Before investing in any crypto project, run it through this verification framework. A scam will fail multiple checks. A legitimate project will pass most of them.
Step 1: Verify the Team (10 minutes)
Goal: Confirm the team members are real people with verifiable identities.
What to check:
- LinkedIn profiles with history
- Previous crypto projects (successful or failed, but real)
- GitHub accounts with substantial code contributions
- Public appearances (conference talks, podcasts, YouTube interviews)
- Real names, not pseudonyms
Fake teams often:
- Use stock photos (check with Google Image Search)
- Have managers with no LinkedIn presence
- List “advisors” who don’t know they’re advising
Step 2: Check the Code (15 minutes)
Goal: Verify the project has real, functioning code.
What to check:
- GitHub organization with repositories
- Code commits from multiple developers over months
- Smart contract verified on the blockchain explorer
- Testnet or mainnet deployment
Warning signs:
- Private repository (can’t see the code)
- GitHub created last week with 2 commits
- Copied code from another project
- No smart contract address
Step 3: Verify the Audit (10 minutes)
Goal: Confirm the security audit exists and is legitimate.
What to check:
- Find the audit report on the auditor’s website (not the project’s site)
- Verify the contract address in the audit matches the deployed contract
- Check for “critical” findings that were not resolved
- Check the audit date (is it recent?)
Audit red flags:
- “Audit” by an unknown firm with no track record
- Audit report only on the project’s website (can be faked)
- No audit at all
- Audit was 18+ months ago with no follow-up
Step 4: Analyze Tokenomics (15 minutes)
Goal: Understand who holds the tokens and whether the distribution is fair.
Use: Bubblemaps, DexScreener, RugCheck, TokenSniffer
What to check:
- Holder distribution — Top 10 wallets should hold <30% of supply
- Liquidity lock — LP tokens should be locked for 6+ months
- Team allocation — Should be <20% with vesting over 12+ months
- Mint function — Can new tokens be created at any time?
- Tax mechanism — Buy/sell tax over 5% is a red flag
Step 5: Investigate the Community (10 minutes)
Goal: Determine if the community is organic or filled with bots.
What to check:
- Twitter account age (>6 months)
- Telegram/Discord member count vs. real engagement
- Are questions answered honestly, or are questions deleted?
- Is there real debate and criticism allowed?
Bot-filled communities:
- 50,000 Telegram members but 50 active speakers
- All positive messages, no criticism
- Bots like “price prediction” and “daily rewards” spam
Step 6: Check Listings (5 minutes)
Goal: Verify the project is tracked by reputable sources.
What to check:
- CoinGecko or CoinMarketCap listing (some vetting required)
- Listed on DEX aggregators (Jupiter, 1inch) or major exchanges
- Available on reputable tracking sites
Warning signs:
- Not listed on any major tracking site
- “Listed” on unknown exchange with no volume
- Volume of $10 but market cap of $10M
Quick Scam Score
| Check | Pass | Fail |
|---|---|---|
| Team with real identities | +3 | -3 |
| Public code on GitHub | +2 | -2 |
| Audit by top firm | +2 | -1 |
| Liquidity locked | +2 | -2 |
| No mint function | +1 | -2 |
| Organic community | +1 | -1 |
| Listed on CoinGecko | +1 | -1 |
| Top 10 holders <30% | +2 | -2 |
| Team tokens vested | +2 | -2 |
| Total | 16 | -16 |
Score interpretation:
- 10-16: Likely legitimate — proceed with standard risk management
- 5-9: Caution — high risk, small position only
- 0-4: Very high risk — avoid
- Negative: Almost certainly a scam
Verdict
This framework takes 60-90 minutes for a thorough check. If a project can’t pass basic checks on team, code, audit, tokenomics, and community, it’s not worth your money. The 90 minutes you spend verifying could save you thousands.
Related: How to Research a Crypto Project Before Investing | Rug Pulls Explained | Fake ICO and Presale Scams
Putting the checklist to work
The checks in this framework are only useful in combination, because any single result can mislead. A project with real code but an anonymous team may still be a honeypot; one with a famous auditor but a mint function left open may collapse anyway. What separates a legitimate project from a scam is that it passes most of the checks at once. Score each of the six areas and be honest about the result. A healthy score in the 10-16 range still means applying normal risk management — start small, diversify, never invest what you cannot afford to lose. A negative total is not a puzzle to solve or a hunt for a bargain; it is the answer, and the answer is to walk away. The 90 minutes you spend here saves you from one mistake that could cost years of savings.
What to avoid
The most common verification failures are not technical — they are short-cuts people take to avoid doing the work. Do not trust a project because it has a polished website; virtually every scam does. Do not rely on an audit link that lives only on the project’s own site, since that report can be fabricated or simply copied from another coin. Do not skip the community check, because a group of 50,000 members who will not tolerate a single critical question is not a community, it is a stage. And never abandon the discipline just because the coin is trending or the price is rising — that is precisely when novice buyers under-react to red flags. If a project blocks you for asking reasonable questions, that alone tells you everything you need to know.
Common questions
Q: What are the fastest signals a crypto project is a scam? A: An anonymous team, a code repository created last week with a handful of commits, no verifiable audit, top holders above 30% of supply, unlocked liquidity, and a community that deletes criticism. Any two or three of these together are enough to avoid the project entirely.
Q: Should I trust projects whose team members are pseudonymous? A: Some legitimate projects have tried pseudonymous foundations, but anonymity removes accountability and makes a rug pull easy to execute without consequence. For your purposes, treat anonymous teams as a major risk and demand far more evidence elsewhere: verified code, a credible audit with matching contract addresses, locked liquidity, and a verifiably organic community.
Q: What does ‘liquidity lock’ mean and why does it matter? A: It means the developers’ trading pair tokens are locked in a smart contract for a set period, commonly six months or more, so they cannot drain the pool and vanish. Unlocked liquidity is one of the clearest technical warning signs, since it lets the team pull all the money out at a moment’s notice — the defining move of a rug pull.
Q: Is the Quick Scam Score the final word? A: No, it is a decision aid, not proof. Use it to force yourself to assess each area rather than skipping straight to the exciting parts. A high score still needs standard risk management, and a low one should end the conversation — there are more than enough legitimate projects that you never need to gamble on a poor score.
Bottom line
Verifying a crypto project is a small, repeatable discipline that pays off exactly once for every scam it stops. Check the team as real, verified people; confirm the code is public, active, and matches the deployed contract; find the audit with the auditor rather than the project; look at tokenomics for concentration, locked liquidity, and a mint function; assess whether the community tolerates real questions; and see whether reputable sources list the token. When a project fails these checks, treat that as the finding it is. The money you risk in crypto should be going into things you have actually verified — because the costliest lesson in this space is the one taught by a rug pull.