Discussion of cryptoasset risk tends to collapse several distinct things into a single conversation about price. The risks are separable and are worth separating.
This describes categories of risk rather than commenting on any asset or recommending any action. These are high-risk instruments, regulatory treatment varies enormously, and anybody considering them should understand they may lose everything.
Price volatility
The most discussed and arguably the least distinctive.
Cryptoasset prices have historically exhibited very large movements over short periods, substantially exceeding those of established asset classes.
Which is a market risk, is disclosed, and is understood by most participants.
What makes it consequential is the combination with leverage, which is widely available in this market and which converts a large movement into a total loss.
Custody risk
A category with no close equivalent in traditional finance and frequently underestimated.
Assets held on an exchange are generally held by the exchange rather than by the customer, and the customer holds a claim against the exchange.
Several exchanges have failed, and in a number of cases customer assets were not segregated and customers became unsecured creditors.
Assets held in a personal wallet are controlled by whoever holds the private key, and loss of the key means permanent loss of the asset with no recovery mechanism.
Which means both custody arrangements carry risk, of different kinds, and neither has the protections that apply to bank deposits or regulated investments in most jurisdictions.
The absence of protection schemes
Worth stating explicitly.
Deposit guarantee schemes and investor compensation arrangements generally do not extend to cryptoassets in most jurisdictions.
Which means a failure of a platform, or a theft, generally leaves no recourse of the kind that exists for regulated products.
Some jurisdictions have introduced or are introducing regulatory frameworks covering aspects of this, and the coverage remains considerably narrower than for conventional financial products.
Operational and security risk
Distinct from custody and substantial.
Exchanges and protocols have been subject to significant thefts, some of which were never recovered.
Smart contract vulnerabilities have resulted in losses where code behaved as written rather than as intended.
And transactions on most networks are irreversible, which means an error or a fraudulent transfer cannot be undone by any authority.
That irreversibility is a design feature and it removes the correction mechanisms that exist elsewhere.
Fraud
The category regulators warn about most.
The combination of irreversible transfers, limited regulation and technical complexity has made this an area of substantial fraud.
Common patterns include investment schemes promising returns, fake platforms, impersonation of legitimate services, and social engineering directed at obtaining private keys or recovery phrases.
Regulators and law enforcement in many jurisdictions publish warnings and lists of unauthorised firms, which are worth checking.
The absolute rule that follows from the irreversibility is that a recovery phrase or private key should never be shared with anybody, in any circumstances, for any stated reason.
Regulatory and tax uncertainty
Which affects holders directly.
Regulatory treatment differs substantially by jurisdiction and has changed repeatedly.
Tax treatment likewise, with disposals frequently taxable events in ways that surprise holders, including exchanges between assets rather than only conversions to currency.
Record-keeping obligations can be substantial, and reconstructing a transaction history afterwards is difficult.
This is an area where professional tax advice is appropriate rather than optional for anybody with meaningful activity.
What separating the risks achieves
The practical value of the exercise.
Someone comfortable with price volatility may be entirely unprepared for custody risk, which is a different question requiring different decisions.
Someone using a regulated platform in a jurisdiction with a framework has addressed some risks and not others.
And the risk of total loss through fraud or key loss is not correlated with price at all, which means diversification across assets does nothing about it.
Being clear about which risk a given precaution addresses is the only way to know what remains.
Recovery phrases and the irreversible mistake
Worth its own note because it accounts for a large share of permanent losses.
A recovery phrase reconstructs a wallet and anybody holding it controls the assets entirely.
Which means it must be recorded, stored securely offline, and never entered into any website or shared with anybody, including anybody claiming to be support.
No legitimate service ever requires it.
Equally, losing it means permanent loss with no recovery mechanism, which is the opposite failure and is equally common.
The regulatory warnings
Worth knowing where to find them.
Financial regulators in most jurisdictions publish warnings about cryptoasset risks and maintain registers of authorised firms and lists of unauthorised ones.
Checking whether a platform appears on either is a straightforward step and it is not one most people take.
Many jurisdictions also restrict how these products may be marketed, including requirements for risk warnings and cooling-off periods.
Promotional material that omits these is itself a signal about whether the firm is complying with anything.