I tried once: to figure out whether a project is reliable or not, I forcefully went through its GitHub, audit reports, and how multi-signature upgrades are configured. To be honest, I’m not the type to read code; I look for a few “human language” signals: Is the repository actively maintained or just updated sporadically? Does the audit report clearly state the risks? Has the team actually made changes based on the recommendations? Is the multi-signature upgrade just a few people making a quick decision, or is there some decentralization and delay buffers? After reviewing that time, I actually became hesitant to invest… It feels like a lot of “security” relies on processes and constraints, not just a statement like “audited.”

Recently, I’ve seen some regions tighten and loosen taxes and compliance rules alternately. When the inflow and outflow expectations change, people become more eager to find “certainty.” But now I prefer: don’t predict, first look for signs of credibility—at least to filter out a bunch of storytelling projects. That’s all for now.