The DYOR Checklist: 15 Questions to Ask Before Buying Any Cryptocurrency

An estimated $17 billion was lost to crypto scams and fraud in 2025. Most of those losses shared the same root cause: the buyer did not ask the right questions first. This is the checklist that fixes that.

DYOR is the most repeated advice in crypto and the most frequently ignored. "Do your own research" sounds simple enough, but when you sit down to actually evaluate a project, the question becomes: research what, exactly? And in what order?

The problem is not a lack of information. It is a lack of structure. There are thousands of articles, tools, forums, and opinions available for any given project. Without a systematic way to sort through them, most people either skip the research entirely or get overwhelmed and make decisions based on sentiment instead of evidence. The consequences are measurable. According to Chainalysis's 2026 Crypto Crime Report, crypto scam losses reached an estimated $17 billion in 2025, with AI-enabled scams proving 4.5 times more profitable than traditional methods. Impersonation attacks alone grew by 1,400% year over year. These numbers reflect a gap not in technology but in preparation. The people targeted were not reckless. They simply did not have a framework for evaluating what was being presented to them.

This checklist gives you that framework. It is organized into 15 questions across five categories, each ranked by priority. Work through them in order, and by the end you will have a clear, evidence-based picture of whether a project deserves your attention or your skepticism. For readers familiar with the most common crypto mistakes beginners make, several of these questions directly address the evaluation failures behind those errors.

How to Use This Checklist

Each of the 15 questions is tagged with a priority level. Questions marked Critical address the factors most likely to determine whether a project is legitimate, viable, and worth your time. Questions marked Important add depth and context to your evaluation. Questions marked Supporting help round out your picture, particularly for projects that pass the first two tiers.

A note on timing: a thorough first pass through all 15 questions typically takes two to three hours per project. That investment pays for itself many times over if it prevents even one bad allocation.

Project Fundamentals (Questions 1 through 4) - Critical Priority

These four questions establish whether the project has a reason to exist and a credible plan to deliver on its claims. If any of these return clearly negative answers, the rest of the checklist becomes irrelevant.

Q1: What specific problem does this project solve, and who needs the solution?

Start with the project's website and documentation. Can you identify in one sentence what problem it addresses? A strong project defines a specific, verifiable problem and a target user. Projects that describe vague ambitions ("redefining the future of finance") without identifying a concrete use case are often built around a narrative rather than a need. Check whether the problem exists independently of crypto. If removing the blockchain component would make the product work just as well (or better), the token may exist primarily as a fundraising mechanism, not as a core part of the solution.

Strong signal: The project addresses a measurable problem and you can identify real users who would benefit. Red flag: Buzzword-heavy descriptions with no clear explanation of who the product serves or what it replaces.

Q2: Is there a working product, or just a whitepaper and promises?

Look for something you can use: an app, a protocol with on-chain activity, a testnet with real users, or at minimum a functional demo. Projects that have been active for a year or more with nothing beyond a whitepaper and a roadmap deserve significant skepticism. Many collapsed or fraudulent schemes never had a functioning product behind their marketing. Treat the presence of a working product as a basic filter. Check blockchain explorers and protocol analytics platforms for verifiable transaction volume and user activity.

Strong signal: A live product with verifiable users and on-chain activity. Red flag: Years of development time with no usable product, only future promises.

Q3: Does the whitepaper explain the mechanism clearly and honestly?

The whitepaper should explain what the project does, how the technology works, and how the token fits into the system. A good whitepaper balances technical depth with accessibility. It should not require a PhD to understand, but it should not read like a sales brochure either. Look for specifics: how does the consensus work, what is the transaction flow, what are the smart contract functions? Vague claims, unverifiable benchmarks, and excessive emphasis on price potential rather than utility are warning signs. For a deeper guide to evaluating whitepapers specifically, see Blockready's framework for reading and evaluating crypto whitepapers.

Strong signal: A detailed, honest whitepaper with clear explanations of trade-offs and limitations. Red flag: Missing whitepaper, plagiarized content, or a document that reads more like advertising than documentation.

Q4: What does the roadmap show, and has the team hit previous milestones?

A credible roadmap has time-bound milestones that you can verify against the project's history. Check whether previous targets were met on schedule. Consistent delivery on stated goals is one of the strongest signals of operational competence. Roadmaps that promise everything without specifics, or that keep shifting timelines without explanation, suggest poor planning or a lack of accountability.

Strong signal: Verifiable milestone history with realistic future targets. Red flag: Vague timelines, repeatedly missed deadlines, or no visible roadmap at all.

Team and Leadership (Questions 5 through 6) - Critical Priority

Q5: Who is building this, and can you verify their track record?

Identify the founders, lead developers, and core team members. Search for them on LinkedIn, GitHub, and professional networks. Do they have verifiable experience in blockchain, software engineering, finance, or the specific domain the project targets? A team with a track record of shipping products and staying through difficult market conditions is far more likely to deliver than a team with impressive titles but no verifiable history. Anonymous teams are not inherently disqualifying (Bitcoin itself had an anonymous founder), but anonymity combined with a request for your money should dramatically increase your scrutiny.

Strong signal: Named, verifiable team members with relevant professional backgrounds and previous project experience. Red flag: Completely anonymous teams, fabricated credentials, or team pages that list only first names and stock photos.

Q6: Is the team transparent, communicative, and accountable?

Check the project's GitHub repository for commit frequency and contributor activity. Look at community channels (Discord, Telegram, Twitter/X) for how the team responds to questions, especially critical ones. Teams that engage openly with concerns, provide regular development updates, and acknowledge challenges openly tend to build more resilient projects. Silence, deflection of criticism, or a pattern of overpromising followed by underdelivering are serious warning signs.

Strong signal: Active GitHub with multiple contributors, regular public updates, and honest engagement with community questions. Red flag: Inactive repositories, no development updates, or aggressive dismissal of legitimate criticism.

Tokenomics and Supply (Questions 7 through 9) - Critical Priority

Tokenomics determines whether the economic design of a project works in favor of holders or against them. Even a legitimate project with a strong team can have token structures that dilute your holdings or create overwhelming sell pressure over time. Supply data, allocation breakdowns, and unlock schedules are typically available in the project's documentation and on major data aggregator platforms.

Q7: How does the token supply work, and what creates scarcity or inflation?

Determine whether the token has a fixed maximum supply (like Bitcoin's 21 million cap) or an inflationary design where new tokens are continuously created. Check the circulating supply against the total supply. If only a small fraction of tokens are currently in circulation and the rest are locked, understand that supply will increase over time and may create downward price pressure. Look for deflationary mechanisms (token burns, buyback programs) and evaluate whether they are meaningful relative to new issuance. A project with 5% of tokens circulating and 95% locked for insiders should be approached with extreme caution.

Strong signal: Clearly documented supply mechanics with a balance between circulating and locked tokens. Red flag: Tiny circulating supply with massive insider allocations, or no clear documentation of supply structure.

Q8: Who holds the tokens, and when do locked tokens unlock?

Examine the allocation breakdown: what percentage goes to the founding team, early investors, the treasury, and the community? Then check the vesting schedule. When do insider tokens unlock? Large cliff unlocks (where a significant percentage of tokens become tradeable on a single date) often create sell pressure that retail holders cannot absorb. Multi-year vesting with gradual release is generally healthier for long-term price stability. Visualizing token holder concentration across wallet addresses can also reveal whether a small number of wallets control the majority of supply.

Strong signal: Multi-year vesting for team and investor tokens with reasonable community allocation. Red flag: Most tokens held by insiders with large unlocks scheduled in the first year or two.

Q9: What drives demand for this token beyond speculation?

Ask whether the token has a functional role in the project's ecosystem. Strong utility tokens are required for specific actions: paying network fees, participating in governance votes, staking for security, or accessing platform features. If the project could operate identically using a stablecoin or no token at all, the token likely exists primarily for fundraising purposes. Governance utility (voting rights), payment utility (transaction fees), and security utility (staking) are the most durable demand drivers.

Strong signal: The token has clear, necessary functions within the ecosystem that create ongoing demand. Red flag: The token could be replaced by any other payment method without affecting how the product works.

Technology and Security (Questions 10 through 11) - Important Priority

Q10: Has the code been audited, and are the results public?

Check whether the project's smart contracts and core code have been reviewed by independent security auditors. Reputable audit firms include Certik, Trail of Bits, OpenZeppelin, and Halborn. A clean audit from a recognized firm is a meaningful positive signal, though it does not guarantee safety (the audited code must match what is deployed, and audits have scope limitations). Projects that refuse to publish audit results or have no audit history should be treated with additional caution. Check the project's documentation and official channels for published audit reports.

Strong signal: Published audits from recognized firms with issues resolved. Red flag: No audits, refused disclosure, or audits completed by unknown entities.

Q11: What consensus mechanism secures the network, and what are its trade-offs?

For Layer 1 blockchains, understand whether the network uses Proof of Work, Proof of Stake, or another consensus model. Each has different security properties, energy requirements, and decentralization characteristics. For tokens built on existing chains (like Ethereum), the relevant question is which chain they are deployed on and whether its security properties are adequate for what the project promises. The Bybit breach in February 2025 demonstrated that even centralized platform security can be compromised through supply chain attacks on signing infrastructure. Understanding the security model behind a project helps you gauge the risks you are accepting.

Strong signal: Well-documented security model with a proven track record. Red flag: Custom consensus mechanisms with no track record, or no documentation of the security model at all.

Market, Community, and Regulation (Questions 12 through 14) - Important to Supporting Priority

Q12: What does the competitive landscape look like, and what is this project's edge?

Identify the project's closest competitors. What does this project do differently, and is that difference meaningful? A project entering a crowded category (another DEX, another lending protocol, another Layer 1) needs a compelling reason to win users from established alternatives. Check comparative metrics: total value locked, daily active users, and transaction volume relative to competitors. Understanding how crypto exchanges work and where they differ can also help you evaluate whether an exchange-related project has a genuine competitive advantage.

Strong signal: A clear, defensible advantage over existing competitors with data to support it. Red flag: No visible differentiation, or claims of superiority with no verifiable metrics.

Q13: Is the community real and engaged, or manufactured?

Community size alone means nothing. Millions of followers can be purchased. What matters is the quality of engagement. Look at Discord and Telegram channels for substantive conversations: are members discussing the product, governance proposals, and technical developments? Or is the conversation dominated by price speculation and promotional giveaways? Check GitHub for community contributions and governance forums for participation in proposals. A project with 50,000 followers and no substantive discussion is weaker than a project with 5,000 followers having detailed technical conversations.

Strong signal: Active, substantive community discussions about the project's technology and direction. Red flag: Bot-inflated follower counts, no genuine engagement, or communities focused exclusively on price and airdrops.

Q14: How does the current regulatory environment affect this project?

Regulation has moved from theoretical risk to operational reality. In March 2026, the SEC and CFTC jointly classified 16 crypto assets as digital commodities, creating a clearer framework for which tokens fall under which regulator. Check whether the project's token has been classified as a commodity or could be considered a security. Projects that may qualify as unregistered securities face enforcement risk. Also consider whether the project complies with relevant regulations in the jurisdictions where it operates, including AML/KYC requirements. A project's ability to adapt to regulatory changes is itself a strong indicator of long-term viability.

Strong signal: Clear understanding of regulatory position, compliance infrastructure in place, and proactive engagement with evolving frameworks. Red flag: No awareness of regulatory requirements, operation in jurisdictions with no compliance framework, or active avoidance of regulatory scrutiny.

The Decision Question (Question 15) - Supporting Priority

Q15: Based on everything above, does the risk profile match your situation?

This final question is not about the project. It is about you. Even a project that passes every critical question may not be appropriate for your financial situation, risk tolerance, or time horizon. Consider how much of your portfolio this allocation would represent. Consider what would happen if the project failed entirely and you lost the full amount. Consider whether you understand the project well enough to hold through volatility without panic selling. If you cannot explain to someone else why you believe in this project, you have not completed your research.

What This Checklist Cannot Do

No evaluation framework eliminates risk entirely. A project can pass every question on this list and still fail due to market conditions, regulatory changes, or unforeseen technical vulnerabilities. What this checklist does is shift your decision-making from emotional (reacting to hype, fear of missing out, or social pressure) to evidence-based (evaluating verifiable information against consistent criteria). That shift alone puts you ahead of the vast majority of participants in the crypto market.

The 15 questions here are a practical starting point. They are derived from a more comprehensive system: Blockready's DYOR Analysis framework covers eight evaluation categories with over 60 individual criteria, each ranked by importance. If you find yourself consistently using this checklist and wanting to go deeper on tokenomics evaluation, on-chain indicators, or legal due diligence, that system is designed as the next step. For more on how to protect your assets after you have made an investment decision, wallet security is the natural continuation of the DYOR process.

Frequently Asked Questions

How long should it take to DYOR on a crypto project?

A thorough first pass through all 15 questions typically takes two to three hours per project. Projects with extensive documentation and transparent teams will be faster to evaluate. Projects with limited information or complex tokenomics may take longer. The time investment is a feature, not a cost. If a project cannot withstand a few hours of scrutiny, that itself is an answer.

What if a project passes most questions but fails one or two critical ones?

It depends on which questions failed and how severely. A project with a strong team, working product, and clear utility but a concerning vesting schedule (Q8) is a different situation than a project with no whitepaper (Q3) or no verifiable team (Q5). Use the decision framework in Q15: one or two critical flags may warrant a smaller position size with active monitoring, while three or more critical flags suggest walking away.

Is DYOR a one-time process or should I re-evaluate over time?

Re-evaluation is essential. Project fundamentals change: teams depart, roadmaps shift, token unlocks approach, competitors launch, and regulatory environments evolve. Plan to revisit the critical-priority questions at least quarterly for any project in your portfolio, and immediately after major events like team departures, security incidents, or regulatory announcements.

Can I use this checklist for meme coins or tokens with no utility?

You can apply the framework, but most meme coins will fail the critical-priority questions by design (no use case in Q1, no working product in Q2, no utility in Q9). That does not mean you cannot buy them, but it means you should do so with full awareness that the evaluation framework has identified high risk, and your position size should reflect that.