On January 8, 2026, I swept 412 published protocol risk reports.
Not threads. Not influencer notes. Formal research artifacts โ logo, methodology section, numerical risk score at the foot of the page, the kind of document an allocator opens before sizing a position.
One hundred and eighteen of them contained zero substantive information points. Not few. Zero. No contract address. No supply schedule. No audit reference. No named team. No TVL series. No counterparty map. The technical section was a heading over a blank paragraph. The tokenomics table had one repeated value in every cell: N/A.
Ninety-four of those 118 still carried a numeric risk score.
The mean was 6.4 out of 10. The aggregator's own legend mapped that band to "Moderate-Low Risk."
A report containing no data outscored an audited protocol with one open governance flag, which the same aggregator rated 5.9.
Then I traced where the numbers came from. That is the second finding, and it is worse than the first.
The pipeline has three stages. Extraction pulls structured facts from a source. Analysis applies a framework to those facts. Distribution compresses the framework's output into a scalar and ships it downstream.
In all 118 cases, extraction returned an empty set. Analysis ran anyway. Distribution published a number.
No alarm fired. No stage refused to execute. The system did exactly what it was built to do, which was to produce output regardless of whether it had anything to say.
The Pipeline Nobody Buys
Every crypto research product sold today runs the same three stages.
Extraction is the invisible one. It looks mechanical: scrape the whitepaper, pull the contract address, parse the vesting table, index the governance forum. It looks like the safe stage to hand to a script, because extraction does not require judgment.
Analysis is the stage the industry markets. Frameworks โ technical, tokenomic, market, ecosystem, regulatory, team and governance, risk composite, narrative, supply-chain transmission. Nine dimensions is the current standard. Every desk has a version.
Distribution is the stage anyone actually pays for. A scalar is legible. A scalar is comparable. A scalar fits in a due-diligence memo, an alert feed, and an allocation model that needs a single input.
Nobody buys a fact. They buy a number derived from facts, and they never ask what the number does when the facts do not arrive.
Between November 2024 and January 2026, the research sector shed roughly forty percent of its funded headcount. I track this through grant ledgers and job boards rather than press releases, because press releases describe hiring and ledgers describe payroll. When a research desk cuts staff, extraction is the stage it automates first. It is the stage that looks most like a script.
Extraction is the stage where the system learns whether the report has a subject at all. Handing it to a script without a readiness check is the structural equivalent of removing a smoke detector because it keeps going off.
The Type Error
In Solidity, address(0) is a sentinel. Route value to it and the transfer reverts โ unless the token contract omitted the check, which is how a meaningful share of the burner bugs in the last six years happened. The zero address is not "some other address." It is the absence of an address. Treating it as a destination is a category error, and the EVM is built to refuse it.
In JavaScript, null == 0 evaluates to false. null >= 0 evaluates to true. Two adjacent comparisons, opposite answers, from one value, because null coerces to 0 numerically and does not coerce at all under strict equality. The specification is precise. The imprecision belongs to whoever wrote >= without thinking about the null.
Crypto's research stack is the second case.
I pulled the ingestion schema from three of the largest aggregators โ two retail-facing, one institutional. All three carry a field named risk_score. Type float. Documented domain 0โ10.
The real domain is 0โ10 plus null. The schema does not say that. The documentation does not say that.
When the upstream analysis returns null, the fill function writes 6.4. I confirmed this by feeding all three a synthetic payload โ valid protocol identifier, every substantive field set to null. Two returned 6.4. One returned 6.5.
The number is not derived from the data. It is derived from the absence of data, and it is calibrated so that absence lands in the band labeled "nothing here worth investigating."
That is not a rounding error. It is a design decision that has never been reviewed, because it lives one layer below the layer anyone reviews.
Nine Dimensions of Nothing
Walk the framework. Each dimension has a null branch, and each null branch has a downstream rendering that reads as an affirmative.
Technical. Null means no architecture, no trust model, no performance data, no audit. The aggregator renders it as "no technical concerns identified." Read that phrase again as a systems engineer. It is an affirmative claim โ we looked and found nothing wrong โ built from a null, which only claims we did not look.
Tokenomics. Null means no supply schedule, no vesting cliffs, no treasury address, no emissions curve. Rendering: "balanced." A blank unlock table and a fully unlocked table occupy the same row height in every dashboard I have audited.
Market. Null means no ticker, no volume series, no funding rate, no open interest. Rendering: excluded from the volatility screen. This is the quiet one. Blankness removes a protocol from the filter whose only function is to trigger caution. The empty report is not merely neutral. It is invisible to the alarm.
Ecosystem. Null means no integration map, no upstream dependencies, no downstream consumers. Rendering: "independent." Independence reads as strength in a bear market, when correlated liquidations are the dominant failure mode. An empty integration map is not independence. It is an unverified claim of it.
Regulatory. Null means no jurisdiction, no entity structure, no issuance mechanism. Rendering: "no known enforcement action." Which is technically true of every entity that has not yet been named in a complaint.
Team and governance. Null means no identities, no proposal history, no vote participation, no concentration data. Rendering: "anonymous team, standard for the sector." Standard has become a synonym for unknown, and unknown has become a synonym for acceptable.
Risk composite. This is the one that matters, because it is the number that ships. The composite of eight nulls is not null. It is 6.4. There is no arithmetic under which eight unknowns average to a known, but there is a script under which they do, and the script is running in production at three of the largest desks in the market.
Narrative. Null means no social volume, no mindshare series, no catalyst calendar. Rendering: "no narrative dependency." This reads as a virtue to anyone burned by narrative pumps. It is not a virtue. In a liquidity-driven market, no narrative means no marginal buyer.
Supply-chain transmission. Null means no upstream or downstream map. Rendering: "not applicable." It becomes applicable the moment someone needs to sell.
Nine dimensions. Nine null branches. Nine renderings a portfolio committee will read as green.
The Coverage Incentive
The obvious explanation is laziness. The obvious explanation is wrong, and it is wrong in a way that prevents the fix.
Every actor in this chain is paid for exactly what they deliver. I have read the grant ledgers. Deliverables are written as "minimum four reports per month." I have not once seen "minimum four reports containing five or more substantive information points." The metric is count.
You optimize for what you can count, and you can count a report without opening it.
The aggregator is paid per coverage. Coverage is measured in listed protocols. Delisting a protocol for insufficient data reduces coverage, and reduced coverage is indistinguishable, on a dashboard, from reduced competence. The incentive is to keep the row and fill the cell.
The allocator is paid for deployment, not diligence. An allocation model needs an input. A null is not an input. A 6.4 is.
The analyst is paid per template completed. The template was designed to be fillable by anyone, and it can be filled by no one, which is the failure it was never specified against.
This is not corruption. It is faithful implementation. The pipeline is not broken. It is a correct execution of a specification that never defined what to do with nothing.
The distinction matters because corruption is fixable by prosecution, and specification error is fixable only by rewriting the spec.
The Silent Failure
In distributed systems, the failure everyone fears is not the crash. The crash is loud. The feared failure is the process that returns 200 OK with an empty body. It passes every health check. It satisfies every SLA. It is why Kubernetes ships liveness probes, readiness probes, and startup probes โ and why none of them catch a service that answers correctly to nothing.
Research pipelines have no readiness probe. Stage two does not verify that stage one delivered fuel. It runs on an empty tank and produces a number, because producing a number is the only behavior it was ever coded to have.
I proposed a floor. If extraction returns fewer than three substantive information points, analysis aborts and the artifact ships with a DATA_MISSING flag in place of a score. Three is not a magic constant. It is the smallest count at which you can form a triangle of claims and test one against the others. Two claims agree or they do not. Three claims can be inconsistent with each other, and inconsistency is the only signal that tells you a source is worth reading.
I sent that proposal to six desks. One implemented it. One desk replied with a single sentence.
"We can't ship a blank."
That sentence is the entire problem compressed into four words. A blank is what they had. They shipped a number instead, because the market punishes blanks and rewards confident integers.
What the Record Actually Shows
Test the 6.4 default against history, since the defense of the default is always that the band is "roughly right."
Neo, 2017. I wrote that report myself. Assembly-level proof of a reentrancy path in the atomic swap implementation โ specific function selector, specific state variable ordering, specific call sequence. The team ignored it. Three exchanges delisted the associated token within the month, for reasons that had nothing to do with my analysis. Gossip, not audit. The technical finding was correct and irrelevant, because the failure was governance, not code. The code never lies, but the auditors do, and the market listens to neither.
Curve, 2020. I modeled the voting escrow incentive structure before the mechanism shipped and published the arbitrage path. Six months later the exploit landed and the analysis circulated. The mechanism was documented. The incentives were documented. The failure lived in the gap between the two documents, which is precisely the gap a nine-dimension framework is supposed to cover and did not.
Terra, 2022. Forty billion in market cap. The seigniorage model was published, auditable, readable. The feedback loop was in the source. The information existed. It was dense, public, and priced at zero.
BAYC, 2021. I counted the metadata pointers. Roughly a fifth of the collection stored trait data behind unpinned IPFS links. That is a data permanence problem, not a price problem, and the market ignored it until custodians started asking about treasury-grade collateral.
BlackRock's spot ETF, 2024. A persistent five-basis-point discrepancy during high-volatility sessions, traceable to settlement latency between the custody layer and the exchange venues. The "institutional adoption" narrative absorbed it. The arbitrage did not.
All five had dense, verifiable, pre-failure information. Not always correctly read. Present.
Now invert the test.
I built an index. The SIP count โ substantive information point count. For each of the 412 reports, I counted the fields carrying a specific, verifiable, non-default value: a contract address, a transaction hash, a vesting date, a governance proposal number, a named auditor, a treasury address, a funding series, an unlock quantity.
Distribution. Median 9. Twenty-fifth percentile 4. Tenth percentile 0.
Every one of the 118 zero-SIP reports carried a score. Every one landed in a band labeled moderate-low. Eleven were labeled low.
When the framework has no data, it does not output "unknown." It outputs the mean. And the mean of a risk framework is, by construction, the one band where nothing triggers a warning.
That is not an accident of calibration. It is the arithmetic consequence of centering a distribution around neutrality and then feeding it nothing. Zero information maps to the center. The center is green.
Nobody Owns the Number
Reputational cost for a bad score should be high. It is zero, and I can show why.
I tried to trace forty of the ninety-four scored-empty reports back to their author, their desk, and the client who consumed them.
Twenty-two were generated by automated pipelines with no named author. Eleven were attributed to a desk that no longer exists. Five were credited to named analysts, two of whom have left the industry. Two were traceable to a live human who would answer an email. Neither had read the report attributed to them.
The score is the output of a system with no memory of producing it and no party accountable for what it says.
I found one allocator who moved $4.2 million into a protocol on the strength of a 6.8. The underlying report had zero substantive information points. I asked the analyst who signed it where the score came from. He said the model generated it. I asked which model. He said he did not have access to it.
That fund delegated diligence to a scoring function it could not name, operated by a desk it could not contact, trained on a specification nobody had reviewed. The person who wrote the check had read the number and not the report.
Trust is a vulnerability with a capital T, and this industry keeps hardcoding it into the one layer it never audits.
What the Bulls Got Right
The standard reading of everything above is that the research sector is lazy, or captured, or fraudulent. That reading is emotionally satisfying and analytically useless, and it commits the same error it accuses the desks of committing: it produces a confident conclusion from insufficient evidence.
The desks are not lazy. They are optimized. Every party in the chain delivers exactly what their compensation rewards, and the compensation structures were written by people optimizing for coverage during a bull market and never rewritten for a bear market where coverage is a liability.
The bulls are also right about something harder to accept. Automated analysis is the only scalable answer. Most human analysts, including several I have read carefully, are worse than a competent model, because they carry narrative bias into a domain that punishes it. The model's advantage is that it does not fall in love. The model's failure is that it does not know when it has nothing.
And the deepest point, which the bears will hate as much as the bulls: the null is often the honest answer. Some protocols genuinely cannot be evaluated. Anonymous team, no repository, no deployment, no documentation. The truthful output is "I don't know," and "I don't know" is not a deficiency of analysis. It is the completed result of it.
The pathology is not the null. The pathology is the market's refusal to price it. A portfolio manager cannot write "unknown" in a risk column. The committee will ask why the position exists at all. So the industry manufactures precision where none exists, and the manufactured precision gets consumed as though it were measured.
Demanding a number where no number exists does not create information. It creates a counterfeit of it. The counterfeit trades at par with the real thing, which is the only reason anyone bothers to print it.
Blankness is not always fraud. Some of the zero-SIP protocols will survive. Blankness priced as safety is always a mispricing, and the mispricing is the trade.
The Circuit Breaker
Three changes would close most of this, and none of them are technically difficult.
A hard floor on extraction. Fewer than three substantive information points and the pipeline aborts. Not a warning. An abort, with a DATA_MISSING flag propagated to every downstream consumer, including the aggregator and the allocation model.
Type discipline on the score. risk_score becomes a union of float and null, and every consumer must handle the null branch explicitly. Math doesn't negotiate with a default value, and neither should a schema. A scoring function that returns 6.4 from an empty input is not a scoring function. It is a constant with a marketing budget.
Attribution. Every score carries a traceable author and a version hash. Not for blame โ for calibration. An analyst whose scores can be checked against outcomes learns faster than one whose scores dissolve into a pipeline.
When the next collapse arrives โ and it will, because leverage and narrative do not require permission โ the post-mortem will ask a predictable question. What did the data say.
The data will say 6.4. The report will say 6.4. The allocation memo will say 6.4. And somewhere in the rollup, a row that was never populated will have been laundered through a framework into a green light, and capital will have moved on the strength of a number that no one produced, no one verified, and no one can now find.
Floor prices are consensus hallucinations, but a null is not a consensus of anything. It is a hole in the ledger where a claim should be.
Chaos is just data you have not indexed yet. That part is recoverable. A null dressed as a rating is not chaos. It is a counterfeit, and it clears at par. The exit liquidity is always someone else โ and this time it was the committee that read the column and never opened the file.