Understanding risk in crypto

Risk isn't a single number

Most financial apps give you a single risk score: "low," "medium," or "high." But that's like saying a city's weather is "bad" without telling you if it's raining, snowing, windy, or 40°C. Knowing the type of risk is what lets you make actual decisions.

In crypto, there are several independent types of risk. A token can be very safe in one dimension and very risky in another. Understanding each one helps you see the full picture.

Sovereignty risk: can someone freeze your tokens?

Not all crypto is created equal when it comes to control. Some tokens have admin keys — meaning a company, a government, or a group of people can freeze, seize, or blacklist specific addresses.

Tokens that can be frozen

• USDT (Tether) — Tether has frozen hundreds of addresses, making those tokens permanently unusable. They do this in response to law enforcement requests, sanctions compliance, or suspected illegal activity.
• USDC (Circle) — Circle can also freeze specific addresses. They froze addresses associated with Tornado Cash after US Treasury sanctions.
• Any token with admin functions — Many tokens have a "pause" or "blacklist" function in their smart contract. The admin (usually the team that created the token) can activate it.

Tokens that cannot be frozen

• BTC (Bitcoin) — No one can freeze Bitcoin. There is no admin key, no company, no override. If you hold BTC in your own wallet, no entity on earth can prevent you from using it.
• ETH (Ethereum) — Same as Bitcoin. The network itself has no freeze function.
• DAI — Governed by smart contracts and token holder votes. No single party can freeze it. However, DAI is partially backed by USDC, which can be frozen — so there's indirect sovereignty risk.
• BOLD (Liquity V2) — Immutable smart contracts with no admin keys at all. The code is deployed and nobody can change it.

Inflation risk: can your tokens be diluted?

Some tokens have a fixed supply — there will only ever be a certain number of them. Others can be created indefinitely, diluting the value of existing tokens.

Fixed or deflationary supply

• BTC — Hard cap of 21 million coins. Ever. The last Bitcoin will be mined around 2140. No one can change this.
• ETH — No hard cap, but since the "Merge" in 2022, ETH is often deflationary — more ETH is burned in transaction fees than is created as rewards, so the total supply actually shrinks over time.

Inflationary tokens

• Many governance and reward tokens — Protocols often create new tokens to incentivize users (yield farming rewards, staking rewards, airdrops). This constant emission dilutes existing holders. A token offering 100% APY in farming rewards is effectively printing tokens — and as more tokens exist, each one is worth less.
• Network tokens with uncapped emission — Some blockchains continuously issue new tokens to pay validators. If demand doesn't grow faster than supply, the price trends downward over time.
• Stablecoins — USDC and USDT can be minted in unlimited quantities, but they're supposed to be backed 1:1 by real reserves. The inflation risk here is different — it's tied to trust in the reserves.

Liquidity risk: can you actually sell?

Liquidity is how easily you can convert an asset to cash (or stablecoins) without significantly affecting the price. High liquidity means you can sell quickly at the market price. Low liquidity means you might have to wait, accept a worse price, or not be able to sell at all.

High liquidity

• ETH, BTC, SOL — Can be sold for billions of dollars per day across many exchanges. Your trade barely moves the price.
• USDC, USDT — Highly liquid stablecoins with deep trading pairs on every major exchange.

Low liquidity

• Small-cap tokens — A token with $50,000 of daily trading volume means selling $10,000 worth could drop the price 20% or more.
• NFTs — Each one is unique. Finding a buyer at your asking price could take days, weeks, or never happen.
• Locked positions — Tokens locked in staking, vesting schedules, or governance locks (veTokens) literally cannot be sold until the lock period ends.
• LP tokens — While redeemable, removing large amounts of liquidity can cause slippage and affect the underlying pool.

Smart contract risk: can the code fail?

When you deposit crypto into a DeFi service, your tokens are held by a smart contract — a computer program on the blockchain. If that program has a bug, a vulnerability, or a deliberate backdoor, your funds can be stolen or lost.

What can go wrong

• Code bugs — Programming errors that allow attackers to drain funds. Even well-audited protocols have been exploited. Hundreds of millions of dollars have been lost this way.
• Oracle manipulation — Many DeFi services rely on price feeds (oracles) to determine token values. If an attacker manipulates the price feed, they can trick the contract into giving them more than they should get.
• Admin key compromise — Some contracts have an admin who can upgrade or modify the code. If the admin's private key is stolen, an attacker can change the contract to steal funds.
• Reentrancy attacks — A specific type of bug where a contract can be tricked into sending funds multiple times in a single transaction.
• Logic errors — The code works as written, but the logic is flawed. Rare conditions can lead to unexpected behavior.

What reduces the risk (but doesn't eliminate it)

• Audits — Independent security firms review the code. Multiple audits are better than one. But audits are not guarantees — they find some bugs, not all.
• Track record — A contract that has held billions of dollars for years has been battle-tested by real attackers. Time is the best audit.
• Bug bounties — Some protocols pay hackers who find bugs to report them instead of exploiting them. This incentivizes responsible disclosure.
• Immutable contracts — Contracts that cannot be modified after deployment (like Liquity V2) eliminate admin key risk, but also mean bugs can never be fixed.
• Insurance — Services like Nexus Mutual offer coverage against smart contract failures, but coverage is limited, not automatic, and requires a claim process.

Volatility risk: how much can the price swing?

Volatility measures how much and how fast a token's price changes. High volatility means big swings — up and down — in short periods.

• Very low volatility: USDC, USDT — designed to stay at $1
• Low volatility: Tokenized Treasuries (OUSG) — backed by stable government bonds
• Medium volatility: BTC, ETH — established cryptocurrencies with large markets
• High volatility: SOL, ARB, OP — smaller but established tokens
• Very high volatility: Memecoins, new tokens — can move 50%+ in a single day

Volatility isn't inherently bad — it's what creates the opportunity for gains. But if your savings are in a highly volatile token and you need the money at a specific time, a price drop at the wrong moment can be devastating.

Peg risk: can a "stable" token lose its value?

Some tokens are designed to track a fixed price — usually $1 USD. This is called a peg. When the price drifts away from that target, it's called a depeg. And when a depeg happens, what was supposed to be the safest part of your portfolio can become the most dangerous.

What keeps a peg in place

Different stablecoins maintain their peg in different ways, and each mechanism has different failure modes:

• Fiat-backed (USDC, USDT) — The issuer holds real dollars or equivalents in reserve. You trust the company to actually hold those reserves and to redeem tokens at $1. The peg holds as long as that trust holds.
• Crypto-backed (DAI, BOLD) — Smart contracts hold crypto as collateral, typically more than the value of stablecoins issued (over-collateralization). The peg is maintained by automated liquidations: if collateral drops too much, the system sells it to cover the stablecoins.
• Yield-bearing (sDAI, sUSDe, USDY) — These are wrappers around other stablecoins or assets. Their peg depends on the underlying asset's peg plus the smart contract working correctly.
• Algorithmic — These use supply-and-demand mechanisms to maintain the peg, without full collateral backing. This approach has a catastrophic track record.

How depegs happen

The Terra/UST collapse: the worst-case scenario

In May 2022, the algorithmic stablecoin UST (Terra) lost its peg and spiraled to near zero. Its sister token LUNA, which was supposed to absorb selling pressure, went from $80 to less than $0.01. Approximately $40 billion in value was destroyed in under a week.

The mechanism was simple in theory — mint and burn LUNA to keep UST at $1 — but it created a death spiral: as UST fell below $1, the system minted more LUNA to compensate, crashing LUNA's price, which further undermined confidence in UST, causing more selling, more LUNA minting, and so on until both tokens were worthless.

Minor vs. major depegs

• $0.99–$1.01 — Normal market noise. This happens daily and usually self-corrects within minutes or hours through arbitrage.
• $0.95–$0.99 — Concerning. Something is causing sustained selling pressure. Worth paying attention to.
• Below $0.95 — Serious event. For established stablecoins, this is rare and signals a real problem with reserves, collateral, or confidence.
• Below $0.50 — Critical failure. The peg mechanism itself is broken. Recovery is uncertain. This is where "stable" money can be lost.

Counterparty risk: who are you trusting?

In traditional finance, you trust your bank to hold your money. In crypto, you might think you don't trust anyone — but that's rarely true. Counterparty risk is the risk that the other party in an arrangement doesn't deliver on their promise.

Where counterparty risk exists in crypto

Where counterparty risk is minimal

• Native tokens in your own wallet — ETH in your wallet doesn't depend on any third party. You are the sole custodian.
• Immutable smart contracts — Protocols like Uniswap or Liquity V2, where the code is deployed and cannot be changed by anyone, have no counterparty — only code risk.
• Crypto-backed stablecoins — DAI and BOLD are backed by collateral locked in smart contracts, not by a company's promises. The risk shifts from counterparty to smart contract risk.

Oracle risk: can your position be tricked by bad data?

Most DeFi protocols don't know the price of anything on their own. They rely on external services called oracles to feed them real-world data — token prices, interest rates, reserve proofs. If the oracle gives wrong data, the protocol acts on wrong information, and your money pays the price.

How oracle risk hurts you

What makes oracle risk higher or lower

• Lower risk: Major assets (ETH, BTC) on established oracles (Chainlink, Pyth) with many data providers and deep liquidity across sources. Hard to manipulate, rarely stale.
• Medium risk: Mid-cap tokens with fewer data sources. Price feeds update less frequently. Manipulation becomes feasible with enough capital.
• Higher risk: New tokens, exotic pairs, or LP token prices derived from on-chain calculations. Often rely on a single DEX pool as the price source — easily manipulated with a flash loan.
• Highest risk: Protocols that use their own on-chain price calculations (like a spot pool price) instead of a decentralized oracle network. This is the most common attack vector in DeFi hacks.

Learn more about how oracles work in our guide: What is a blockchain oracle?

Complexity risk: how many things can go wrong?

The more layers of technology between you and your money, the more things can potentially fail. Each layer adds its own risk.

Mobility risk: how expensive is it to move?

Not all networks cost the same to use. Moving tokens on some networks is nearly free, while on others it can cost $10, $50, or more per transaction.

• Very low cost: Solana (fractions of a cent), most Layer 2s (under $0.10)
• Low cost: BNB Chain, Polygon, Tron
• High cost: Ethereum mainnet — gas fees can spike to $50+ during high demand
• Very high cost: Bitcoin — fees vary dramatically, from $1 to $30+

Mobility risk matters when you need to react quickly. If ETH gas fees are $50 and you need to add collateral to avoid liquidation on a $500 loan, the cost of saving your position is 10% of the loan itself.

Concentration risk: all eggs in one basket

This isn't about a single token's properties — it's about your portfolio as a whole. Concentration risk means having too much of your value dependent on one thing.

• Token concentration — 80% of your portfolio in one cryptocurrency
• Network concentration — All your positions on a single blockchain
• Service concentration — All your savings in one lending protocol
• Underlying concentration — Holding wstETH, stETH, and cbETH thinking you're diversified, but all three are really just ETH

A practical summary

Understanding these dimensions doesn't mean avoiding risk — it means knowing what you're exposed to and deciding if that's acceptable given your goals. Someone saving for next month should care a lot about volatility and liquidity. Someone investing for 5 years might accept higher volatility for potentially higher returns.