first five actions for each. If the lists are identical, the plan is not distinguishing incident types well enough.
*Cryptocurrency and virtual asset transactions are highly volatile and irreversible, may result in significant losses, and do not guarantee returns; customers should trade only after understanding the risks involved.
