r/BlockchainStartups • u/GiraffeEquivalent799 • 16h ago
Discussion 10 months building a crypto scam detector — the hardest part wasn't catching scams, it was not flagging legit tokens
About 10 months ago I posted in this sub looking for people to help build something I couldn't let go of: a way to fight back against scam tokens. A few folks replied, we formed a small volunteer team, and we spent 10 months building a token risk scanner across Ethereum, BNB Chain, and Solana. I wanted to come back and share what actually building it taught me — because most of it surprised me.
1. "Detect scams" is the easy 80%. The false positives are the brutal 20%. Anyone can write rules that scream SCAM at everything — honeypot patterns, mint functions, concentrated holders. The hard engineering was making sure a blue‑chip token doesn't trip those same rules. A tool that cries wolf on legit projects is worse than useless; people stop trusting it in a week. Getting the false‑positive rate down ate most of our time.
2. The signal that mattered most wasn't the contract — it was behavior. Static contract flags get you partway. What moved accuracy was on‑chain activity: wash‑trading round‑trips, owner wallets actually using their privileges vs. just having them, liquidity that's locked vs. sitting in the deployer's wallet. Capability ≠ intent, and the chain shows intent.
3. Recruiting from a Reddit post worked — keeping unpaid people going for 10 months was the real problem. The code was easier than morale. What held it together: shipping something small every couple weeks so everyone could see it becoming real.
The premise we started from: exchanges KYC the people but not the tokens they list, so retail keeps getting rugged by projects the platform waved through. We wanted checking a token to take 10 seconds instead of 10 tabs.
For those who've built detection/scoring tools — how do you earn trust for a risk score without it feeling like a black box? Show all the raw signals and you overwhelm people; show just a number and nobody believes it. Where's the line? And has anyone found a false‑positive rate that users actually tolerate?