Many CIMs present “TVL growth,” “token upside,” or “Web3 moat” without proving sustainable fee capture after emissions, custody of keys, real versus wash volume, or a regulatory theory that survives enforcement. Crypto and digital assets due diligence (also called blockchain, Web3, cryptocurrency, token, DeFi, crypto company, digital asset, NFT, protocol, or on-chain diligence) underwrites how the business creates, holds, transfers, and monetizes digital assets. It tests token and protocol economics, custody and key control, on-chain revenue quality, regulatory classification, smart-contract risk, liquidity, treasury, and governance. It is not the same as fintech / payments diligence (TPV, take-rate, MTL/sponsor-bank rails), technology diligence (engineering stack and architecture alone), SaaS diligence (ARR/NRR metric definitions), AI / GenAI diligence (model and data layer), compliance diligence (internal program alone), sanctions diligence (list screening alone), cybersecurity diligence (enterprise controls alone), or commercial diligence (aggregate demand). Crypto work underwrites whether the digital-asset economic engine produces durable, custodied, classifiable cash through the hold period.
Crypto vs fintech vs technology vs compliance
| Workstream | Primary question | Typical output |
|---|---|---|
| Crypto / digital assets DD | Is the token/protocol/custody engine bankable? | Token economics bridge, custody map, classification heat map |
| Fintech / payments DD | Is the payment rail and take-rate stack bankable? | TPV quality, licenses, sponsor bank, fraud |
| Technology DD | Is the engineering stack and architecture sound? | Code, debt, team, infra |
| SaaS metrics DD | Are ARR/NRR definitions durable? | Cohorts, retention, packaging |
| Compliance / sanctions program DD | Is the control program effective? | Policies, screening, training |
Six pillars of crypto & digital assets diligence
1. Token, protocol & revenue economics
Bridge headline TVL, volume, and token price to sustainable fee capture: utility versus governance tokens, emissions and unlock schedules, insider cliffs, circular incentives, real users vs bots, fee switches, and free cash after market-making and reward costs. Align with commercial diligence, pricing diligence, quality of earnings, and SaaS diligence when subscription layers sit beside protocol fees.
2. Custody, keys, customer assets & treasury
Key control model (custodian, MPC, multi-sig, founder laptops), recovery procedures, segregation of customer vs corporate assets, proof-of-reserves claims, insurance limits, change-of-control ability to move assets, and treasury concentration in volatile tokens. Connect to financial diligence, debt / net debt diligence, and NWC diligence.
3. Regulatory classification & licensing posture
Security vs commodity vs payment instrument vs NFT/hybrid theories across core jurisdictions; registration, exemption, or enforcement history; money transmission, VASP, and exchange licenses; staking and stablecoin treatment; marketing claims versus counsel theory. Align with regulatory, compliance, legal, fintech, and CFIUS when foreign investment or dual-use tech applies.
4. Smart contracts, oracles, bridges & on-chain risk
Audit history and remediations, upgradeability and admin keys, oracle dependencies, bridge and cross-chain exposure, bug bounties, incident history, and whether critical value sits in contracts the buyer cannot remediate. Connect to technology, cybersecurity, product, and BCP / DR workstreams.
5. Liquidity, market structure & counterparty risk
Exchange and OTC venues, market-maker agreements, wash or wash-adjacent volume signals, concentration of liquidity, settlement and credit risk with venues, and whether modeled exits assume depth that is not real. Align with customer, competitive, and market diligence.
6. Governance, foundation, people & go-forward control
DAO vs foundation vs OpCo control rights, veto and admin powers after close, key developer and security talent, related-party token grants, disclosure quality, and integration risk if decentralization claims conflict with buyer control. Connect to management, people, board / governance, cultural, and LBO diligence.
DI20-WELCOME) — useful for token and revenue questions, custody and key-control maps, classification red flags, open-question lists, and data-room prioritization, not a substitute for full smart-contract audits, securities counsel opinions, forensic on-chain reviews, or multi-jurisdiction licensing opinions.
Stage sequencing (screen to IC)
| Stage | Crypto focus | Deal-team action |
|---|---|---|
| Teaser / CIM | TVL, token story, growth claims | Flag emissions, wash risk, custody claims |
| Desk diligence | Token bridge, keys, classification | Red/amber/green; hotspot list |
| Deep technical / legal | Audits, counsel, on-chain forensics | Economics bridge; custody & class map |
| IC / model | Cases for unlock, depeg, ban, exploit | Base / upside / downside with crypto cliffs |
| Post-close | Key ceremony, licenses, governance | 100-day crypto control plan with named owners |
Red flags
| Signal | Severity | Why it matters |
|---|---|---|
| Revenue or TVL mostly incentive-driven; collapses when emissions end | Deal-Killer | Growth thesis not cash |
| Customer or treasury assets controlled by founder keys without enforceable transfer | Deal-Killer | Buyer cannot own the asset base |
| Primary product likely a security/unlicensed VASP with active enforcement risk | Deal-Killer | Addressable market or license to operate collapses |
| Unaudited or upgradeable contracts with opaque admin keys hold majority of value | High | Exploit or rug risk post-close |
| Large insider unlocks or related-party grants during hold period | High | Price and treasury cliff |
| Liquidity concentrated on one venue or one market-maker with soft terms | High | Exit and mark-to-market risk |
| Decentralization claims conflict with buyer control or regulatory perimeter | High | Governance and compliance deadlock |
| No multi-year token unlock calendar or custody map pre-IC | Watch | Model and IC risk elevated |
Cost & timeline (traditional vs first-pass)
| Approach | Typical cost | Timeline | Best use |
|---|---|---|---|
| Full crypto specialist module (audit, counsel, forensics, licensing) | $25K–$150K+ | 4–12 weeks | Protocols, exchanges, custodians, cross-border VASPs |
| Targeted custody + classification + top-contract deep-dive | $15K–$50K | 2–6 weeks | Cleaner single-product or custody-heavy assets |
| Public first-pass crypto & digital assets pack | $49 | Minutes to hours | Triage before specialist spend / IC framing |
50-point crypto & digital assets diligence checklist
- Business model: exchange, custodian, protocol, NFT, wallet, mining/staking, hybrid
- Token map: utility, governance, security-like claims, dual-token structures
- Emissions schedule and remaining unlocks (team, investors, foundation)
- Insider cliff calendar through hold period
- Fee capture vs incentive spend (3–5 years if available)
- On-chain vs off-chain revenue bridge
- Real users vs bots / sybil activity signals
- TVL quality: sticky capital vs mercenary incentives
- Stablecoin or pegged-asset exposure and depeg history
- Custody model: third-party, MPC, multi-sig, self-custody
- Key ceremony, recovery, and social-engineering controls
- Customer vs corporate asset segregation
- Proof-of-reserves / attestation quality if claimed
- Insurance limits, exclusions, and claims history
- Change-of-control path to move or re-key assets
- Treasury composition and mark-to-market policy
- Related-party wallets and foundation grants
- Securities / commodity / payment classification theory by jurisdiction
- VASP, MTL, exchange, and staking license inventory
- Enforcement, Wells, or inquiry history
- Marketing claims vs counsel memo alignment
- AML/KYC program effectiveness for on-ramps
- Sanctions / OFAC screening on wallets and counterparties
- Smart-contract audit firms, dates, and open findings
- Upgradeability, admin keys, and timelock design
- Oracle dependencies and failure modes
- Bridge / cross-chain exposure and historical exploits
- Bug bounty maturity and past payouts
- Incident history and post-mortem quality
- Exchange listings, OTC desks, and market-maker agreements
- Volume quality and wash-risk indicators
- Liquidity concentration and exit depth assumptions
- Counterparty credit with venues and prime brokers
- DAO / foundation / OpCo control rights post-close
- Veto powers, multi-sig signers, and buyer representation
- Key developer, security, and compliance talent concentration
- Retention packages and non-solicit enforceability
- IP ownership of code, brands, and domain keys
- Open-source licenses and copyleft exposure
- Data privacy for off-chain KYC and analytics
- Cyber posture for hot wallets, CI/CD, and cloud keys
- Business continuity for chain outages and venue freezes
- Tax treatment of tokens, staking rewards, and treasury
- Accounting policy for crypto assets and fair value
- Litigation, class actions, and arbitration history
- Competitive set and differentiation without emissions
- Synergy claims that ignore classification or custody limits
- Data-room gaps on wallets, audits, and counsel files
- IC materials: unlock, depeg, ban, exploit downside cases
- Post-close 100-day crypto control plan with named owners
How deal teams use a first-pass pack
Use a first-pass crypto and digital assets pack to structure early questions, pressure-test CIM TVL and token language, build custody and classification heat maps, and prioritize data-room asks before smart-contract auditors, securities counsel, and on-chain forensic teams engage. Pair it with fintech, technology, cyber, compliance, sanctions, regulatory, financial, QoE, commercial, and LBO workstreams. It is an input to IC framing — not a full smart-contract audit, multi-jurisdiction securities opinion, or forensic wallet review.
Underwrite the digital-asset engine before you underwrite the token story
⇧ Already delivered: Tesla (TSLA) · Alphabet (GOOGL) · Palantir (PLTR) — real orders, real SEC data, every claim source-cited.
Get a structured first-pass diligence pack — useful input for crypto and digital assets thesis tests, token and custody questions, regulatory classification risk, liquidity and treasury cliffs, and IC prep, not a full specialist crypto study.
Order report $39.20 → Free brief Sample PDF