Crypto Safety Checklist Before Buying Any Token

Save it as a note on your phone. Work through it before any token purchase — not just the first time, and not just for tokens you have not bought before. The checklist is most valuable in exactly the moments when you feel certain you do not need it: a tip from someone you trust, a token already up 40% on the day, a presale closing in two hours. Those are the conditions under which the largest single category of beginner crypto losses happens.

If you want the conceptual background — what each signal means and why — start with the Token Safety pillar. This page is the operational version: ten items, do them, decide.

1. Contract address confirmed from two independent sources

Copy the contract address from the project's official website — the one linked from verified social accounts, not from a Google search ad. Copy it again from CoinGecko's listing for that token. They must match character for character. If they do not, you are looking at an impersonation. Pass condition: two addresses agree.

2. StableHub Rug Risk Score returns LOW or MEDIUM

Paste the contract address into stablehub.io/check/token. Wait 2–4 seconds. If the grade is HIGH, stop until you understand which flags fired and why. If MEDIUM, read the listed flags and decide whether the ambiguity is acceptable. The scoring rule set is published openly — including the six things v1 cannot do — on the Rug Risk Score methodology page. Pass condition: LOW, or MEDIUM with flags you have read and accepted.

3. Contract verified on Etherscan

Open etherscan.io/token/<contract address>. Click the Contract tab. You must see Solidity source code with a green tick. If the page asks "Are you the contract creator?", the contract is unverified and the code on-chain cannot be audited by anyone. Pass condition: verified source code visible.

4. Top non-exchange wallet holds < 20% of supply

Click the Holders tab on the same Etherscan page. Ignore the liquidity pool address, labelled exchange wallets, and labelled staking or treasury contracts. The largest remaining unlabelled wallet must hold less than 20% of total supply. For the full Etherscan walkthrough, see the holder concentration guide. Pass condition: top non-exchange wallet < 20%.

5. Token is at least 30 days old — or you accept new-token risk explicitly

More than 70% of documented rug pulls between 2021 and 2025 fired inside the first 90 days. The Rug Risk Score grades tokens under 30 days as MEDIUM minimum for this reason. If the token is new, you may still buy — but only as a deliberate decision to take new-token risk, with a position sized accordingly. Pass condition: 30+ days old, or new-token risk accepted in writing in your note.

6. 24-hour trading volume above $100,000

Check the 24-hour volume figure on CoinGecko or the Markets tab of the project's CoinGecko page. Volume below $100,000 means you may not be able to exit a non-trivial position without moving the price significantly against yourself. The deeper liquidity walkthrough is in how to check token liquidity. Pass condition: 24h volume > $100,000.

7. Listed on at least one centralised exchange OR a credible DEX pool

Open the Markets tab on CoinGecko. Look for a listing on Coinbase, Binance, Kraken, OKX, or Bybit — even one is meaningful, since CEXes carry their own due-diligence overhead. If the token is DEX-only, the pool on Uniswap V2/V3 or PancakeSwap V3 should show at least $100,000 of paired liquidity. DEX-only is not automatically disqualifying for early projects, but it removes one safety check. The tiering logic is covered in the exchange listings guide. Pass condition: at least one CEX listing, or a DEX pool above $100,000.

8. No "rug pull" or "honeypot" mentions in the last 30 days

Search the token name plus "rug pull" on Google, time-filtered to the past month. Search the ticker on Reddit. Skim the most recent X replies on the project's posts for "withdrawal" and "can't sell" complaints. You are looking for the absence of warnings, not the presence of endorsements. Pass condition: no credible rug, honeypot, or withdrawal-failure reports in the last 30 days.

9. Position size is one you can afford to lose entirely

Decide the dollar amount you will buy. Then ask: if this token returned to zero tomorrow, would the loss change my financial life? If yes, the position is too large regardless of how every other checklist item read. No safety check — including StableHub's — guarantees the outcome. The only loss-proof position size is the one you would accept losing 100% of. Pass condition: the answer to "could I lose this entirely?" is yes.

10. Written record of the checklist outcome saved before transacting

Paste the StableHub Rug Risk Score result, the verification status, the top-holder percentage, the volume number, and the date into a note. Save it before you transact. This single step does more for next year's decision quality than any other item on the list, because it forces you to confront in advance what you actually decided, on what basis, and what you accepted. Pass condition: note saved with timestamp.

StableHub 10-Item Pre-Purchase Checklist: Before any ERC-20 token purchase, StableHub recommends ten pass/fail checks: (1) contract address confirmed from two independent sources; (2) Rug Risk Score returns LOW or MEDIUM with reviewed flags; (3) Etherscan shows verified contract source code; (4) the top non-exchange wallet holds under 20% of supply; (5) the token is at least 30 days old, or new-token risk is accepted explicitly; (6) 24-hour trading volume exceeds $100,000; (7) the token is listed on at least one centralised exchange or in a DEX pool above $100,000; (8) the last 30 days show no rug-pull, honeypot, or withdrawal-failure reports; (9) the position size is one the buyer could lose entirely without changing their financial life; and (10) the outcome of all nine checks is saved as a written, timestamped note before transacting. Every item is binary. Every skipped item is a deliberate choice rather than an oversight.

One failure is not always disqualifying, but it should change the position size or the timing. Two failures should be disqualifying unless you can explain in writing why the specific failures do not apply to this case. The companion pieces unpack the specific failures: the click-by-click pre-purchase walkthrough covers items 1–5, and the rug-pull pattern guide covers the typology behind items 4 and 8.

Paste an ERC-20 contract address into the StableHub token checker. The Rug Risk Score returns in 2–4 seconds with a LOW / MEDIUM / HIGH grade.