Guidelines for Case Timelines

It is important for the organization of cases and to prevent duplicates that all cases be assigned to a specific date when they occurred. This date is used to organize information on the public case lists. It is often desirable to use an exact timestamp. If the exact time of day cannot be determined, then noon UTC on the specified date will be assumed.

The guidelines vary slightly depending on the type of case involved:

Hacking

For hacking events, the timestamp of the first blockchain transaction that actually removes funds from the individual or service facing the loss. Every effort should be undertaken to find the actual blockchain transactions. However, if no blockchain transactions can be found due to the limited available information, then the timestamp of the very first public report of loss should be used.

Rug Pull

For rug pull events, the timestamp of the first blockchain transaction that removes funds from the individual or service facing the loss. If no blockchain transactions can be found, then the timestamp of the very first public report.

Ponzi Schemes

Ponzi events must have concluded before they can be covered. For ponzi events, in this order:

• The timestamp of the first public declaration of bankruptcy, guilt by a founding member, or announcement that the platform is shutting down.
• If there was no such announcement, the time at which the platform ceased to honour withdrawals. This is the time of last withdrawal, not counting withdrawals by operators of the scheme.
• If information about withdrawals cannot be obtained, or no withdrawals were ever allowed, the timestamp of the first public report that a participant is unable to withdraw their funds.
• Failing that, the date of the most comprehensive investigation can be used.

Lost Funds

For lost funds, the time at which the individual or organization first publicly reports the funds inaccessible.

Privacy Breaches

For privacy breaches, the date at which the information was first accessed by an unintended party. If the circumstances of the access have not been publicly revealed, then the time of the first announcement.

What Constitutes Multiple Events

Often times, there will be many events that are related to one another. For example, Mt. Gox went through multiple events leading up to their ultimate demise. In these cases, the following considerations should be made to determine when events are the same:

• If the actual date and platform/wallet/service/contract of the events are within three days (72 hours), these will be considered as one event and included together, even if there may have been multiple separate "incidents" that happened on that single day.
• Each separate event or incident must be fully compliant with the Criteria For Case Inclusion on their own. If they are not, then the minor events should be included in the history or aftermath timeline of the main event/incident.

Some discretion may apply, and it can be challenging to make the right call. Please use the Discussion page if you believe that the original decision was made incorrectly.