What risks are distinctive in crypto?

If a company share falls, the investor may still own the share in the same brokerage account. The price has changed, but the record of ownership and the route for recovering account access normally remain inside established financial infrastructure.

Crypto can add another question: can the holder still access or transfer the asset at all?

That does not mean every cryptoasset or service has the same risk. It means the word crypto describes a stack of technology, markets and intermediaries. Each layer can fail differently.

The most useful approach is to separate the risks instead of compressing them into one warning that “crypto is volatile”.

Market risk: the price may have little to anchor it

Many cryptoassets do not give the holder a claim on a company’s profits, a borrower’s promised payments or a pool of redeemable assets.

Their price may depend heavily on expectations of future use, perceived scarcity and confidence that other people will continue to demand them. Those expectations can change quickly.

Price risk can be intensified by:

• concentrated ownership;
• leverage and forced liquidations;
• thin trading outside the largest assets;
• tokens unlocking for founders or early investors;
• social-media promotion;
• changing regulation; and
• uncertainty about whether the token is necessary for the service around it.

A quoted market capitalisation does not show how much money entered the asset or how much every holder could withdraw. Multiplying the latest price by the supply can produce a large headline number even when only a small quantity traded near that price.

Stablecoins need a different test. Their price is intended to track another asset, often a currency. Stability depends on the reserves, issuer, custody, redemption rights and market mechanism. A peg is a design objective, not a guarantee that redemption always works.

Custody risk: control depends on keys

A blockchain records units against addresses. A wallet manages the keys used to authorise transactions.

The private key provides practical control. Many wallets represent it through a seed phrase, a sequence of words from which the keys can be recovered.

If somebody obtains that information, they may be able to move the asset. If the holder loses it and has no recovery route, access may be permanently lost. A blockchain transaction sent to the wrong address may be difficult or impossible to reverse.

This creates a trade-off.

With self-custody, the holder controls the keys and does not depend on an exchange to approve a withdrawal. But they are responsible for security, backups, inheritance planning and avoiding mistakes.

With custodial storage, a platform controls the keys or the account through which the asset is accessed. Recovery may be easier, but the holder now depends on the platform’s security, solvency, record-keeping and terms.

“Not your keys, not your coins” captures one risk but not the whole choice. Holding your own keys does not automatically mean holding them safely.

Who controls the exit?

Picture two doors. The self-custody door has one key held by the user: no company can lock it, but losing the key can make the door unusable. The custody door has an account-recovery desk, but the company controls whether the door opens and must remain secure and solvent. Neither door removes risk; each places it somewhere different.

Platform risk: the venue can fail while the network continues

A crypto exchange may provide trading, custody, lending, staking and conversion between cryptoassets and conventional currency. These are different services with different obligations.

If the platform fails, assets may be frozen while administrators determine what customers legally own and whether assets were kept separate from the firm’s own property. Terms may allow the platform to lend, pool or otherwise use customer assets.

Platform risks include:

• cyber-attack or theft;
• operational outage;
• withdrawal suspension;
• poor segregation or record-keeping;
• fraud or misuse by insiders;
• insolvency; and
• dependence on a bank or payment provider.

Registration for one regulatory purpose — such as registration under money-laundering rules — should not be mistaken for a guarantee of solvency, security or investment quality.

Before using a platform, examine which legal entity holds the assets, where it is based, what the terms say about ownership, whether customer assets are segregated, how withdrawals work and what happens if the firm fails.

Protocol and smart-contract risk: code can behave exactly as written

Some cryptoassets operate through smart contracts: programs that apply rules and move assets when stated conditions are met.

The code may contain an error. An attacker may combine several legitimate functions in an unexpected way. An administrator may retain a key allowing rules to be changed. The system may depend on an oracle, a service bringing outside information such as prices onto the blockchain. If the oracle fails or is manipulated, the contract may act on bad data.

Bridges, which move representations of assets between networks, add another set of contracts, keys and operators. The user is not only trusting each network, but the mechanism linking them.

A transaction can be valid under the protocol rules and still be disastrous for the user. Tamper-resistant records do not prove that the underlying instruction was sensible or authorised by the rightful person.

Open-source code can improve transparency, but availability is not the same as a complete audit. An audit can reduce risk without proving that every future interaction is safe.

Network and governance risk: rules can change

Crypto networks need a method for agreeing which transactions are valid. They also need people or processes that maintain software and respond to problems.

Risk may come from:

• a small group controlling validation;
• developers or a foundation having unusual influence;
• disagreement causing a network split;
• changes to issuance or fees;
• validators refusing or rearranging transactions;
• congestion making transfers slow or expensive; and
• declining participation weakening security.

The claim that a system is decentralised should be tested. Who can change the code? Who operates the validating infrastructure? Who controls administrative keys? What happens when participants disagree?

Trust has not disappeared. It has been distributed across software, incentives, operators and governance arrangements.

Liquidity risk: the displayed price may not be available

A token can show a price while offering little genuine trading depth.

One venue may display activity that does not exist elsewhere. Much of the supply may be locked or held by insiders. A holder may be able to buy a small amount easily but unable to sell a large amount near the last quoted price.

Liquidity can also fragment across blockchains, exchanges and trading pairs. Exiting may require several transactions, each with its own fee, spread and operational risk.

Ask where the volume occurs, how deep the order book is, how concentrated ownership is and whether the route back to pounds is dependable.

Fraud and irreversible-action risk

Crypto transactions are attractive to criminals because transfers can be fast, international and hard to reverse.

Common attacks include fake investment platforms, impersonation, malicious wallet links, fraudulent token contracts, recovery scams and messages pressuring somebody to reveal a seed phrase.

No legitimate helper needs the private key or seed phrase to provide customer support. A promise to recover stolen crypto in return for another upfront payment may be a second scam aimed at the same victim.

The technology can be genuine while the person asking for the transaction is not.

Protection and regulation: check the activity, not the logo

United Kingdom crypto regulation is developing. The Financial Conduct Authority published final policy statements in June 2026 for a broader regime intended to apply to authorised cryptoasset firms from October 2027.

That future framework does not turn cryptoassets into low-risk investments. The FCA states that cryptoassets remain high risk and that buyers should be prepared to lose the entire value.

Direct cryptoasset investment is not protected by the Financial Services Compensation Scheme in the way an eligible bank deposit may be. Financial Ombudsman coverage depends on the firm, activity and complaint; it does not compensate ordinary market losses.

Rules applying to a promotion or service provider are not a government endorsement of the asset.

Because this area is changing, check the current position immediately before acting rather than relying on an old article, app badge or social-media explanation.

The useful conclusion

Crypto risk is distinctive because ownership, access, software and market value can fail separately.

The price may fall while custody works perfectly. A platform may fail while the blockchain continues. A smart contract may execute correctly according to flawed rules. A holder may lose keys to an asset whose market price has risen.

Treat the asset, wallet, platform, protocol and legal protection as separate layers. Understanding one does not automatically make the others safe.