Researching a cryptocurrency means checking what a price chart cannot show: how many tokens will exist and when they arrive, who holds them, who can change the code and whether anyone actually uses the network. Most of the evidence is public, in project documents and on the blockchain itself. This guide sets out eight checks, a red-flag table and a worked example on a made-up token; it does not rate any real coin. The crypto hub covers the basics, the crypto price dashboard lists live prices, and what is bitcoin shows how one long-running network is designed.
How do you research a cryptocurrency?
Work through the same eight checks for every token, starting with supply and ending with legal status, and write down what each one shows.
Eight due-diligence checks for any token
- Supply and emissions. Maximum and circulating supply, and how fast mining, staking rewards or open-ended inflation add new tokens.
- Vesting schedule. When tokens held back for the team, investors and treasury become transferable, and how many arrive on each date.
- Insiders' allocation. The share held by founders, early investors and the foundation, and how concentrated the largest wallets are.
- Team and governance. Who builds the project, who can upgrade or pause its contracts, and whether changes face a delay or a vote.
- Audits and bug bounties. What code was audited, when and with what scope, which findings were fixed, and how the bounty compares with the money at risk.
- Liquidity and exchange listings. How much can trade without moving the price, in which pools and order books, and on how many venues.
- On-chain activity. Fees, transactions and active addresses from real users, counted separately from paid incentives.
- Legal status. Whether the token, or the way it is sold, could fall under US securities law, and what the issuer has promised buyers.
What is the difference between market cap and fully diluted value?
Market cap prices only the tokens already circulating, while fully diluted value prices the maximum supply that can ever exist, at the same price.
Market cap = price × circulating supply; fully diluted value = price × maximum supply
The gap between the two is supply still to come. Bitcoin's maximum is fixed at just under 21 million BTC (20,999,999.9769 BTC), and about 95.7% of that already exists, so its two figures are close. Many newer tokens launch with a fifth or less of their supply circulating, and some have no maximum at all, in which case fully diluted value cannot be calculated and the yearly inflation rate tells you more. Staking rewards and mining also create tokens, paid to whoever secures the network, and what is staking explains how those rewards dilute holders who sit out.
How do vesting schedules affect a token's supply?
Vesting schedules decide when tokens held back for insiders and the treasury become free to trade, so they set how fast circulating supply grows.
A typical schedule starts with a cliff, a date before which nothing is released, followed by monthly or daily releases over two to four years. The terms appear in project documents and, more reliably, in the vesting contracts themselves, which a block explorer can display. Releases matter because people paid in tokens often sell some to cover costs or taxes.
Keyrock, a crypto market maker, studied more than 16,000 release events in its report From Locked to Liquidity. About 90% put downward pressure on prices, often starting around 30 days before the release date. Releases to team members did the most damage, with price effects of roughly −25%, while releases to ecosystem funds were followed by an average gain of 1.18%.
Who holds the tokens, and who controls the project?
Check how much of the supply sits with founders, early investors and the foundation, and who holds the keys that can upgrade, pause or drain the contracts.
Allocation tables in project documents show the split at launch, and a block explorer's holder list shows where tokens sit now. Exchange and contract addresses can make concentration look worse than it is, but a handful of unlabeled wallets holding most of the float means a few sellers could swamp the market. Control matters as much as ownership. Many contracts have an admin key that can change their code; a multisig needs several keyholders to sign, and a timelock delays changes for days so users can see them coming. A 2-of-3 multisig with no timelock lets two people rewrite the rules immediately.
Promotion is worth a look too. In October 2022 the SEC charged Kim Kardashian over a June 2021 Instagram post promoting the EMAX token, for not disclosing the $250,000 she was paid for it, and she settled for $1.26 million. Anyone paid to promote a security must disclose the payment, so heavy celebrity or influencer promotion is a reason to ask who is paying.
What do audits and bug bounties actually cover?
An audit covers only the code, version and scope a firm was hired to review, and a bug bounty pays outsiders who report flaws before attackers find them.
Read the report itself rather than the badge on the website. It lists the version reviewed, the contracts in scope, each finding by severity and whether it was fixed. Code deployed later, and contracts left out of scope, are not covered.
Balancer v2, a decentralized exchange protocol, lost more than $120 million on November 3, 2025, when an attacker exploited rounding in the math behind some of its pools. OpenZeppelin said the vulnerable pools were outside the scope of its audit. Trail of Bits said it had flagged a related rounding issue, of undetermined severity, in an October 2021 review of other Balancer pools, and that the stable-pool math was out of scope in a September 2022 review. Several audits still left the failing code unreviewed.
A bounty deters attackers only if it is large next to what they could take: a $50,000 maximum reward on a contract holding $30 million is 0.17% of the funds at risk.
How do you check liquidity and exchange listings?
Look at how much money sits in the token's trading pools and order books, because that, not the quoted price, decides what a sale actually returns.
On a centralized exchange, liquidity is the depth of the order book: the bids and offers waiting near the current price. On a decentralized exchange it is the tokens deposited in a pool. Uniswap-style pools follow the rule x × y = k, where the product of the two balances stays constant, so every sale pushes the price down along a curve. CEX vs DEX compares the two kinds of venue.
Worked example: Selling 100,000 tokens into a $400,000 pool
A pool holds 400,000 tokens and $200,000 of a dollar stablecoin, so the quoted price is $0.50. Assume a 0.3% trading fee; pools charge different rates.
- The constant: 400,000 × $200,000 = 80,000,000,000.
- After the fee, only 99,700 of the 100,000 tokens count toward the pricing math: 400,000 + 99,700 = 499,700.
- Stablecoins left in the pool: 80,000,000,000 ÷ 499,700 = $160,096.06.
- The seller receives $200,000 − $160,096.06 = $39,903.94, an average of $0.399 a token, 20.2% below the quoted price.
- The fee tokens stay in the pool, which now holds 500,000 tokens against $160,096.06, a price of about $0.32, roughly 36% below the starting quote.
On paper the 100,000 tokens were worth $50,000. The pool paid about $39,904.
A listing on a large exchange means the token met that exchange's own criteria, not that a regulator approved it. Count the venues and note whether most of the volume sits on one little-known platform. Pools can also vanish: if the team supplied a pool and kept control of its liquidity tokens, it can withdraw the money and leave holders with nowhere to sell, the move known as a rug pull.
What on-chain activity should you look for?
Look for fees paid by real users, because transactions and addresses are easy to inflate with rewards, airdrop farming and bots.
Block explorers and analytics dashboards show daily transactions, active addresses, fees and, for lending and trading protocols, the value deposited. Each can be gamed: one person can control thousands of addresses, and incentive programs pay people to deposit money that leaves when the rewards stop. Fees are harder to fake because someone has to pay them. A network that pays out more in token rewards than its users pay in fees is buying its activity. What is DeFi explains deposit measures such as total value locked, and how blockchain works explains what a block explorer is showing.
How can US securities law apply to a token?
A token can fall under federal securities law either because it is a security itself or because it is sold as part of an investment contract.
The SEC's interpretive release that took effect on March 23, 2026, which the CFTC joined, sorts crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. Its examples of digital commodities include bitcoin, ether, solana, XRP, ada and dogecoin, and digital commodities, collectibles and tools are not securities in themselves. Such a token is still sold subject to an investment contract when the issuer offers it with representations or promises to carry out essential managerial efforts from which buyers would reasonably expect profits. Those promises can appear in a whitepaper, on a website, on official social-media accounts or in sale agreements.
For research, that means reading what the team has promised, such as exchange listings, buybacks or a roadmap, because promises of profit from the team's work are what the law examines. Payment stablecoins sit under a separate law, covered in stablecoin regulation under the GENIUS Act. Congress has not finished a broader market-structure law, and US crypto regulation tracks the agencies and bills.
What red flags should you watch for?
The clearest warning signs are promised returns, hidden or concentrated control, supply arriving faster than buyers, and pressure to act before checking anything.
| Red flag | Why it matters | Where to check |
|---|---|---|
| Promised or fixed returns | Returns on a volatile token cannot honestly be fixed, and issuer profit promises draw securities law in | Website, whitepaper, sale terms |
| Under a fifth of maximum supply circulating | Each release still to come adds potential sellers | Token documents, vesting contracts |
| Large team or investor releases within months | Team releases had the worst price effects in Keyrock's study | Vesting contracts, release trackers |
| A few unlabeled wallets holding most of the float | A handful of sellers could swamp a thin market or control votes | Block explorer holder list |
| Admin keys with one person, or a small multisig with no timelock | Contracts can change or funds can move without warning | Contract code, governance documents |
| No audit, an old audit, or one that skips the contracts holding funds | Unreviewed code is where exploits happen | The audit report's scope section |
| Team-supplied liquidity the team can withdraw | Pulling the pool leaves holders unable to sell | DEX pool page, liquidity token holders |
| Volume far larger than visible liquidity | A common sign of wash trading | Order books, pool data |
| Paid promotion with no disclosure | Promoters may be paid to sell to their audience | Posts, SEC enforcement actions |
| Pressure to buy fast, or a contract that blocks selling | Tactics of pump-and-dump and honeypot schemes | Contract code, independent token scanners |
Fraud tied to crypto is large and growing: complaints to the FBI's Internet Crime Complaint Center with a crypto link reported $11.37 billion lost across 181,565 complaints in 2025, a 22% rise in losses from 2024. The crypto scams guide covers the schemes behind those losses.
How does the checklist apply to an example token?
Applied to a made-up token, the checks show a $90 million market cap sitting under a $500 million fully diluted value and a year of heavy scheduled releases.
Token A launched 10 months ago with a maximum supply of 1 billion and trades at $0.50. Its 180 million circulating tokens are the full 120 million airdrop, 50 million lent to market makers and pools, and 10 million the treasury has spent on grants.
| Allocation | Share | Tokens | Release terms |
|---|---|---|---|
| Team | 20% | 200 million | 25% at a 12-month cliff, the rest monthly over 36 months |
| Early investors | 18% | 180 million | 25% at the 12-month cliff, the rest monthly over 24 months |
| Treasury | 25% | 250 million | 10 million spent; 4 million a month from next month |
| Staking rewards | 15% | 150 million | 2.5 million a month from next month |
| Airdrop | 12% | 120 million | Fully circulating |
| Liquidity | 10% | 100 million | 50 million in use; 50 million held by the team |
Worked example: Token A's supply over the next 12 months
- Market cap: 180 million × $0.50 = $90 million. Fully diluted value: 1 billion × $0.50 = $500 million. Ratio: 0.18.
- Team: 25% of 200 million = 50 million at the cliff in two months, then 150 million ÷ 36 ≈ 4.17 million a month for 10 months ≈ 41.67 million. Total ≈ 91.67 million.
- Investors: 25% of 180 million = 45 million at the cliff, then 135 million ÷ 24 = 5.625 million a month for 10 months = 56.25 million. Total 101.25 million.
- Treasury: 4 million × 12 = 48 million. Staking rewards: 2.5 million × 12 = 30 million.
- New supply: about 270.92 million tokens, worth $135.5 million at $0.50. Circulating supply grows from 180 million to about 450.92 million, a 150.5% increase.
- For the market cap to stay at $90 million, the price would have to fall to $90 million ÷ 450.92 million ≈ $0.1996, down 60.1%. Holding $0.50 would need buyers for $135.5 million of new tokens.
- Cliff day alone adds 95 million tokens, 52.8% of today's float, worth $47.5 million, or about 20 days of the token's $2.4 million average daily volume.
None of this is a forecast. Demand could grow, and insiders may hold rather than sell; the arithmetic shows how much new buying the price needs just to stand still.
The other checks complete the picture:
| Check | What the example shows | Reading |
|---|---|---|
| Insiders' allocation | Team, investors and treasury hold 63% of supply | Concentrated |
| Team and governance | A 2-of-3 multisig controls the contracts, with no timelock | Two people can change the rules at once |
| Audits and bug bounties | Token contract audited; the staking contract holding $30 million is not; $50,000 bounty | The largest pot of money is unreviewed |
| Liquidity and listings | The $400,000 pool from the example above, plus two offshore exchanges reporting most of the $2.4 million daily volume | Volume six times the pool's size |
| On-chain activity | About $4,000 a day in fees, or $1.46 million a year, against $15 million a year in staking rewards | Activity largely paid for |
| Legal status | The sale page promised exchange listings and treasury buybacks | Profit promises tied to the team's efforts |
Almost every row lands in the red-flag table. Writing the results down makes it harder to wave away a failed check because the chart looks strong.
What are the risks of relying on your own research?
Research narrows the unknowns but cannot remove them, and a carefully checked token can still lose most or all of its value.
- Information gaps. Documents can be incomplete or out of date, and teams can change vesting terms, contracts or plans after you have read them.
- Manufactured signals. Volume, holder counts, follower numbers and audit badges can all be faked or bought.
- Code risk. Audited, long-running protocols have still been exploited, and new attack methods keep appearing.
- Market risk. Crypto prices are volatile across the board; even bitcoin, the largest, fell 76.7% from its November 2021 record close to its November 2022 low.
- Rule changes. The SEC's 2026 interpretation can be revised, and a token's legal treatment can turn on how it is sold.
- Confirmation bias. Research done after buying tends to hunt for reasons to hold; checks written down beforehand are harder to explain away.
How much of a portfolio any one token should take is a separate question, covered in how much crypto to own, and how to read crypto charts covers the price side of the picture.