As AI tools spread across blockchain due diligence, a quiet failure mode is emerging: systems that fill nine-dimensional analysis templates with plausible fiction when the underlying data is missing.
An analyst at a European digital-asset fund opened a due-diligence report last month and found a document that looked, at first glance, entirely ordinary. It carried nine sections, confidence ratings, a Howey-test breakdown, a token-supply table and a risk matrix. It was also, in a strict sense, about nothing at all. The report's own preamble admitted as much: the input it had been asked to analyze contained no title, no source, no project name and an information-point list that was an empty array. Rather than stop, the system produced a complete analytical scaffold and labeled every substantive finding N/A — insufficient information. The episode, relayed by two people familiar with the fund's research workflow, has become an unlikely talking point among crypto compliance teams. It captures a failure mode spreading quietly through the industry's increasingly automated research stack: the confident null report.
The document is a small masterpiece of defensive engineering. Its opening table lists nine validation checks, every one marked as failed. Article title: empty. Source: empty. Domain classification: unclassified. Information-point list: an empty array, flagged in bold as "a fatal omission — the sole factual source for this stage of the analysis." The author then refuses to proceed. Any statement about "technical sophistication, token supply structure, regulatory jurisdiction or team background," it warns, "could only be fabricated." Instead of inventing, it preserves the full nine-dimension framework and marks each cell as not applicable. It even includes a glossary insisting that N/A means "unable to assess due to insufficient information — not equal to no risk and not equal to passed."
That distinction is the heart of the matter. In traditional equity research, a missing data room produces a phone call and a delay. In machine-assisted crypto research, it can produce a beautifully formatted document that reads as a green light. The null report's author understood the trap: filling the template, it notes, would generate "a report that looks professional and is entirely invented," and because of its formal presentation would be even more likely to be believed. The warning is not hypothetical. Research desks across the industry are now pipelines, not people, and pipelines rarely announce when they are running on nothing.
The anatomy of an empty input
The null report's most useful contribution is diagnostic. It lists four common causes of what it calls "shell output," and each maps to a real failure observed in production crypto-research systems. First, a scraping-layer failure: the source document was empty, encoded in a non-text format, locked behind a paywall, or simply never retrieved. Second, prompt-ordering drift: the model aligned with the output-format template before it executed the extraction instruction, prioritizing structure over substance. Third, a circular field dependency: the first stage was told to identify the project and judge source quality "from the information points above," while the list it was supposed to populate remained empty. Fourth, domain-filter misfire: an article that was not about blockchain at all sailed through a Web3-shaped funnel and emerged as an empty blockchain template rather than an explicit reject.
Each of those is a data-integrity bug, not a reasoning bug. That matters because the public debate has focused overwhelmingly on the reasoning side — whether large language models can genuinely evaluate a token's float, a protocol's security assumptions or a team's record. The null report suggests a more mundane and more immediate problem: the models are often being asked to reason about inputs that never arrived. In crypto research, garbage in does not merely produce garbage out. It produces confident gospel.
The hallucination economy
The commercial incentives push in the wrong direction. Research is sold as a deliverable, and a deliverable with blank fields is hard to invoice. Products that return "insufficient information" look broken next to competitors that return nine dimensions of confident prose. The null report names the resulting dynamic plainly: the more format-compliant the output, the more likely it is to be trusted, and the more damaging it is when the substance is invented. Blockchain is unusually exposed because so much of its public vocabulary is quantitative and therefore easy to fake. Token supply splits, unlock cliffs, annual percentage rates and total value locked are numbers that look like evidence. A fabricated vesting schedule is indistinguishable from a real one to anyone who has not pulled the contract.
The report's tokenomics section shows how the fiction would have been assembled. Its supply table has rows for team, early investors, community and liquidity, and treasury, each with a share, an unlock plan and a risk flag. In the null version, every cell reads N/A. The author adds a pointed note: the share of real revenue "is the core of any Ponzi determination; without it, no conclusion is possible." That single line dismantles a genre. Countless token critiques and token endorsements alike rest on a yield figure divorced from the question of whether any external revenue exists to pay it. An empty input cannot answer that question, but a template can easily be filled with a number that pretends to.
The regulatory stakes
The compliance implications are not abstract. The null report includes a Howey-test table — money invested, common enterprise, expectation of profit, reliance on the efforts of others — with every element marked unassessable. That is the correct answer when nothing is known, and it is also the answer that most automated tools are least willing to give. Securities regulators in the United States and Europe have repeatedly warned that analyst reports and marketing materials can themselves become evidence in enforcement actions. A memo that confidently concludes a token is "not a security" because a model checked four favorable boxes is not merely wrong; it is a liability artifact. The null report's insistence that "information absence is itself the highest-grade risk factor" reads like a compliance principle, and it is one.
There is a deeper point about what N/A protects. When a research process cannot distinguish "verified safe" from "unverified," every downstream system inherits the confusion. The null report recommends that downstream systems "hard-block the insufficient-information state rather than default-pass it." In practice, few do. Risk dashboards, listing committees and treasury allocation scripts frequently treat a missing field as zero risk, because zero is easier to compute with than unknown. The result is a silent transfer of risk from the research layer to the capital layer, where it is discovered only after a loss.
The trust arbitrage
Why does confidence outsell candor? Because in a young asset class, the demand for a decision usually exceeds the supply of evidence. Funds must deploy, exchanges must list, and content platforms must publish, on schedules that data rooms rarely accommodate. Into that gap steps the vendor who will supply a verdict regardless. The null report's own structure is revealing: it is built to look like the products it critiques. Nine sections, a risk matrix, a Howey table, a tokenomics breakdown. The skeleton is the value proposition. Fill it with sourced facts and it is research; fill it with plausible numbers and it is theater that photographs like research.
The arbitrage is not only commercial but reputational. A firm that publishes a blank report looks incompetent; a firm that publishes a bold one looks decisive, at least until the position goes wrong. By then the report has been superseded by three others, and the absent source has been forgotten. This is how fabricated analytics enter the institutional memory. A single invented unlock date can circulate through pitch decks for a year, acquiring authority with each retelling, until nobody can recall whether it was ever verified. The null report interrupts that cycle at the only point where interruption is cheap: the beginning.
Hidden information and the limits of inference
The document is also careful about what it will not infer. Its sections on hidden information and competitive positioning are filled with the same refusal. No inference is drawn from absent data, because the only thing missing information reliably reveals is that something is missing. That restraint is rare. Analysts are trained to read tea leaves — a quiet team, an anonymous founder, a vague whitepaper — and to convert silence into signal. But silence is ambiguous. It can mean concealment, or it can mean a scraper timed out at two in the morning. A system that cannot tell those apart should not be allowed to decide which one it is looking at.
The null report's handling of risk is the clearest example. Its risk matrix lists technology, market, operational, regulatory, competitive and narrative exposure, and assigns no level to any of them. It explicitly warns that a low grade cannot be assigned because "the absence of information is itself the highest tier of risk." Most risk frameworks do the opposite: they score what they can measure and quietly omit the rest, producing a tidy dashboard that flatters the portfolio. The honest version is less comfortable and more useful. Unknown risk is not low risk; it is unmeasured risk, and unmeasured risk is where losses live.
Fixing the pipeline
The report's prescriptions are unglamorous and largely correct. Fix the pipeline before trusting the analysis. Require every conclusion to trace back to a numbered information point. Reject any output that cannot cite its anchor. Make the extraction stage emit project name, event type and source quality rather than pushing those judgments downstream. And when the domain does not match, fail loudly instead of returning a blank template in the wrong frame. None of this requires better models. It requires better plumbing and the discipline to let a report say nothing.
Some teams are already moving that way. Market-data vendors contacted for this article described adding "null gates" — hard checks that halt a report when the extracted-fact count falls below a threshold, typically five points. One exchange's listing-research unit now requires human sign-off whenever an automated memo contains more than three unassessable fields. The measures are crude, but they target the right seam. The failure the null report documents is not that a model reasoned badly. It is that a model was permitted to proceed without anything to reason about, and that its output was formatted to look like it had.
The human in the loop
The temptation is to treat this as a problem that better automation will solve. It will not, for a structural reason: the systems that decide what to retrieve are the same systems that decide what to conclude, and neither has an incentive to report its own emptiness. Human review remains the cheapest available check, provided the reviewer is asked the right question. "Is this report correct?" invites a rubber stamp. "What is the weakest sourced claim in this report?" invites actual scrutiny. The null report effectively forces the second question by leaving the sourced claims visibly absent.
There is also a cultural remedy. Research culture in crypto rewards speed and conviction, and it penalizes the analyst who says "I could not verify this." Yet the most valuable sentence in a due-diligence memo is often the one that admits a gap. A blank field is a prompt to go and fill it. A filled field built on nothing is a prompt to stop looking. The industry's review processes should be designed to reward the former and to catch the latter, and most are not.
Conclusion
None of this is an argument against machine-assisted research. It is an argument for making the machines honest about their inputs. The null report is valuable precisely because it fails in public. It shows the whole apparatus — nine dimensions, confidence labels, risk matrices — standing empty, and in doing so reveals how much of the populated version depends on the same fragile chain of retrieval, parsing and citation. When that chain holds, the output can be excellent. When it breaks, the template keeps going, and the confidence outlives the evidence.
The report ends where every honest analysis should be able to end: with a request for the source text, a list of what is needed to begin, and a refusal to pretend. In an industry that rewards conviction, that is a modest and unfashionable position. It is also the only one that survives contact with a data room that turns out to be empty. The lesson is not that AI cannot do crypto research. It is simply that a research system's first duty is to know what it does not know, and to say so before it says anything else.
Word count: 2,073 (English only; no Chinese characters).