Cryptocurrency investors face more than price volatility. They must also assess whether a project’s team, technology, token economics, market activity and legal claims can withstand independent scrutiny. The risks remain substantial: the FBI’s Internet Crime Complaint Center said cryptocurrency investment fraud caused $7.2 billion in reported losses in the United States during 2025, making it the costliest category of investment fraud reported to the agency.

Chainalysis separately estimated that crypto scams and fraud received $17 billion worldwide during the year, while attackers stole another $3.4 billion through hacks and wallet compromises. The figures measure different forms of activity, but they show why a polished website, exchange listing or smart-contract audit should never be treated as proof that an investment is safe.

What Is Crypto Due Diligence?

Crypto due diligence is the process of independently researching and verifying a cryptocurrency, token or blockchain project before investing. Rather than relying on marketing materials, social media posts or influencer opinions, investors gather evidence from primary sources such as project documentation, smart contracts, blockchain data, audit reports, regulatory filings and official announcements to evaluate whether a project's claims can be verified.

A thorough due diligence process examines multiple areas, including the project's purpose, team, technology, tokenomics, security, governance, market adoption and regulatory considerations. It also involves reviewing onchain data, such as token-holder concentration, wallet activity, liquidity and contract permissions, to identify risks that may not be apparent from a project's website or whitepaper alone.

Crypto due diligence cannot determine whether an investment will be profitable or eliminate the risk of loss. Instead, its purpose is to help investors identify warning signs, challenge a project's claims with independent evidence and make better-informed investment decisions based on verifiable facts rather than speculation or hype.

1. Understand the Project

Understand exactly what the project is trying to build and why the token exists. If you cannot clearly explain the project in a few sentences, you probably should not invest.

Review the following:

  • Project purpose: What problem does the project solve? Is blockchain genuinely needed, or could the same product operate without it?
  • Product status: Is there a working product, testnet, mainnet or only a concept? Look for evidence that the product exists rather than relying on marketing claims.
  • Target users: Who is expected to use the product? Developers, businesses, institutions, consumers or another audience? A project should have a clearly defined user base.
  • Token utility: What is the token actually used for? Common use cases include paying network fees, staking, or governance. Be cautious if the token has little or no clear purpose.
  • Documentation: Read the project's whitepaper, technical documentation and official website to understand its objectives, architecture, roadmap and token design. Treat these documents as the project's claims, not proof that those claims are true, and verify important statements using independent sources whenever possible.
  • Roadmap and progress: Compare the project's roadmap with what has actually been delivered. Consistently missed milestones or vague timelines may indicate poor execution.
  • Competitive advantage: Identify the project's main competitors and determine what differentiates it. A sustainable advantage may come from technology, lower costs, stronger security, network effects or developer adoption, not marketing alone.

2. Research the Team and Developers

The people building a crypto project can be just as important as the technology. Verify who they are, what they have built before and whether their claims can be independently confirmed.

Review the following:

  • Team identity: Are the founders, executives and core developers publicly identified? Anonymous teams are not automatically a red flag, but they increase the importance of reviewing the project's technology, governance and security.
  • Experience: Do team members have relevant experience in blockchain, software engineering, cybersecurity, finance or the industry the project targets? Review previous roles, technical expertise and notable achievements.
  • Track record: Have they worked on other crypto or technology projects? Research whether those projects were successful, abandoned, exploited, involved in legal disputes or accused of misleading investors.
  • Independent verification: Confirm employment history, education and previous positions using professional profiles, company websites, conference appearances, interviews and other reliable public sources. Be cautious of recently created or incomplete profiles.
  • Developer activity: If the project's code is public, review GitHub or other repositories to determine whether the development team is actively maintaining the project. Regular updates from multiple contributors generally provide more confidence than long periods of inactivity.
  • Transparency: Does the team communicate regularly through blog posts, developer updates, governance discussions or community AMAs? Consistent communication helps investors understand how the project is progressing and how the team responds to challenges.
  • Investors and advisors: If the project claims support from venture capital firms, advisors or strategic partners, verify those relationships through the investor's or organization's official announcements instead of relying solely on the project's website.

3. Research the Technology and Security

You do not need to read smart contract code to evaluate a crypto project's technology. Instead, look for evidence that the project is actively developed, independently reviewed and follows recognized security practices.

Review the following:

  • Blockchain and architecture: Which blockchain does the project use, and why? If it has its own blockchain, review how it achieves security, scalability and decentralization. The project's documentation should clearly explain its technology and how it works.
  • Development activity: Check whether the project is actively maintained on GitHub or another public code repository. Look for recent updates, multiple contributors and ongoing development rather than abandoned repositories.
  • Smart contract audits: Verify whether the project's smart contracts have been audited by a reputable blockchain security firm. Read the published audit report to confirm which contracts were reviewed, whether critical issues were identified and whether those issues were fixed. An audit reduces risk but does not guarantee the absence of vulnerabilities.
  • Bug bounty program: Check whether the project rewards security researchers for responsibly reporting vulnerabilities. An active bug bounty demonstrates an ongoing commitment to security beyond a one-time audit.
  • Security incidents: Research whether the project has experienced hacks, exploits or other security incidents. If so, review how the team responded, whether users were compensated when appropriate and what changes were made to prevent similar incidents.
  • Open-source code: Projects that publish their source code allow developers and independent researchers to review how the protocol works. While open-source software is not automatically secure, greater transparency generally allows issues to be identified more quickly.
  • Independent reviews: Look beyond the project's own claims. Review by yourself analyses from reputable blockchain security firms, researchers or developers, and verify that important technical claims are supported by independent sources rather than marketing materials.

4. Research the Tokenomics

Tokenomics refers to how a cryptocurrency's supply, distribution and economic design work. Even a strong project can struggle if too many tokens are controlled by insiders, large amounts are scheduled to unlock, or the token has little practical use.

Review the following:

  • Token utility: What is the token used for? It should have a clear purpose, such as purchasing in-game assets, accessing products or services, rewarding users or enabling participation in the project's ecosystem. Be cautious if the token exists mainly for speculation.
  • Circulating, total and maximum supply: Compare how many tokens are currently in circulation with the total and maximum supply. A low circulating supply may increase price volatility and could lead to selling pressure as additional tokens are released.
  • Token allocation: Review how tokens are distributed among the team, investors, advisors, the community and the treasury. A high concentration of tokens held by insiders may increase the risk of future selling pressure.
  • Vesting and token unlocks: Check when locked tokens become available for sale. Large token unlocks can increase the circulating supply and affect the token's market price if many holders decide to sell.
  • Inflation and emissions: Determine whether new tokens will continue to be created over time. Higher inflation may reduce the value of existing holdings unless demand grows at a similar pace.
  • Market capitalization and FDV: Inspect the Fully Diluted Valuation (FDV), and compare it with the token market cap. A significat difference between the two may indicate future dilution as additional tokens are released.
  • Token burns and supply reduction: If the project burns tokens, understand how the process works and whether it meaningfully reduces the supply. Token burns alone do not guarantee that a token will increase in value.
  • Where to verify the information: Review the project's tokenomics page, whitepaper or official documentation, then compare the figures with reputable blockchain explorers and cryptocurrency data platforms to confirm that the reported supply and allocation are consistent.

5. Evaluate Onchain Activity and Market Data

Onchain activity and market data can help you determine whether a launched crypto project is actually being used and how its token is traded. This section applies only to projects with a live token or blockchain. If the token has not launched yet, onchain activity and market data will not be available.

Review the following:

  • Token holders: Check how many wallets hold the token and whether ownership is concentrated. If a small number of wallets control a large percentage of the supply, they could significantly influence the market if they decide to sell.
  • Wallet concentration: Review the largest token holders using a blockchain explorer. While exchange, treasury and smart contract wallets often hold large balances for legitimate reasons, a high concentration among unknown wallets may increase investment risk.
  • Trading volume: Compare the token's daily trading volume with its market capitalization. Consistently low trading volume may indicate limited investor interest and make it more difficult to buy or sell the token without affecting its price.
  • Liquidity: Check whether the token has sufficient liquidity on the exchanges where it trades. Higher liquidity generally makes it easier to enter or exit a position with less price impact.
  • Market capitalization: Compare the project's market capitalization with similar cryptocurrencies in the same category. This helps place the project's valuation into context but should not be used as the only measure of value.
  • Network activity: If the project operates its own blockchain or protocol, review metrics such as active addresses, transaction activity or Total Value Locked (TVL) for DeFi projects. Consistent user activity may indicate real adoption, although these metrics should not be viewed in isolation.
  • Price history: Review how the token has performed over time and whether major price movements coincide with significant news, token unlocks or market events. Past performance does not predict future returns, but it can help identify periods of unusually high volatility.
  • Where to verify the information: Use reputable blockchain explorers to review wallet and transaction data, and compare market metrics across established cryptocurrency data platforms. Cross-checking multiple sources helps identify inconsistencies or outdated information.

6. Check the Community and Governance

An active and transparent community can indicate that a project is being developed and discussed openly. However, community size alone is not a reliable measure of quality or legitimacy. Focus on meaningful participation rather than follower counts.

Review the following:

  • Community engagement: Visit the project's official social media channels, forums and community platforms to see whether discussions are active, constructive and focused on the project's development rather than only its price. Be cautious if legitimate criticism is routinely censored.
  • Developer communication: Check whether the team regularly shares development updates, explains major decisions and responds to community questions through blog posts, governance forums, community calls or Ask Me Anything (AMA) sessions.
  • Governance: If the project allows token holders to vote on proposals, review recent governance activity. Active voting and transparent discussions may indicate that the community has meaningful input into the project's development.
  • Transparency: Look for clear communication about roadmap changes, security incidents, partnerships and other important developments. Projects that openly discuss challenges generally inspire more confidence than those that avoid difficult topics.
  • Independent discussion: Search for conversations about the project on independent platforms, such as Reddit or developer forums, to see how the broader crypto community views it. Compare positive and negative opinions, and verify important claims using reliable sources.
  • Where to verify the information: Review the project's official website and social media accounts, governance forum (if available), and established community platforms. Consider multiple sources rather than relying on a single channel.

7. Check the Legal and Regulatory Risks

Crypto laws differ by country and by the type of token or service involved. Investors do not need to interpret every regulation, but they should establish who operates the project, what rights the token provides and whether important legal claims can be independently verified.

Review the following:

  • Legal entities and jurisdiction: Identify the company, foundation or decentralized autonomous organization (DAO) responsible for issuing the token, developing the project and operating its services. Verify the legal entity through official company registers. If the project is incorporated in an offshore jurisdiction, ensure the team and key decision-makers can be identified and that the legal structure is transparent. A registered company confirms that a legal entity exists; it does not prove that the project or token is approved by a financial regulator.
  • Regulatory status: Determine whether the issuer, exchange, custodian or other service provider requires authorization in your country. Search the relevant regulator's official register using the entity's exact legal name, not only its brand name. Also check the regulator's warning list for unauthorized businesses and companies, impersonators and known scams.
  • Meaning of registration: Verify what any claimed license or registration actually covers. Authorization for custody, exchange services or anti-money-laundering supervision may not cover the token itself or constitute approval of the investment. In the European Union, for example, ESMA states that whitepapers in its MiCA register have not been reviewed or approved by a competent authority.
  • Token classification and holder rights: Read the token terms and legal disclosures to understand what buyers receive. A token may provide network access, governance rights, redemption rights, a claim on reserves or no enforceable rights at all. Do not assume that owning a token provides ownership in the project, entitlement to revenue or the same protections as shares or regulated investments.
  • Restrictions and disclosures: Check whether the project excludes residents of particular countries, requires identity verification or limits transfers, redemptions or withdrawals. Restrictions that appear only after a purchase, or claims that users can avoid them with a virtual private network, are warning signs.
  • Legal and regulatory history: Search the project, its legal entities and senior team members alongside terms such as “lawsuit,” “enforcement,” “regulator,” “bankruptcy,” “investigation” and “sanctions.” Confirm important findings through court records, regulator announcements or company filings rather than social media posts.
  • Terms governing investor funds: For presales, stablecoins, tokenized assets and custodial products, establish who receives and controls the money, how it may be used, whether investors have redemption or refund rights, and what happens if the issuer, custodian or platform fails. A token representing another asset may expose holders to the bankruptcy or failure of the company holding that asset.
  • Where to verify the information: Start with the project’s terms, privacy policy, token disclosures and named legal entities. Then cross-check the information through official company registries, securities or financial regulators, court databases and sanctions lists in the relevant jurisdictions. Rules vary, so investors should check both the project’s jurisdiction and the laws that apply where they live.

Common Crypto Red Flags

No single warning sign proves that a crypto project is fraudulent or destined to fail. However, multiple red flags should prompt additional research or, in some cases, a decision not to invest.

Watch for the following:

  • Guaranteed returns or unrealistic promises: Be skeptical of projects that claim investors cannot lose money or promise fixed or exceptionally high returns.
  • Unverifiable team: The founders, developers or company behind the project cannot be identified, or their backgrounds and qualifications cannot be independently confirmed.
  • Poor transparency: The project provides little information about its technology, tokenomics, legal structure or roadmap, or frequently changes key details without explanation.
  • Copied or low-quality documentation: The whitepaper or website contains plagiarism, factual inaccuracies, vague technical explanations or unrealistic claims.
  • Unclear tokenomics: Token allocation, vesting schedules, supply figures or token utility are missing, inconsistent or difficult to verify.
  • No independent security review: The project has no published smart contract audit, refuses to disclose audit results or leaves critical security issues unresolved.
  • Excessive insider control: A small number of unidentified wallets control a large share of the token supply, or the project lacks transparency about treasury holdings.
  • Fake or misleading partnerships: The project claims relationships with well-known companies, investors or organizations that cannot be confirmed through official sources.
  • Artificial hype: Marketing focuses on price predictions, celebrity endorsements, giveaways or fear of missing out (FOMO) instead of explaining the product and its development.
  • Suppressed criticism: Legitimate questions are routinely deleted, critics are banned without explanation or the team avoids responding to reasonable concerns.
  • Pressure to invest quickly: Investors are encouraged to act immediately because of "limited-time" offers, countdown timers or claims that an opportunity will disappear.
  • No working product: The project has been in development for a long time but still has no working product, testnet or demonstrable progress beyond marketing materials.
  • High fully diluted valuation: An FDV that is significantly higher than the current circulating market capitalization may indicate substantial future dilution as locked or unissued tokens enter circulation.
  • Low or concentrated liquidity: Be cautious if most of the token's liquidity is concentrated in a single exchange, liquidity pool, market maker or wallet address, particularly one controlled by the project's developers. Limited or concentrated liquidity can make it difficult to buy or sell the token without significantly affecting its price.
  • Withdrawal or payment demands: A platform requires additional deposits, taxes, fees or verification payments before allowing users to withdraw their funds.
  • Regulatory warnings or legal issues: Financial regulators have issued warnings about the project, or the company and its executives have unresolved enforcement actions, lawsuits or investigations.