How to verify a crypto company before you trust it

In short: verify a crypto company by checking five independent things: who owns the domain and how old it is, whether its social accounts match the official site, whether a financial regulator lists it, whether a company registry confirms the legal entity, and whether named people and third-party audits stand behind it. No single check proves safety, but a firm that fails several of them should not get your money.

Why this matters in 2026

Crypto fraud is no longer a fringe problem. The FBI's 2025 Internet Crime Report, as summarised by The Block, counted 181,565 crypto-related complaints and about $11.4 billion in losses, up 22% on 2024. Crypto investment fraud alone accounted for roughly $7.2 billion, and crypto ATM scams for $389 million.

Chainalysis estimates that about $17 billion was stolen through crypto scams and fraud in 2025, a projection that may rise as more wallets are identified. Impersonation scams grew more than 1,400% year over year, and scams linked on-chain to AI vendors earned about 4.5 times more per operation than those without. The same report says pig butchering (long-con romance and investment fraud) and high-yield investment programmes remain dominant categories by volume.

Across all scam types, the FTC says Americans reported record losses of $15.9 billion in 2025, with investment scams the largest category at $7.9 billion. Scammers now build convincing sites and copy real brands, so verification must rest on records you can check yourself.

Step 1: check the domain and WHOIS

Run the company's domain through a WHOIS or RDAP lookup and note the registration date, registrar and expiry. A "five-year-old exchange" on a domain registered three weeks ago is a problem. Be careful in the other direction too: an old domain proves little, because scammers buy aged or expired domains.

Also check the exact spelling for swapped letters or look-alike endings. A valid HTTPS certificate is necessary but means little, since scam sites have them too. Treat the domain as a screening tool: it can disqualify a site quickly but cannot qualify one.

Step 2: match the official social accounts

Do not trust links sent to you in messages. Go to the company's website, find the links to its X, LinkedIn, Telegram, Discord or GitHub accounts, and then check that those accounts link back to the same domain. Two-way matching is hard to fake.

Fresh accounts, purchased followers and deleted questions are warning signs. Impersonation is now the fastest-growing scam type, so assume anyone who contacts you first, including "support staff" in direct messages, is not official until proven otherwise.

Step 3: look the firm up on regulator registers

If a company serves customers in a regulated country, it should appear on that country's register. Use the regulator's own website, reached by typing the address or using a bookmark, never a link supplied by the company.

Understand what each register means. FinCEN registration is a filing, not an endorsement. The FCA has said its crypto registration regime is about anti-money-laundering supervision and does not carry consumer protection powers, a point made when the regime began and worth confirming against current FCA guidance. Under the EU's MiCA rules, authorisation is the stronger signal, and the ESMA register also publishes a non-compliant list. One analysis by TRM Labs found 17 authorised providers across seven member states in April 2025; the register has grown considerably since, so always read the live version.

Check the exact legal name, not just the brand. A licence held by a group subsidiary in one country does not cover a different entity serving you from elsewhere. VARA itself warns that only licensed entities may operate in Dubai and advises verifying status before any transaction.

Legitimate firms also operate from lighter regimes such as Seychelles or the British Virgin Islands. That is not disqualifying, but regulator protection may be limited, so the other steps carry more weight. The country pages summarise each jurisdiction.

Step 4: confirm the company in a corporate registry

Ask for the registered legal name, registration number and registered address, then verify them in the official registry: Companies House in the UK, the relevant Secretary of State database in a US state, ACRA in Singapore, or the equivalent elsewhere. Confirm:

• the company exists and is active, not struck off or dormant;
• the incorporation date is consistent with the age it claims;
• the directors listed match the people the website names;
• the address is a real business address, not a mass-registration or mail-forwarding location.

Step 5: check audits for protocols and smart contracts

For DeFi protocols, the key question is whether independent security firms reviewed the code. Look for:

• a published audit report, not just a logo on the homepage;
• the audited contract addresses matching the ones you will interact with;
• the audit date, and whether the code changed afterwards.

An audit lowers risk but does not remove it. Reports describe a snapshot of specific code. Browse smart contract auditors and the wider DeFi category to see which firms operate in the space, then confirm any claim directly with the auditor.

Step 6: look for team transparency

Credible projects name their people and let you verify them. Check that founders and executives have independent professional histories, such as LinkedIn profiles with a long record, conference talks, prior employers who confirm their roles, or a published GitHub history. Be wary of stock-photo headshots or "advisors" who do not know they are listed. Pseudonymity is not automatically a red flag, since many respected protocols began that way, but a pseudonymous team asking you to deposit with a custodial service is a different matter from open-source software you can inspect.

Step 7: ask for proof of reserves, and read it critically

Exchanges and custodians increasingly publish proof of reserves, usually a cryptographic attestation of customer balances against on-chain wallets. Useful reports show:

• the wallet addresses, so you can check balances yourself;
• a method that includes customer liabilities, not only assets;
• a named independent reviewer and a regular schedule.

Assets alone do not prove solvency, because a firm can owe more than it holds. Treat proof of reserves as one signal alongside licensing and custody arrangements. For institutional use, check whether client assets are held by a qualified custodian under segregated arrangements.

Step 8: spot the red flags

Most frauds share a few traits. The table compares them with what legitimate firms usually do.

One flag is a reason to ask questions; three or more is a reason to walk away. Fast paper gains after a small first deposit, followed by pressure to send more, is the standard pig-butchering pattern.

What directories can and cannot verify

Business directories are useful for discovery and for finding the right place to start checking. They are not regulators. BitOrgs is an independent register, and its entries use three states, Listed, Verified and Claimed, explained on the methodology page. In general terms:

• A directory can confirm that an organisation exists, collect its public details, link to its official channels and show which category and country it belongs to.
• It can show whether the organisation has taken part in a check or claimed its own profile.
• It cannot guarantee solvency, safe custody, honest management or regulatory standing today. Licences are suspended, withdrawn and reissued, and a directory entry can lag behind.

Read the state labels as statements about what was checked, not as endorsements. Always confirm the licence on the regulator's own site before depositing funds. To report an error or add an organisation, use submit; recent additions are on the new listings page, and the compare tool lines organisations up side by side.

For exchanges, see the exchange category; for self-custody, the wallet category. Suspicious counterparties can be investigated by blockchain forensics firms and legal and compliance providers.

Frequently asked questions

How can I tell if a crypto exchange is legitimate?

Check the legal entity on the regulator register for your country, verify the company in the corporate registry, and confirm its domain and social accounts match. Then look for a published proof-of-reserves report and a track record of ordinary withdrawals. Start with a small deposit and test a withdrawal before adding more.

Is a crypto company safe if it is registered with FinCEN?

Not necessarily. FinCEN registration means a money services business has filed with the US Treasury, but it is not an endorsement or a guarantee of safety. Also check state money transmitter licences and the firm's compliance record.

Does a WHOIS lookup prove a crypto website is real?

No. WHOIS can reveal a very new domain, which is a good reason for caution, but scammers also buy older domains and hide behind privacy services. Use it as a first filter alongside registers, filings and independent audits.

What are the biggest red flags for a crypto scam?

Guaranteed returns, pressure to deposit quickly, unsolicited contact from "account managers", and fees demanded before you can withdraw. Anonymous teams that cannot show checkable histories and vague claims of regulation without a licence number are also common warning signs.

Can a crypto directory tell me if a company is trustworthy?

A directory can help you identify an organisation, find its official links and see what has been checked, but it cannot vouch for solvency or conduct. Use directory labels such as Listed, Verified and Claimed as a starting point, then confirm licences and filings with regulators and registries yourself.

Sources and method: statistics come from the FBI IC3 2025 report (via The Block), Chainalysis's 2026 crypto scams report, FTC 2025 data (via Spokesman-Review), TRM Labs and VARA; regulator register details should be confirmed on each regulator's live site.

Last reviewed: 4 November 2026.