Crypto Due Diligence: A 7-Step Research Framework

Crypto due diligence is the structured process of researching a project before you put money into it. You check who is behind it, what the token actually does, how supply is distributed, whether the code has been reviewed, how easily you can sell, and whether the pitch shows known fraud patterns. The aim is not to collect reassuring facts. It is to look for reasons not to proceed, and to invest only if none survive.

This guide gives you a seven-step framework you can reuse for a new token, a DeFi protocol or an established coin. It is educational information, not personalized financial advice, and nothing here predicts returns.

Key Takeaways

• Due diligence is a search for reasons not to invest. One framework describes it as weighing team, smart contracts, tokenomics, traction, governance and legal exposure together, not ticking a checklist.
• Start with the documents: a white paper, a roadmap, a clear use of funds and a stated explanation of what the token gives its holder.
• Supply, unlock schedules and liquidity decide how much selling pressure and exit risk you carry, regardless of how good the story sounds.
• An audit reduces risk but never removes it, and guaranteed returns, urgency and unsolicited offers are fraud signals.
• Finish with a written scorecard so you can compare projects on the same criteria and revisit the decision over time.

Table of Contents

What Crypto Due Diligence Means and Why It Is Harder Here

In traditional finance, due diligence leans on audited financial statements, regulated disclosures and a legal entity you can sue. Crypto offers fewer of those anchors. IOSCO, the international body of securities regulators, lists the key crypto-asset risks as insufficient disclosure, unclear or inaccurate documents, technical complexity, dependence on a project team, liquidity risk, volatility and possible partial or total loss. It also notes that investors may have limited legal and practical recourse, partly because projects are often cross-border.

The US Commodity Futures Trading Commission (CFTC) advises extensive research before buying digital assets, warns that fraud is a significant risk, and states that no investment or trading strategy is guaranteed.

That is the reason to work through a method. When information is patchy, a consistent process protects you from the loudest marketing.

The 7-Step Framework at a Glance

Step 1: Read the Purpose, Documents and Roadmap

Start with what the project says it does. The SEC’s investor education arm advises you to look for a clear business plan, white paper or development roadmap, to ask how funds will be used and what rights the token provides, and to check whether the code is public and independently audited.

FINRA’s guidance, reproduced by IOSCO, adds a useful test: you should understand the issuer’s technical explanation in plain English, the intended use of funds, and a roadmap with specific goals and timelines. If you cannot understand or verify these claims, your due diligence is impaired, and that is itself a finding.

Practical questions to answer in writing:

• What problem does the product solve, and who would pay for it without a token incentive?
• Does the token have a function inside the product, or is it only a fundraising instrument?
• Are roadmap items specific and dated, or vague (“ecosystem expansion”)?
• Does the white paper read as original, or does it borrow wording from other projects?

The last question matters. IOSCO reports that a 2018 review of 1,450 ICOs found 271, about 18%, with plagiarized investment documents, guaranteed-return promises or missing or fake executive teams.

A token is only as dependable as the people who can change its code, move its treasury or market it. Check whether the founders use real, verifiable identities, what they have built before, and whether any prior projects ended in disputes. The SEC suggests investigating the people and firms offering the investment, and, where relevant, checking the seller’s licensing or registration.

Two US enforcement cases show why. In July 2024 the SEC alleged that Nader Al-Naji raised more than $257 million for BTCLT while falsely stating that proceeds would not compensate him or employees, and that he presented BitClout as decentralized under the pseudonym Diamondhands. In April 2024 the SEC alleged that Geosyn Mining falsely claimed favorable electricity contracts and failed to disclose that it had not bought or activated machines for some investors. These are allegations in SEC releases, but they illustrate the pattern: the claims that sounded most concrete were the ones that needed checking.

For a method of vetting founders and campaigns in general, this campaign fraud prevention playbook covers reputation checks that carry over to token projects.

A quick team checklist:

1. Do the founders appear under their own names on professional profiles and past project pages?
2. Can you confirm their earlier roles from sources they do not control?
3. Is there a legal entity, and where is it registered?
4. Do they respond to technical questions in public channels, or only post promotional content?
5. Are endorsements from independent people, or paid promoters?

Step 3: Analyze Tokenomics, Utility and Governance

Tokenomics is the economic design of a token: how much exists, who holds it, when it unlocks and what gives it demand. An EY token due diligence paper recommends analyzing total, circulating and fully diluted supply, alongside vesting and unlock schedules that affect selling pressure.

Supply. Circulating supply is what trades today. Fully diluted supply is the total if every token were released. A large gap means future unlocks could weigh on the price. For scale, Bitcoin had roughly 20.04 million coins in circulation as of June 15, 2026, against a fixed limit of 21 million. Most altcoins do not have a limit this clear, so check each one.

Allocation and unlocks. Missing supply and allocation figures, or large unlocked team and treasury allocations, are red flags that can lead to heavy selling pressure. Ask: what share is held by founders, early investors and the treasury, and what is the vesting schedule?

Utility. Ask whether demand comes from real use, such as fees, collateral or access, or only from expectation of a higher price. FINRA also advises checking the terms and white paper to learn what the buyer actually receives, including governance or ownership rights, resale limits and whether a market may exist.

Governance. The Bank for International Settlements describes a decentralization illusion in DeFi: the need for governance tends to concentrate power among developers or governance token holders, much like shareholders. Look at who holds voting tokens, who controls upgrade keys and whether a small group can move treasury funds.

A worked example

Suppose a new token has 100 million in circulation and 1 billion in total supply. Only 10% trades today. If the team and early investors hold 40% with a one-year cliff, a large unlock sits ahead. That does not make the project bad. It tells you the price you see reflects a small float, and that you should find the unlock dates before sizing any position.

Step 4: Assess Security and Smart Contract Audits

For DeFi and any token with on-chain logic, code risk is central. Ethereum’s developer documentation says smart contract audits give an independent review of code to find vulnerabilities, but they are not silver bullets and will not catch every bug or design error.

When you read an audit, check:

• Who audited it, and when. An audit of version 1 says little about version 3.
• What was in scope. Some audits cover only part of the system.
• How findings were resolved. Look for critical issues marked fixed, not acknowledged and ignored.
• Whether the code is public. Open repositories let independent developers inspect it.
• Development practices. Ethereum’s guidance points to static analysis tools such as Slither, property-based testing and a robust CI process.

Governance can be attacked too. The same Ethereum documentation notes that flash loans can give attackers enormous temporary voting power to push through malicious proposals. And composability, where DeFi protocols plug into each other, means a weakness in one component can spread to the wider ecosystem, according to a 2025 SEC-hosted submission. So check which other protocols your target depends on.

For background on how audits are changing, see Cryptela’s coverage of an AI-based smart contract audit firm launching.

Step 5: Check Liquidity, Volume and Valuation

A price is only useful if you can trade at it. EY advises examining liquidity depth on decentralized exchanges, market capitalization relative to fully diluted value, and transaction volume to judge whether entering and exiting is feasible. For DeFi platforms, cross-reference total value locked (TVL, the assets deposited in a protocol) to see whether growth is organic or driven by temporary incentives.

A simple routine:

1. Compare the market cap with the fully diluted valuation.
2. Check 24-hour volume against market cap. Very thin volume means big orders move the price.
3. Look at where the token trades and whether volume is concentrated on one venue.
4. For DEX tokens, check pool depth: how large a sell would move the price by several percent?
5. Review historical highs and lows to see how violently the asset has moved. Cryptela’s all-time high and low tracker and market cap rankings are useful starting points, and the crypto converter helps you translate values into your own currency.

Stress matters as well. The BIS notes that liquidity mismatches in stablecoins can trigger runs and collateral fire sales if participants doubt the quality of the underlying assets. A separate BIS working paper finds that collateral liquidations in DeFi lending can create downward price pressure and feedback loops across decentralized exchanges.

Any price or volume you record should carry its date, time, source and currency. Market data goes stale within minutes.

Step 6: Screen for Red Flags and Fraud Patterns

Regulators have published the warning signs for years, and they have changed little. The SEC says guaranteed high returns, unsolicited offers, pressure to buy immediately and claims of little or no risk are all warnings. A joint SEC and CFTC alert adds complicated jargon paired with outsized-return promises, unlicensed sellers and fake identities. The SEC’s 2021 alert says not to rely solely on testimonials and to watch for fabricated returns, fake endorsements and recruitment-based promotion.

Smart contracts can dress up a fraud as innovation. In 2022 the SEC charged 11 individuals over Forsage, which it called a pyramid and Ponzi scheme that raised over $300 million through smart contracts on Ethereum, Tron and Binance blockchains. Being on-chain did not make it legitimate.

A fast red-flag screen:

• Promised or implied fixed returns
• Rewards for recruiting others
• Anonymous team with no track record and no stated reason for anonymity
• No public code, or an audit that is missing or unverifiable
• Missing supply and allocation data
• Pressure to act today or an unsolicited message
• Endorsements from accounts that also promote many unrelated tokens

If you have already lost funds to a scam, Cryptela has covered a service that helps victims pursue crypto scam recovery. Also consider reporting it to the SEC, the CFTC or the FBI’s Internet Crime Complaint Center if you are in the US.

Step 7: Compare Projects, Decide and Monitor

Findings only help if you can act on them. A scorecard turns notes into a decision. EY’s framework groups risk into six pillars: reputational and strategic, technical, financial, legal and compliance, cybersecurity, and auditability. You can adapt those pillars into a simple scale.

Treat any red-flag finding as a veto, not one more number to average. This follows the idea that due diligence looks for reasons not to proceed. A project with a strong team but opaque token allocation should not be rescued by a high team score.

When comparing two projects, use the same sources, the same date and the same scale. Write a one-paragraph summary of why you would or would not proceed, plus what would change your mind.

Monitor after you decide

Due diligence does not end at purchase. Set review triggers:

• Scheduled token unlocks and treasury movements
• New audits, protocol upgrades and governance proposals
• Changes in volume, liquidity depth or the number of trading venues
• Team departures or unexplained roadmap delays
• New regulatory actions in the jurisdictions that matter to you

Decide in advance how much you could lose without harm, and size any position accordingly. Volatility and the possibility of total loss are standard features of this market, as the IOSCO risk list above makes clear.

Researching DeFi Projects and Brand-New Tokens

New tokens have little history, so more weight falls on documents, code and token distribution. Check how the launch was structured, who got tokens first and at what price, and whether liquidity is locked or controlled by a single wallet. Review the contract on a block explorer for owner privileges such as minting or pausing transfers.

For DeFi, add three checks: which protocols it depends on, how its governance can change parameters, and what happens in a stress event with falling collateral prices. Funding news can add context. For example, Cryptela has reported on Web3 Foundation and Scytale’s seed investment in Hyperbridge. Investor backing is a data point, not a verdict, so run the same seven steps anyway.

Where Cryptela Fits in Your Research

Our market pages give you price, market cap and volume context for Step 5, and our editorial coverage gives you background on projects and audits. We also run paid placements. If you are a project that wants exposure, our advertising options include sponsored articles and press releases, and submitting an article costs 99 USD one-off. Sponsored and submitted content is not independent editorial coverage, so read it as the project’s own claims and put it through the same checklist.

Frequently Asked Questions

What is due diligence in simple terms?

It is the research you do before committing money, to confirm that what you are told is true and to find the risks. In crypto that means checking the team, token supply, code reviews, liquidity and warning signs for fraud.

How do I research a crypto project from scratch?

Begin with the white paper, roadmap and use of funds, then investigate the people behind it. Next review tokenomics, audits and liquidity, and screen for red flags. Record each finding with its date and source so you can compare projects.

Does a smart contract audit mean a project is safe?

No. Ethereum’s documentation says audits are not silver bullets and will not catch every bug or design error. Treat an audit as one input and check its date, scope and whether findings were fixed.

What are the biggest red flags in a new cryptocurrency?

Guaranteed returns, pressure to buy quickly, unsolicited offers, fake or missing team members, and rewards for recruiting others are the main ones regulators cite. Missing supply and allocation data is another.

Conclusion

Good crypto due diligence is repeatable, written down and skeptical. Work through purpose, team, tokenomics, security, liquidity and red flags, then score projects on the same scale and review them on a schedule. No process removes the risk of loss, and nothing here is personalized financial advice, so consider speaking with a licensed financial professional before making decisions about your own situation.

Sources

Recommended