The most important crypto risk signals are unverifiable promises, hidden control, unclear custody, fragile liquidity, unaudited or upgradeable contracts, reward systems without external revenue, and pressure to move funds before you understand the transaction.
This checklist is not a fraud detector and cannot make an unsafe product safe. It helps you slow down, identify dependencies, and decide what evidence is missing before money or private information moves.
Promise risk
Guaranteed returns, fixed daily profits, “risk-free” arbitrage, secret algorithms, and countdown pressure are immediate warning signs. Markets change. A legitimate strategy can lose money. Anyone claiming otherwise must explain who absorbs losses and why the opportunity remains available.
Be cautious when proof consists of screenshots, account balances inside an unknown website, or testimonials that cannot be verified. A fake platform can display any number. Small early withdrawals may be allowed to build confidence before larger deposits are blocked.
Custody and access risk
Determine who controls the private keys. On a custodial platform, the company may control access, withdrawals, and asset movement. In self-custody, you control the keys but also bear recovery, phishing, malware, and transaction risks. Neither model removes risk; it changes the responsible party.
Review withdrawal terms, address allowlists, recovery processes, account-freeze powers, and whether customer assets are segregated. Avoid sending funds to a platform that cannot identify its legal operator, jurisdiction, or support process.
Smart-contract and upgrade risk
A contract can contain logic errors, economic design flaws, unsafe integrations, or privileged functions. Verify the deployed contract and compare it with the reviewed code. Check whether an administrator can upgrade implementation, pause transfers, change fees, mint tokens, or drain funds.
Audits are scoped and dated. Multiple audits can still miss a vulnerability or fail to cover new integrations. Review unresolved findings, bounty programs, timelocks, emergency procedures, and previous incidents.
Bridge and oracle risk
Bridges introduce another system that must correctly lock, mint, burn, validate, or release assets. A token on another chain may depend on custodians, validators, multisignature signers, or smart contracts that differ from the original asset. Oracles add a separate dependency for prices and external data.
Ask what happens if the bridge pauses, validators disagree, the oracle reports a bad price, or liquidity for the wrapped asset disappears. A familiar ticker does not guarantee identical risk across networks.
Liquidity risk
Liquidity determines whether a quoted value can be realised. Examine market depth, spread, venue concentration, withdrawal status, redemption rights, and the portion of supply held by insiders. Thin liquidity can make a token appear valuable until a large holder sells.
Yield products add liquidation and maturity risk. If assets are locked, borrowed, rehypothecated, or deployed in other protocols, users may be exposed to several layers at once. Trace the route rather than relying on the final advertised percentage.
Token and incentive risk
New token issuance can subsidise usage, security, liquidity, or growth. It can also hide a lack of external demand. Compare rewards with dilution, unlock schedules, treasury concentration, and who receives newly issued supply.
In games and social applications, determine whether rewards come from players purchasing assets, protocol revenue, advertising, or newly issued tokens. If the economy needs a constant flow of new buyers, it may contract quickly when attention falls.
Governance and control risk
Governance tokens can provide voting rights without effective control. Low turnout, delegated voting, foundation influence, insider holdings, and emergency powers can make a system more centralised than its marketing suggests. Read proposals and execution rules, not only token descriptions.
Identify the legal entity that maintains interfaces, employs contributors, signs contracts, or holds trademarks. A decentralised protocol can still depend on central websites, hosted APIs, sequencers, app stores, banks, or corporate service providers.
Operational and personal-security risk
Many losses occur without a protocol exploit. Users send to the wrong network, approve malicious contracts, expose recovery phrases, install fake wallets, trust impersonated support, or copy an address altered by malware. Use official links, verify addresses, review transaction details, and test new routes with a small amount when practical.
Ethereum.org warns that recovery phrases and private keys provide access to assets, that transactions can be irreversible, and that fake support and giveaway schemes are common. Review its security and scam-prevention guidance.
Regulatory and legal risk
Availability, registration, consumer protections, tax treatment, and asset classification differ by jurisdiction and can change. A platform serving one country may not lawfully or practically serve another. Registration does not eliminate market or custody risk, but unverifiable status should not be ignored.
The CFTC digital-assets resource center collects advisories on trading platforms, fraud, social-media schemes, and payment risks. The FTC cryptocurrency scam guidance explains common impersonation and investment patterns.
Stop conditions
- Someone requests a seed phrase, private key, password, or remote device access.
- A platform requires more payment to release an existing withdrawal.
- Returns are guaranteed or losses are described as impossible.
- The legal operator, contract, custody arrangement, or token supply cannot be verified.
- Urgency prevents independent review or a second opinion.
- Support moves the conversation to unofficial private channels.
- Evidence consists mainly of screenshots, influencers, referral codes, or unverifiable logos.
- You cannot explain the transaction, fees, network, and recovery plan before signing.
A risk score is not a safety certificate
Numeric scores can create false precision. Two projects with the same score may fail through different mechanisms. Record the evidence, missing information, severity, likelihood, and who bears the loss. Use a score only as a summary of a documented process.
Return to the crypto health diagnostic, browse the field guide index, or review how to evaluate a crypto project.