How to Research a Crypto Project

Key Takeaways

Introduction: Why Most People Skip the Research

Every crypto cycle produces the same outcome for the same reason. A project launches, builds hype, attracts buyers, and then collapses when the founders exit, the token inflates beyond control, or the smart contract turns out to have a hidden backdoor. The investors left holding the bag almost always share one thing in common: they did not do real research before buying in.

"Do your own research" (DYOR) is widely quoted in crypto but rarely explained. This guide changes that. Below are 10 practical checkpoints you can run on any new crypto project before you commit any money. Each step links to free, publicly available tools.

Important: This article is educational. Nothing here constitutes financial advice. Completing this checklist does not guarantee a project is safe or profitable.

The 10-Point Due Diligence Framework at a Glance

1. Understand What the Project Actually Does

Start with the simplest question: what problem does this project solve, and who is it built for? A credible project should be able to answer this in one or two plain sentences. If the website is full of vague statements like "revolutionizing the financial future" without explaining a specific use case, that is your first yellow flag.

Visit the official project website. Read the homepage summary. Look for a clear explanation of the product or protocol, the problem it solves, and who the target users are. Then ask yourself: is this a real problem, and does this project offer a meaningfully better solution than what already exists?

What to look for:

• A specific and real use case

• A named existing problem being solved

• A user base that makes sense (developers, traders, institutions, etc.)

• Professional, clearly written content, not just pitch language

2. Read the Whitepaper

The whitepaper is the project's technical and strategic blueprint. It should explain how the technology works, what the token does, how it will be governed, and what the long-term roadmap looks like. A missing whitepaper, or one full of copied text, buzzwords, and no technical detail, is a serious warning sign.

Key sections to evaluate:

• Problem and solution: Is the problem clearly defined and the solution realistic?

• Technology: Does the team explain their technical approach, or do they hand-wave it with jargon?

• Tokenomics: How is the token used within the protocol? Is it necessary, or is it just for fundraising?

• Roadmap: Are milestones dated? Can you verify which ones have already been achieved?

• Team section: Are names and credentials listed? Can you verify them elsewhere?

Whitepapers are not legally verified documents. During the 2017 ICO wave, many projects made impressive claims and failed to deliver. Treat the whitepaper as a starting point for questions, not a guarantee of anything.

3. Verify the Team

The people behind a project are among its most important signals. A team with real, verifiable identities and relevant experience gives you something concrete to evaluate. Anonymous teams are not automatically fraudulent, but they do remove a layer of accountability.

How to verify a team:

• Search each named founder on LinkedIn. Check for employment history, connections, and whether their work history appears credible.

• Look up their GitHub profiles. Do they have real commit histories, public repos, and contributions to prior projects?

• Search their names alongside the phrase "crypto scam" or "rug pull" to check for prior incidents.

• If a team claims notable advisors, verify those advisors have actually endorsed the project publicly, not just allowed their names to be listed.

4. Check GitHub Activity

If a project claims to be building software, you should be able to see that work happening. GitHub is the standard place where open-source blockchain projects publish their code.

What to look for on GitHub:

• Recent commits. If the last code update was six or more months ago on a project claiming active development, that is a gap worth noting.

• Number of contributors. A single developer working alone on a major protocol is a concentration risk.

• Stars and forks. These are rough indicators of developer community interest.

• Open vs. closed issues. A healthy project actively responds to issues and pull requests.

A private or empty GitHub repository for a project claiming to be open-source is a significant red flag. Legitimate projects that handle user funds should have publicly reviewable code.

5. Analyze the Tokenomics

Tokenomics refers to the economic design of a project's token: how many exist, who holds them, how they are distributed, and what they are used for. Poorly designed tokenomics can undermine a project regardless of how good the underlying technology is.

A well-structured tokenomics model should show that the team's tokens are locked with a vesting schedule, with at minimum a 6-month cliff and a linear release period of 12 to 24 months. If team members can sell all their tokens at launch, the incentive structure is misaligned.

6. Review Token Unlock Schedules

Token unlock events are scheduled dates when previously locked tokens become available for sale. Large unlock events can create significant sell pressure on the open market, even for otherwise healthy projects. Knowing when unlocks are coming is basic due diligence.

Tools to use:

• DefiLlama Unlocks (defillama.com/unlocks): One of the most comprehensive free dashboards for tracking upcoming token release schedules across hundreds of projects.

• CryptoRank: Provides vesting schedule data and upcoming unlock calendars with estimated dollar values.

• Token Terminal: Shows protocol revenue alongside token supply data for context.

A large unlock event, for example, when early investors have 20% of the total supply vesting at a single date, can drive significant price drops. Knowing these dates in advance helps you understand the supply-side dynamics of a token.

7. Inspect On-Chain Data Using a Block Explorer

Block explorers let you read blockchain data directly, without relying on anything the project itself tells you. This is where you go to verify wallet distributions, contract activity, and transaction history.

What to look for on-chain:

• Check the top token holders. If five or fewer wallets control more than 50% of the supply, that is a concentration risk.

• Verify that the smart contract is published and verified on the explorer. Unverified contracts cannot be independently reviewed.

• Look at transaction history. Does the activity look organic, or is the same cluster of wallets transacting repeatedly with each other?

8. Check Smart Contract Audits

A smart contract audit is an independent security review of a project's code, conducted by a specialized firm. Audits check for vulnerabilities, backdoors, and logic errors that could allow funds to be stolen or the contract to be manipulated.

According to data reported by TokenMetrics in 2025, approximately 87% of rug-pull projects had no publicly available audit. Audits are not a guarantee of safety, but the absence of one on a project handling user funds is a meaningful warning sign.

Well-known audit firms:

• CertiK

• Trail of Bits

• OpenZeppelin

• ConsenSys Diligence

• Halborn

9. Use DefiLlama to Assess Protocol Health

DefiLlama (defillama.com) is one of the most widely used free tools for researching DeFi protocols. It aggregates on-chain data from thousands of protocols across hundreds of blockchains. Unlike project-reported numbers, DefiLlama collects data directly from smart contracts.

Key metrics available on DefiLlama:

• Total Value Locked (TVL): The total amount of assets deposited in the protocol. A rising TVL generally indicates user trust and growing usage.

• Protocol Revenue and Fees: Does the protocol generate real revenue? Or is it entirely dependent on token emissions to attract users?

• Unlocks Dashboard: Tracks upcoming token release events across major projects.

• Raises: Shows funding rounds and which investors backed the project.

• Stablecoins and Bridges: Useful for evaluating cross-chain exposure and associated risks.

As of early 2025, DefiLlama tracked over 5,000 protocols across more than 300 chains. It is free to use and does not require an account for most data.

10. Review Community Health and Governance

A project's community and governance structure tell you how it makes decisions and whether it has genuine user engagement. Inflated follower counts and bot-driven activity are common in crypto, so approach community metrics with skepticism.

What to check:

• Discord and Telegram: Is there real discussion happening? Are questions being answered by the team? A large member count with no real conversation is a warning sign.

• Twitter/X: Look at engagement rates, not follower counts. A project with 100,000 followers and 3 likes per post is likely using fake followers.

• Snapshot.org or on-chain governance: Does the project have working governance? Have proposals been voted on? Token holders should have a meaningful say in protocol decisions.

• Reddit: Search the project name to find organic discussions outside the project's own channels.

Real community health shows up in the quality of debate, not the size of the audience. Look for users asking tough technical questions and for the team responding with substance.

Common Red Flags Summary

The Full DYOR Checklist

Use this checklist before evaluating any new crypto project:

1. Visit the official website and confirm a clear, specific use case

2. Read the whitepaper, focusing on tokenomics, technology, and team

3. Verify all named team members on LinkedIn and GitHub

4. Review GitHub for recent commits and contributor activity

5. Analyze token distribution and check vesting schedules

6. Look up upcoming token unlocks on DefiLlama or CryptoRank

7. Use a block explorer to check wallet distribution and contract verification

8. Find and read the security audit report from the auditor's own website

9. Check TVL, revenue, and fees on DefiLlama

10. Review community quality on Discord, Twitter/X, and governance forums

Frequently Asked Questions (FAQ)

What does DYOR mean in crypto?

DYOR stands for "Do Your Own Research." In crypto, it refers to the practice of independently researching a project before putting money into it, rather than relying on social media recommendations, influencer promotions, or price hype.

How long should due diligence take for a new crypto project?

For a small amount of money, a one-to-two hour review covering the main checkpoints above is a reasonable starting point. For larger amounts or more complex DeFi protocols, dedicate 10 to 20 hours across multiple sessions to avoid confirmation bias and surface-level conclusions.

What is a smart contract audit and why does it matter?

A smart contract audit is a review of a project's code by an independent security firm. Auditors look for bugs, backdoors, and vulnerabilities that could allow funds to be stolen or the protocol to be exploited. Audits are not a guarantee of safety, but unaudited contracts managing user funds carry significantly higher risk.

Is DefiLlama free to use?

Yes. DefiLlama provides free access to TVL data, protocol comparisons, revenue and fee metrics, token unlock calendars, and more. Most data does not require an account. It is one of the most trusted free tools available for DeFi research.

What is a token unlock and why should I care?

A token unlock is a scheduled release of previously locked tokens, often belonging to early investors or the founding team. Large unlock events introduce new supply into the market, which can create downward price pressure. Checking upcoming unlocks before entering a position helps you understand when that supply-side risk is most concentrated.

Can a project pass every check and still fail?

Yes. Due diligence reduces risk but cannot eliminate it. Smart projects can still fail due to market conditions, poor product-market fit, regulatory changes, technical failures, or competitive pressure. The goal of this framework is to filter out the most obvious risks, not to predict outcomes.

What is the difference between a rug pull and a failed project?

A rug pull is an intentional exit scam where the developers deliberately drain funds or abandon the project with user money. A failed project is one that ran out of money, lost users, or could not execute its roadmap without malicious intent. The red flags for rug pulls are more specific: no audits, anonymous teams with no history, concentrated token supply, and locked or honeypotted selling mechanics.

Disclaimer: This content is for educational and informational purposes only and is not financial advice. Nothing here is a recommendation to buy or sell any asset or use any platform. Do your own research and manage your risk.

Read More

AI + Crypto Convergence in 2026: What It Means for Web3 Developers and Users

AI Meets DAOs: How Artificial Intelligence Is Changing On-Chain Governance in 2026

The Phishing Defense Stack: Browser Extensions, Hardware Confirmations, and Sender Verification in 2026

Real-World Asset Tokenization Hits $31 Billion: What It Means for On-Chain Finance