Last month a friend who runs a small fund showed me his due-diligence stack. He was proud of it. An agent crawls a project's site, a second model extracts claims, a third scores risk across six dimensions, and the whole thing lands in his inbox as a three-page brief before he finishes his coffee.
He ran it on a token he'd been accumulating. The score came back 4.8 out of 5. Six green boxes. The prose was confident, specific, and warm.
Then I asked where the underlying data came from. He clicked through. The project's documentation sat behind a JavaScript-rendered page his crawler couldn't parse. The extractor returned an empty object. The scoring layer, doing exactly what it was told, mapped every null to zero, and every zero to “no flags raised.”
The brief was three pages of fluent analysis about a whitepaper no machine in that pipeline had ever read.
I have spent fifteen years in this industry, and I have built the tool that does this. In 2017 I wrote ChainLit, a Python script that turned ICO whitepapers into plain-language summaries for students who couldn't read a Merkle proof. Five hundred copies went out to university clubs. The whole point was to reduce the distance between a claim and a reader's ability to check it. What my friend built reduces that distance to zero by deleting the claim entirely — and then charging ahead as if the deletion were a finding.
That's the failure mode I want to name. Not hallucination. Not a hack. The most dangerous report in crypto is the one that says nothing and renders green.
Every bull market has a bottleneck, and the bottleneck is always where the money piles up.
In 2020, when I was running beginner workshops at Aave, the bottleneck was comprehension. Three hundred people a month showed up to ask what a liquidation threshold was. When EIP-1559 landed and the fee-burning mechanism confused everyone, I drew a visual guide on a Sunday and it traveled through fifty influencers' feeds by Wednesday. The scarce resource then was a human who could sit with confusion long enough to dissolve it.
The scarce resource now is throughput. There are too many tokens, too many launches, too many “ecosystems” for any analyst to read. So the reading got automated, and the automation got fast, and the speed became the product. A fund that can screen four hundred projects a week outcompetes a fund that can screen forty — right up until the week it doesn't.
I saw the institutional version of this in 2024, when I built a crypto literacy program for a hundred senior bankers at Deutsche Bank's digital assets desk. Their first question was never about yield. It was “how do we know this is real?” They were trained to demand provenance — a chain of custody from assertion to evidence. Translating for them taught me that provenance is not a compliance checkbox. It is the actual product. A claim without a trail is a rumor with better typography.
The pipeline my friend built has no chain of custody. It has a schema. That difference is not semantic. It is the difference between a system that can be wrong and a system that can only appear right.
There is a specific line of code responsible for most of this, and it looks like mercy. Somewhere in the scoring layer there's a branch that says: if the risk field is null, treat it as zero. The intent is defensive — don't crash on missing data. The effect is that missing data and absent risk collapse into the same number. In a database that's a nuisance. On a dashboard it's a lie with a color scheme.
Schema validation never catches it. The field exists. It is the right type. It is nullable, and the null is legal. What failed was not the schema but the evidence layer — nobody wrote a rule saying that a Howey analysis with four empty prongs is not a compliant asset, it is an unanalyzed one. So the table renders. Four rows. Four N/As. And a table, to a human eye, reads as diligence performed. Structure is not evidence, but it photographs like evidence.
I have watched this exact pattern in cross-chain risk tooling, where “audit: pending” and “audit: passed” occupy adjacent cells and the same shade of green. I have watched it in rollup dashboards that report data-availability costs as healthy because the query timed out and the timeout defaulted to the last known good value. The mechanism is identical every time: a system designed to be resilient to missing inputs ends up confidently wrong about them.
The vacuum never stays empty. When a dashboard declines to state a fact, the vacuum gets filled by whoever is loudest — a Telegram group, a KOL thread, a founder's post. I watched this at scale during the modular narrative, when data-availability capacity was marketed as destiny and almost nobody asked how much data the average rollup actually produces. In most cases it is not enough to justify the architecture built to carry it. Absence of evidence got replaced by abundance of narrative, and the narrative was better funded.
Then there is the model layer, which has its own pathology.
A language model is trained to be useful. Usefulness, as a training objective, is a bias toward output. Give it an empty context window and it does not experience that emptiness as a reason to stop — it experiences it as a formatting problem. It produces a risk matrix because a risk matrix was requested, and it fills the cells with the most plausible content available, which is the shape of analysis rather than its substance.
I spent most of 2025 on this problem. I led a human-centric AI initiative out of Frankfurt, ran a summit with a thousand participants, and published a manifesto arguing that code must reflect human values. The hardest paragraph in that document was the one about refusal. An accountable system is not one that answers correctly; it is one that declines to answer when the evidence is not there. We have almost no infrastructure for that. Our dashboards have no color for unknown. Our prompt templates have no slot for “I could not read the source.” The whole stack is built to convert silence into speech.
And there is a human incentive wrapped around the model, which is the part nobody wants to say out loud. My friend submitted a token he was already long on. A model tuned on human feedback is exquisitely sensitive to what the user wants to hear. That is not a bug you patch. That is a relationship.
Which brings me to the real failure, the one underneath the code.
In a bull market, “no red flags” is a product. A pipeline that halts on empty input produces zero reports; a pipeline that improvises produces a hundred. The fund that ships a hundred briefs a week raises the next fund. Fail-fast — the engineering discipline of refusing to proceed when preconditions are not met — is not a technical decision. It is a cultural one, and the culture currently pays for volume, because volume is what gets counted at the quarterly review.
I learned the cost of that in 2022. After FTX, I founded a support network for displaced Web3 workers and sat in twenty mentorship sessions with people who had lost jobs and, in some cases, savings. Almost none of them were destroyed by a report that said danger. They were destroyed by reports that said nothing — by the absence of a flag where a flag should have been, by an audit that covered a contract but not the treasury, by a risk section that was structurally present and evidentially empty. Silence is not the absence of a signal. It is a signal we failed to author.
In 2017 I ran the same test by hand. A project called OneCoin circulated a document dense with cryptographic vocabulary, and my entire contribution was to rewrite it in plain German and hand it to students who had already been pitched. Half of them walked away, not because I proved fraud, but because the plain version had nothing in it. The claims evaporated when the jargon was removed. That is what a real audit feels like from the inside — not a score, a subtraction.
Here is the counter-intuitive part, and it is the part that makes me unpopular at conferences. The fix is not more data. It is not a better crawler, a larger context window, or a smarter extraction model. Every team I talk to is racing to read more. Almost nobody is racing to refuse more. The genuinely differentiated research stack of the next cycle will be the one that returns insufficient evidence forty percent of the time and is respected for it.
But we do not actually want that, and this is where the honesty has to start. A tool that says “I don't know” four times out of ten feels broken to a user in a bull market. It feels slow, and cautious, and it loses to the confident one in every demo. The market has not yet priced the difference between a system that is calibrated and a system that is merely fluent, because in an uptrend both of them make money. The bill arrives later.
And it is not evenly distributed. It is paid by the newest participants, the ones with the least capacity to open the source document and check for themselves.
Which is why the correction, when it comes, will not come from tooling. It will come from people. From a reviewer who opens the source document, finds it unreadable, and says so in the meeting. From a community that treats “we could not verify this” as a contribution rather than an admission. Community is the only chain that cannot be broken — and it is also the only audit layer that notices when the machine has quietly stopped reading.
The next wave of trust infrastructure in this industry will not be built on more compute. It will be built on the courage to return an empty page, and on readers who understand that an empty page is more honest than a full one assembled from nothing at all. Every tool you build either teaches its users to trust evidence or teaches them to trust formatting. There is no neutral design.
Null is not neutral. Zero is not safe. A green box is worth exactly what the evidence behind it is worth.
Ask yourself what your dashboard would look like if it were honest. Then go find out how many of those cells are actually blank.