Asit Gupta

In 2017, when Bitcoin reached around USD 19,000 and the RBI took action against cryptocurrency markets as a whole, my curiosity shifted from Bitcoin as an asset to the much bigger question of why governments were trying to regulate it and what its legal status really was. As a law student, I started following the technology, regulations and legal developments closely. In 2021, after graduating, I attended the Future Blockchain Summit in Dubai and saw first-hand how quickly the industry was developing.

What pulled me into due diligence was the realisation that in crypto, what a project says publicly and what is actually happening on-chain can be very different. My legal background naturally made me question the people, structure, source of funds and regulatory position behind a project. Blockchain added another layer — being able to follow transactions and analyse wallet activity to understand what is actually happening. That combination of legal due diligence and on-chain intelligence is what really drew me into this field.

I would simply say that blockchain intelligence is about using the information already recorded on a blockchain to understand what is actually happening. Instead of only looking at what a project says on its website or social media, you look at wallets, transactions, token movements and relationships between addresses. The blockchain does not tell you someone's name automatically, but it can show patterns that are extremely difficult to see from the outside. For me, the legal side is important because the on-chain information then has to be connected with the actual business, people and regulatory structure.

One of the first things that stood out to me was that a company can present a very convincing story through its website, pitch deck and public statements, but the blockchain can show what is actually happening behind that story. BitConnect is a good example, it promoted a proprietary trading system and promised investors attractive returns, while the movement of funds told a very different story. It reinforced my view that you cannot rely only on what a project says; you need to look at the underlying blockchain data and follow where the money is actually going.

The biggest misunderstanding is that people often think crypto itself is a scam and illegal. There are certainly scams and bad projects in the industry, but that is very different from saying the underlying technology is a scam. Bitcoin, blockchain infrastructure and legitimate digital-asset businesses are very different from fraudulent schemes, and understanding that distinction is an important part of my work.

I normally start with the people behind the project, because the team tells you a lot about the business. Second is the legal structure — where the company is incorporated, who owns it and what licenses or registrations may be required. Third is the token and wallet structure, including distribution, concentration, liquidity and movements of major wallets. Fourth is the smart contract and technical security history. Fifth is the actual business model: whether there is a genuine use case, sustainable revenue or simply a token being marketed through hype.

I don't see them as alternatives. They answer different questions. On-chain data can tell me what happened with the assets, while off-chain due diligence can tell me who controls the business, where it is incorporated, what agreements exist and whether the business is legally operating. The strongest assessment is where both sides tell the same story; when they do not, that difference itself becomes a risk indicator.

With an anonymous team, the standard of due diligence has to become much higher. I look at the project's history, wallet activity, previous projects, public statements, developer activity, corporate records where available and the relationship between the people claiming to be involved and the actual activity on-chain. I also look for inconsistencies rather than trying to prove a person's identity from one piece of information. An anonymous founder is not automatically evidence of wrongdoing, but it does reduce the amount of information available for proper due diligence.

A credible proof of reserves should allow an independent party to verify that the stated assets actually exist and are controlled by the relevant entity at the time of the assessment. Ideally, there should also be transparency around liabilities, because showing assets without showing what is owed gives only half the picture. Proof of reserves also does not automatically tell you whether the assets are unencumbered, whether the company is solvent overall or how well its internal controls work. It is one part of due diligence, not a substitute for a full audit or financial review.

I have seen situations where the public-facing side of a project was very strong — professional website, experienced-looking people, partnerships and a good marketing strategy — but the underlying structure raised questions. The important lesson was that the presentation and the actual movement of assets did not completely match. I generally do not like naming projects in these situations because the purpose of due diligence is to identify risks, not publicly accuse people. For me, the lesson is simple: the more polished the presentation, the more important it is to independently verify it.

The first is excessive concentration of tokens in a small number of wallets. The second is unexplained movement of funds by insiders or connected wallets. Third is a project that talks constantly about price but very little about its actual product or business. I would also look closely at anonymous teams, unrealistic returns, aggressive pressure to invest and liquidity that can be removed very easily. FATF also identifies unusual transaction patterns, unusual transaction sizes, anonymity enhancing tools and unexplained source of funds as important risk indicators.

I become cautious when the actual distribution is very different from what the project communicates. For example, a token may appear widely distributed while related wallets are effectively controlled by the same group. Large insider allocations, unclear vesting arrangements, sudden unlocking and a very small amount of genuinely liquid supply can also create significant risk. I also look at whether wallets that appear unrelated are consistently funding or transacting with each other.

There is no perfect formula, but there are warning signs. Check who controls the liquidity, whether the contract has unusual administrative powers, how concentrated the token supply is and whether the team has the ability to change important contract parameters. Look at the actual wallets rather than relying only on social media. Most importantly, do not confuse a rising token price, large follower count or influencer promotion with evidence that the underlying project is legitimate.

They are useful, but none of them should be treated as a guarantee. An audit usually covers the code and the scope specified in the audit, not necessarily the honesty of the team, token economics or future changes to the project. Influencers and partnerships are even further removed from that question. I would treat all three as supporting information and still conduct independent legal, financial and on-chain due diligence.

It is becoming more sophisticated, but the basic principle is still following transaction relationships and identifying patterns. You start with known addresses and follow the movement of assets through wallets, exchanges, bridges, DeFi protocols and, where relevant, mixers or other obfuscation services. Cross-chain activity makes the investigation harder because the same economic activity can move between different networks. Modern blockchain analytics tools can help connect these movements, but human analysis is still important because a transaction path needs context before you can draw a reliable conclusion.

The blockchain itself normally gives you an address, not a person's identity. Attribution comes from combining different sources — exchange records where available, public disclosures, ENS or other naming systems, transaction behaviour, corporate information, leaked or public wallet information and relationships with known entities. The confidence level can therefore range from very high to very low. I always prefer to describe attribution as an evidence-based assessment rather than presenting an inference as an absolute fact.

One type of investigation that has stayed with me involved following a transaction that initially appeared to be a simple transfer between two unrelated wallets. Once the wider transaction history was mapped, the wallets showed repeated connections with other addresses and ultimately with a service used by the wider ecosystem. The on-chain evidence did not by itself prove who the person was, but it helped establish a much clearer picture of the flow of funds and the relationships involved. That is where blockchain analysis is particularly powerful — it can turn an isolated transaction into a much larger financial trail.

Recovery is possible, but there is no guarantee. Time is extremely important because once stolen assets move through multiple wallets, bridges, exchanges or other services, the investigation becomes more difficult. The chances of recovery depend on how quickly the theft is identified, whether the assets can be traced, whether they reach a regulated or identifiable service, the cooperation of exchanges and service providers, and the legal powers available in the relevant jurisdictions. Good evidence preservation is critical from the beginning.

The biggest misconception is that owning your own private keys automatically means you are safe. Self-custody removes some risks but creates others. A compromised device, phishing attack, malicious signature or leaked seed phrase can still result in a complete loss of assets. Security is therefore not only about where the assets are stored; it is also about how the user interacts with wallets, websites and transactions.

I would look at the legal entity behind it, jurisdiction, regulatory position, custody model, security history and transparency around reserves. For DeFi, I would additionally examine the smart contract, audit history, admin permissions, oracle dependencies, liquidity and whether there have been previous exploits. I would also check how withdrawals work and what happens if something goes wrong. A professional-looking interface should never be treated as evidence of security.

AI is making impersonation much more convincing. We are seeing the use of deepfake video, cloned voices, fake investment personalities, fake executives and highly convincing messages designed to create urgency. Chainalysis estimated that crypto scams and fraud generated at least $14 billion in on-chain inflows during 2025, with impersonation scams showing particularly rapid growth; its research also found AI-enabled scam operations to be significantly more profitable on average.

The practical lesson is that seeing someone's face or hearing their voice is no longer enough to verify identity. For a significant transaction, verification should happen through a separate trusted channel.

They have made the industry more accountable. In India, specified virtual digital asset activities such as exchange between VDAs and fiat, exchange between VDAs, transfers and custody-related services were brought within the PMLA reporting framework, with VDA service providers required to register with FIU-IND as reporting entities.

For users, this means more KYC, transaction monitoring and source-of-funds checks, but it also creates a clearer compliance framework. FIU-IND continues to update its AML/CFT guidance for VDA reporting entities, including an updated version issued in January 2026.

It can do both depending on how it is implemented and how users respond. Regulation can improve transparency, KYC, reporting and accountability among compliant businesses. At the same time, if legitimate access becomes difficult or expensive, some users may look for offshore or unregulated alternatives. The answer is therefore not simply more or less regulation; the quality, clarity and practical implementation of the framework matter.

AI is making it much easier to process large volumes of blockchain data and identify relationships that would take a human analyst much longer to find. It can help cluster wallets, identify unusual transaction behaviour, prioritise suspicious activity and connect information from different sources. At the same time, criminals are using the same technology to create better scams and more sophisticated identities. So AI is becoming both an investigative tool and a threat that investigators need to understand.

I think the risk is increasingly moving toward the intersection of AI, crypto and identity. Deepfakes, automated social engineering and AI-generated investment scams can make it much harder for an ordinary person to distinguish a real person or company from an impersonation. We are also likely to see more sophisticated attacks involving autonomous or semi-autonomous systems interacting with financial infrastructure. The technology is developing faster than many organisations' internal controls.

They carry different types of risk. CeFi concentrates risks around the company, custody, governance and counterparty, while DeFi moves more of the risk toward smart contracts, governance, oracles and user interaction. I would not say one category is automatically safe or unsafe. The specific platform and its structure matter much more than the label.

I use blockchain explorers as the starting point because they let me see the underlying transaction history directly. For more complex investigations, specialized analytics platforms become useful for clustering, attribution and tracing activity across wallets and chains. I prefer using more than one source when the conclusion is important rather than relying entirely on a single platform.

Inconsistency: When what the team says, what the documents show and what the blockchain shows do not match, I want to understand why.

Realist. I think blockchain technology has genuine long-term applications, particularly in financial infrastructure, settlement, tokenisation and digital ownership. At the same time, not every token or project will survive, and regulation, security and business fundamentals will matter much more as the market matures.

Earlier in my career, like many professionals, I sometimes gave too much weight to the information that was easiest to verify and not enough to what was happening underneath it. Working in the crypto space taught me to question the complete picture — legal documents, people, financial information and on-chain activity. Today I try to approach every assessment with the assumption that there may be information I have not yet seen.

They confuse a rising price with a strong project. When the market is moving up, people often stop asking basic questions about token supply, liquidity, governance, the team and actual utility. They also tend to believe that because something has survived one cycle, it will automatically survive the next one. Markets change, and due diligence should not disappear simply because the price is going up.

I would keep it very simple:

1. Who is behind it?
2. Where is the legal entity and what regulation applies?
3. Where are the tokens and money actually moving?
4. What can the smart contract and insiders actually do?
5. What happens if the project fails tomorrow?

If a person cannot answer these five questions, they probably have not done enough due diligence.

Learn both sides of the industry. Understanding blockchain technology is important, but understanding law, AML, corporate structures, finance and evidence is equally valuable. I would recommend learning how to use explorers and analytics platforms, while also understanding how transactions fit into real-world legal and financial structures. The people who can connect technical information with business and legal context will have a very useful skill set.

Crypto gives individuals access to financial technology that was previously available mainly through traditional institutions, but that freedom also comes with responsibility. Do your own research, understand where your money is going and never rely only on somebody's reputation or social media following. The blockchain gives us an unusual advantage because a lot of financial activity is publicly visible. We should use that transparency to ask better questions rather than simply follow the crowd.