Token safety
How to check if a crypto token is a scam
No checklist can prove a token is safe. A good one tells you what you are actually buying, which powers the contract still holds, and how hard it would be to sell. Here is the order that catches the expensive mistakes.
Updated 10 November 2026.
1. Get the contract from the official source
Anyone can deploy a token with the same name and ticker. The only identifier that matters is the contract address. Copy it from the project’s official site or a verified social profile — never from a reply, a direct message or a search ad. Then check that the address is the same one the project and the explorer show.
2. Read the contract powers
A verified contract is not automatically safe: verification only proves the published source matches the bytecode. Look for the powers that can change the deal after you buy:
- Mint — can the owner create more supply and dilute you?
- Owner and proxy — can the rules be upgraded or the owner changed?
- Transfer tax or limits — a sell tax or a max-wallet cap can trap a position.
- Blacklist or pause — can transfers be blocked for selected wallets?
- Honeypot — can you buy but not sell? A simulation with a small amount is the practical test.
3. Check the liquidity, not the market cap
A large market cap on a thin pool is a number, not a market. Check the depth of the main pool, who controls the LP tokens, whether the liquidity is locked, and how old the pool is. Then check the price impact for the size you actually want to trade: if a $500 sell moves the price double digits, you are the exit liquidity.
4. Look at who holds the supply
Concentration is the quiet risk. If a few wallets hold most of the supply, they can sell into your buy. Look at the top holders, the deployer, and wallets funded from the same source. A lock or a vesting contract is only as good as the contract that enforces it.
GTXAgent does not have a key-free holder index today. It will tell you that and point you to the explorer rather than inventing a concentration number.
5. Compare volume with liquidity
Volume can be washed. If the daily volume is many times the pool depth, a small number of wallets may be trading with each other. Check the number of holders and the age of the pool, and be suspicious of a token that appeared today with a perfect chart.
6. Read the story with a cost mindset
“Guaranteed returns”, “next 100x”, a countdown, paid shills and a team that only exists as avatars are marketing, not evidence. A real project can still fail; a fake one usually cannot answer a simple question about who controls the mint and the liquidity.
What the assistant can and cannot do
GTXAgent can run a contract-level safety verdict on a token address, read its liquidity and the latest news, and explain the result with the source and the time of the read. It cannot prove a token is safe, it does not have holder-concentration data today, and it cannot sign or move funds. When a check is missing, it says so and lowers confidence.
Questions
Is a verified contract automatically safe?
No. A verified contract only means the published source matches the bytecode. It can still contain owner minting, a transfer tax, a blacklist or a proxy upgrade. Read the powers, not just the badge.
What is the biggest red flag in a new token?
A small number of wallets holding most of the supply, combined with thin liquidity and an owner who can mint or change the rules. Any one of those is a risk; all three together is how most new-token losses happen.
Can GTXAgent tell me if a token is a scam?
It can run a contract-level safety verdict on a token address, read liquidity and news, and explain the result with its sources. It cannot prove a token is safe, and it does not have holder-concentration data today; it will name that gap instead of guessing.