Unknown Is Not Neutral: The Anatomy of a Blank Crypto Risk Report

Last week a nine-dimension due diligence report landed in my inbox. It had a technical section, a tokenomics section, a market section, an ecosystem section, a regulatory section, a team and governance section, a risk matrix, a narrative section, and a supply-chain transmission map. It had column headers. It had row labels. It had a five-star rating system, a glossary of terms, and a disclaimer at the bottom. It had everything, in the same sense that a mannequin has everything. Every substantive field was null. Not wrong. Null. The extraction layer had returned an empty list of information points, the analysis layer had consumed that empty list without complaint, and the rendering layer had produced a document indistinguishable, at a glance, from the other forty memos in the folder. The only honest sentence in the entire artifact was buried in section seven, in a note on risk classification: the complete absence of information is itself an independent risk. Everything around that sentence was scaffolding holding up nothing. I have been paid to read bad research for nine years. This was the first time I read research manufactured out of the absence of research, and shipped with a rating system attached. It is not a bug in one pipeline. It is the operating model of a meaningful fraction of this industry's diligence machinery in 2026. To understand why a blank report is a systemic event rather than an embarrassing one, you have to look at how the machinery is wired. The modern crypto diligence stack has four stages. A crawler fetches source material. An extractor decomposes that material into information points, the atomic unit of verifiable fact, each one carrying a subject, an action, a number, and a timestamp. An analysis layer maps those points across a fixed set of dimensions: technology, tokenomics, market structure, ecosystem position, regulatory exposure, team and governance, risk, narrative, and supply-chain transmission. A renderer turns the analysis into a memo a human can read in eleven minutes. The constraint that makes the whole thing honest is the citation rule: every conclusion must name the information point it descends from. That rule is what separates analysis from atmosphere. It is also the first thing that gets dropped when a team optimizes for throughput instead of accuracy, because citations are expensive and vibes are free. Now the market context. This cycle, diligence is being run by agents at a volume no human team could match. My own fund processes more memos per quarter than it did per year in 2020. The volume of documents is up by an order of magnitude. The number of humans who read the underlying primary sources has not gone up at all. It has, if I am honest, gone down, because the documents look better than they used to. Typeset tables read as rigor. Section headers read as coverage. Star ratings read as judgment. So the failure I received is not exotic. It is the natural endpoint of a system optimized to produce the form of analysis at a speed that outruns the substance of it. And the most interesting thing about it is not that the extraction stage failed. Extraction fails constantly. The interesting thing is that it failed open, that a null input was permitted to flow through three downstream stages and emerge as a deliverable. I do not chase the candle; I study the gravity. This quarter the gravity was in an empty field. Start with the mechanics, because the mechanics are where the money leaks. There are three distinct failure modes stacked in that one document, and they are worth separating because different people own each of them. Silent null propagation. Every data engineer knows the class of bug where a null gets coerced to zero, and the aggregation stage happily computes a mean over a field that was never populated. In quantitative finance this is catastrophic and well understood: a missing return coerced to 0.00 percent drags a Sharpe ratio toward zero and makes a volatile strategy look like a savings account. Crypto diligence has the same bug with a worse coercion. Here, UNKNOWN does not get mapped to zero. It gets mapped to neutral. A token with no disclosed unlock schedule receives no red flag, because there was nothing to flag. A protocol with no published audit receives no audit risk, because the field was empty. Absence of evidence is rendered as evidence of absence, a table border is drawn around it, and it is filed. Schema drift. Parsers break quietly. A site moves behind a paywall. A frontend switches to canvas-rendered text and the crawler returns an empty string where it used to return six paragraphs. A prompt revision changes the output shape, and the downstream validator, written by someone who was told to check that fields exist, confirms that the fields exist. They do exist. They are empty. A presence check is not a content check, and in my experience the gap between those two things is where roughly all automated research fails. The output-shaped illusion. A memo with nine sections reads as thorough. Human reviewers skim for structure, not for falsifiability. We are pattern-matching machines, and a filled table satisfies the pattern completely. This is the exact cognitive exploit the 2017 ICO whitepaper ran at scale: forty pages, a team photograph, a roadmap with quarters printed on it, and not one verifiable claim. I audited more than forty of those documents as a junior analyst in Kuala Lumpur, and the ones that frightened me were never the ugly ones. The ugly ones were honest. The beautiful ones were the trap. Which brings me to the part of the report that actually matters, and it is not the nulls. The report's only defensible sentence was the rule almost nobody implements: unknown should be treated as negative until proven otherwise. In underwriting, an unverifiable fact is priced as adverse. That is how insurance works. That is how credit works. It is not how crypto scoring models work. In most of the models I have inspected, a missing data point contributes zero to the risk score. Run that logic to its conclusion and you get an inversion that should end the conversation: a project that discloses nothing accumulates no disclosed risks, while a project that honestly reports a forty percent team allocation accumulates one. The scoring model rewards opacity. The least transparent asset in the universe wins on a clean sheet. I have watched this exact inversion play out in governance, where it does the most damage. A DAO with a tidy on-chain vote history and a three-of-five multi-sig that can upgrade the contract at will scores as more decentralized than a messy, publicly contested protocol with an immutable core, because the multi-sig does not appear in the dataset. The foundation wallet does not appear either. The vesting cliff nobody wrote down does not appear. None of it is missing in reality; all of it is missing in the model. Code is not law in these systems, the upgrade key always sits with a handful of signers, and the diligence model cannot see the key. It sees the vote tally and calls it governance. Same disease, different organ. The reason I stopped trusting governance scores is the reason I stopped trusting TVL rankings: both measure what is easy to instrument rather than what is true. Liquidity is a mirror, not a foundation. So is a risk score. It reflects the disclosure practices of the entity being scored, and if the entity discloses nothing, the mirror shows a clean room. There is a second-order problem that almost nobody is pricing yet. The information point is now an attack surface. Projects in this cycle know how the pipelines work, because the pipelines are open source and the people running them publish their prompts. So press releases are being written for extractors rather than for readers: subject, action, number, timestamp, all favorable, machine-parseable, stripped of the context that would make them falsifiable. A team that publishes TVL at four hundred and twelve million, up thirty-eight percent quarter over quarter, with fourteen thousand daily active addresses, every Tuesday, is not informing the market. It is training every extractor in the market to produce a memo with high information-point density and zero independent verification. The nulls get filled. That is worse than a blank report, because a blank report is at least honest about its ignorance. This is ignorance wearing a source span. The citation rule is satisfied. The citation points at the press release. The press release has become the primary source. The loop closes: agents read agent-optimized content, produce memos, and those memos feed allocation models, and the human at the end sees nine dimensions, a hundred and forty information points, every one traceable, and not one of them independently verified. Citation density is not verification. It is the aesthetic of verification, which is the more dangerous of the two, because it survives review. Now the rhyme. In 2022 I stepped back from trading and spent eighteen months inside modular architecture, building a simulation that compared monolithic and modular throughput. The finding that reorganized my thinking was not about consensus. Consensus was fine. The bottleneck was data availability, the layer where data has to actually show up, get posted, and become retrievable. Everything upstream of that layer is theater if the data never arrives. I have carried that lesson into every system I have evaluated since, and it produces an uncomfortable conclusion about the current infrastructure cycle. The industry has overbuilt the layers that demo well and underbuilt the layers that have to be correct. There are now more than a dozen data availability layers competing for blob space the market does not need. Ninety-nine percent of rollups do not generate enough data to justify a dedicated DA layer; they need a reliable one and a reason to post. Meanwhile the extraction layer, the unglamorous stage where a human-readable fact becomes a machine-readable one, is a prompt, a regex, and a prayer, running unattended, validated for shape. History does not repeat, but it rhymes in code. We did this with bridges. We did this with oracles. We are doing it with data availability, and now with research pipelines, and the pattern is identical every time: the component that produces a visible output gets funded, and the component that has to be correct gets a README. This is also why I have been allocating into decentralized compute rather than into model providers. The scarce resource in the agent economy is not inference. It is provenance. Compute markets can be priced because a GPU-hour is a commodity with a spot rate. Provenance cannot be priced, because almost nobody is producing it, and the entities with the strongest incentive to produce it are the ones whose numbers would not survive it. So what does a correct pipeline look like? I have rebuilt two of them, and the design is not clever. It is boring in the way audit is boring. First, a hard gate on input. If the extraction stage returns fewer than a threshold number of information points, five is a reasonable floor for substantive source material, the pipeline halts and raises an error. It does not proceed with a warning. It does not render a template with a note at the bottom. It stops, because a document built on zero facts is not a weak document. It is a document that does not exist, wearing a costume. Second, a source span on every claim. Not a citation to the article. A span. Character offsets, or a page and paragraph, or a transaction hash. If a conclusion cannot point at the exact text it came from, it is not a conclusion. It is a prior, and priors belong in a separate field labeled as such, where an investment committee can see them and discount them. Third, fail-closed defaults on every scoring dimension. Missing data must raise the risk score, not leave it unchanged. This is a one-line change in most codebases and a cultural earthquake in most teams, because it means the model will tell you that your favorite asset is uninvestable due to poor disclosure. That is the correct answer. Certainty is the enemy of the ledger. Fourth, and this is the one nobody wants to hear, a human has to read the primary source. Not every source. The contested ones. When the pipeline flags a null, a person opens the document and checks whether the null is real. Sometimes the data genuinely does not exist. Sometimes it exists and the parser is blind. The difference between those two cases is the entire investment decision, and no model I have seen can distinguish them from the inside. We ran this diagnostic across our own archive last quarter: a sample of memos that had passed validation, re-checked for populated fields with actual content rather than mere presence. The number that failed was not small. I am not going to publish the figure, because the figure is embarrassing and the fix is already in production. But the shape of the finding is the point. The documents that passed were not the documents that were right. They were the documents whose nulls were better formatted. Here is the part that will annoy the people who build these systems. The blank report is more honest than a filled one. I mean that literally. A null cannot be quoted in an investment committee. A null cannot anchor a position. A null cannot be screenshotted into a group chat and used to justify a five-million-dollar allocation. It sits there, inert and useless, and its uselessness is a form of integrity. A hallucinated TVL figure, by contrast, is perfectly quotable. A confidently stated audit by a top-four firm that was never performed is quotable. A synthesized roadmap with dates on it is quotable. The industry spends its energy worrying about hallucination as a technical artifact, the model making things up, when the real risk is plausibility: the model producing something that is wrong in exactly the way a reader expects it to be right. The blank report fails loudly. The plausible report fails silently, six months later, in a drawdown. The second thing worth saying is that the empty pipeline is a governance event wearing an engineering costume. Somewhere in that chain, a person signed off on a process capable of producing a deliverable from nothing. That is the same structural failure I keep finding in decentralized organizations: a governance surface that looks participatory, sitting on top of an admin key a handful of people control. The vote is real. The vote is also downstream of an upgrade function that can rewrite the rules. The null is real. The null is also downstream of a renderer nobody told to refuse. The algorithm does not care about your conviction. It also does not care about your process diagram. It will do exactly what it was built to do, which is produce output, and if you did not build it to refuse, it will never refuse. By the end of this cycle I expect diligence to be judged on a different metric than coverage. Not how many dimensions a report spans, but what fraction of its claims carry a source span a human can verify in under a minute. The memos that survive will be the ones that can be audited, not the ones that look complete. Coverage is a marketing number. Auditability is a capital-allocation number, and the two have never been further apart than they are right now. Which leaves a question worth sitting with. When your pipeline returns nothing, does it tell you, or does it hand you a table? We are not building a future; we are auditing one. And the audit is only worth the paper it is printed on if the paper refuses to be printed when there is nothing to say.