What Belongs on a Crypto Due Diligence Checklist?

In 2021, anyone who wanted proof that the Terra blockchain had real users could point to Chai, a Korean payments app. Its transactions showed up on Terra's chain, and Terraform Labs told investors that real-world use like this was part of what gave its LUNA token value. The SEC's complaint tells a different story. It says Chai payments ran through ordinary payment rails, and that Terraform copied them onto the blockchain to make them look as if they had settled there.

By then Terraform was also promoting Anchor, a protocol the SEC says "promised to pay 19-20% interest" on its UST stablecoin. In May 2022 UST lost its dollar peg and LUNA collapsed with it. In April 2024 a jury found Terraform and its founder Do Kwon liable for fraud, and in June 2024 they agreed to pay more than $4.5 billion, according to the SEC.

Two questions would have caught it early: where does that 20% come from, and who is actually using this? Those questions run through every check below.

Ten minutes or an hour?

There are two jobs here, and they need different amounts of time. The first is a scam screen: can you sell the token, is the contract verified, does the address match the one you were sent. That takes about ten minutes, and our guide to checking if a crypto project is legit walks through it. Do that first. If a project fails it, you're done.

This page is the second job. A project can pass the scam screen and still be a bad place for your money: too many tokens waiting to unlock, a treasury nobody can see, a single company holding the keys. That's what the hour is for.

Not sure whether a site, a message or an offer is a scam? Our is this a scam? quiz takes a minute, and the Scams hub has every guide in one place.

1. Team: is it real and reachable?

Start with the people. Are they named? If they are, check what they actually shipped before, not what their bios say. A founder's last project is the best evidence you'll get about this one. Look at the GitHub too: a repository with years of commits from several people says more than a polished website.

Anonymous isn't an automatic no. Bitcoin's founder is anonymous. But an anonymous team removes the one thing that keeps most founders honest, which is that people know where to find them. Weigh it rather than ignore it, and ask a simple question: if this went wrong tomorrow, who would answer for it?

Prefer to watch? The short version in under a minute.

2. Tokenomics: what the token does, and who holds it

First, what is the token for? Some tokens pay for something people need, like fees on a network. Some give a vote. Some do neither, and their price rests entirely on the next buyer. Read the docs and write the token's job down in one sentence. If you can't, that's your answer.

Then look at who holds it. How much of the supply sits with the team, investors and treasury versus the public, and when do their tokens unlock? A launch with 15% of tokens circulating and the rest arriving over two years is a very different bet from one that's fully circulating. Free trackers like Tokenomist and CryptoRank show unlock calendars, and the block explorer's holder list shows who has what today. Our token unlocks guide explains why the calendar matters.

One number helps here. Market cap counts only the tokens circulating now. Fully diluted valuation, or FDV, prices every token that will ever exist. When the FDV is many times the market cap, most of the supply hasn't reached the market yet, and someone is waiting to sell it.

3. Audits, and who can still change the code

Has a known security firm reviewed the code? Find the report on the auditor's own website, because a PDF hosted only by the project proves nothing. Then check three things in it: that it covers the contract address you're looking at, that it's recent, and that the problems it found were fixed.

Even then, an audit lowers the risk. It doesn't remove it. Euler Finance, a lending protocol, had been through 10 audits in two years, its CEO said, when an attacker took about $197 million from it on March 13, 2023, according to Bloomberg. The attacker returned the recoverable funds by April 3. Most victims of most hacks don't get that ending. No audit on a contract holding real money is still a clear step up in risk.

Then ask who holds the keys. Many contracts can be upgraded or paused by an admin wallet, and many bridges move money when enough "signers" agree. The Ronin bridge, built for the game Axie Infinity, needed 5 of 9 validator signatures to approve a withdrawal. On March 23, 2022, an attacker controlled 5 of them, four held by one company, and drained about $625 million, as The Record reported. On the explorer, look at who owns the contract, whether it's an upgradeable proxy, and how many signers a change needs. Keys held mostly by one company aren't spread out, whatever the number says.

4. Real usage: who is paying to use it?

Marketing is cheap. On-chain numbers are harder to fake: active addresses, transactions, fees paid, total value locked. DefiLlama shows TVL and fees for most DeFi protocols for free. If the project claims booming adoption and the chain shows a flat line, believe the chain.

Harder to fake doesn't mean impossible to fake. Terra's Chai transactions were on-chain, and the SEC says they were copied there. So look for usage that costs someone money. Fees paid by users are the best sign. Deposits that arrive only while a reward is running, then leave when it ends, are a sign of rewards, not users.

The same goes for yield. If a protocol pays you, find out who is paying. Borrowers paying interest, traders paying fees: those are sources. "The treasury" or "new deposits" are not. Anchor's 19-20% was the question everyone could have asked in 2021.

5. Treasury: where did the money go?

Serious projects publish their treasury wallets and report what they spend. You can then check the wallets against the reports on a block explorer. When a project raised millions and shows nothing, you're being asked to trust instead of check.

FTX is the extreme case. It wasn't a token, but the lesson is the same. When the SEC charged Sam Bankman-Fried on December 13, 2022, it alleged that he had diverted FTX customers' money to his trading firm, Alameda Research, while raising more than $1.8 billion from investors, according to the SEC. Nobody outside could check, so nobody did. Unverifiable is a risk in itself.

6. Communication: how do they handle bad news?

Pull up the roadmap from a year ago and compare it with what shipped. Delays are normal. What matters is whether the team says so. Then read the community channels the way a skeptic would. Straight answers to hard questions are a good sign. A Telegram where those questions get deleted is a bad one.

7. Your exit

Decide before you buy what losing all of it would mean, and size the position so you'd survive that. Of all seven, this is the only check you control completely. Write down, now, what would make you sell: a missed unlock date, a team member leaving, an audit nobody can find. You'll think more clearly about it today than on the day it happens.

Four collapses, four skipped checks

None of these needed inside information to question. The yield, the key setup, the missing reports and the limits of an audit were all questions you could put to the team at the time, from your own chair.

FAQ

What is due diligence in crypto?

It's the research you do before you put money into a project: who runs it, what the token does, who holds the supply, whether the code was audited and who can change it, whether people really use it, where the money goes and how the team behaves. For a token, an hour of reading free sources covers most of it.

How long should crypto due diligence take?

About ten minutes for a scam screen, then about an hour for the checks on this page. If a project fails the first ten minutes, skip the hour.

Is an audited crypto project safe?

No. An audit lowers the risk, it doesn't remove it. Euler Finance had 10 audits in two years and still lost about $197 million in March 2023. Check that the audit covers the live contract and that its findings were fixed.

Is an anonymous crypto team a red flag?

It's a risk, not an automatic no. Bitcoin's founder is anonymous. But with an anonymous team nobody answers for mistakes, so the code, the keys and the treasury need to be checked even more closely.

What's the difference between market cap and fully diluted valuation?

Market cap counts the tokens circulating now. Fully diluted valuation counts every token that will ever exist. A big gap between the two means many tokens are still waiting to unlock.

What tools do I need for crypto due diligence?

All free: the block explorer for the token's chain, DefiLlama for usage and fees, an unlock tracker such as Tokenomist or CryptoRank, and the auditor's own website. Tools are named as examples, not endorsements.

For the market backdrop to set any project against, see how to read a market cycle. If the project runs on its own stablecoin, read stablecoins explained first.