Most harm done to newcomers in crypto doesn't come from sophisticated attacks — it comes from putting money into a project without doing the basic checks first. Genuine research takes longer than reading a few social media posts, but it's not complicated once you know what to actually look for.
Start with the team. Are real people, with names and verifiable track records, publicly associated with the project? An anonymous team isn't automatically disqualifying — some legitimate projects have anonymous founders — but it does remove a layer of accountability, and should raise the bar for everything else you check.
Read the actual documentation, not just the marketing. A legitimate project can usually explain, in reasonably specific terms, what problem it solves and how. Vague language, excessive buzzwords, and documentation that reads more like a sales pitch than a technical explanation are worth noticing.
Check the tokenomics: how many tokens exist, how they're distributed, and whether the team holds a large share with little or no lock-up period — a structure that lets them sell into early demand regardless of the project's long-term success. Look for independent smart contract audits, and read enough of the summary to understand what was actually tested, rather than just noting that an audit exists.
Be careful how you weigh community size and social proof. A large, enthusiastic community doesn't verify a project — it can be bought, and even when genuine, enthusiasm isn't evidence of technical or financial soundness. Treat hype as something to investigate further, not as a substitute for your own research.
None of these checks guarantee a project is legitimate. But doing them consistently, and walking away when the answers are evasive or missing entirely, filters out a significant share of the projects that go on to fail or turn out to be scams.