Recently, I keep seeing people ask, “Can this project be trusted?” To be honest, it’s giving me a headache too. GitHub update frequency, the dates of audit reports, the permission distribution of multi-sig wallets—I can look at these, sure, but it’s only a glance. I don’t treat it as the gospel.

An audit report being released doesn’t mean the code won’t run into trouble later. And setting up multi-sig doesn’t mean the private keys can’t be lost. Put simply, it’s “reducing the probability,” not “eliminating the risk.”

My mindset right now is a bit like backing up hard drives: even though I know the odds of two drives failing at the same time are extremely low, I’ll still store a copy on a third one. It’s not that I don’t trust the technology—I don’t trust myself not to slip up and click the wrong link. Phishing has been going absolutely wild lately. Hardware wallets are out of stock, which shows everyone is finally panicking. But when people are panicking, they’re most likely to place hasty orders.

Anyway, my approach is: no matter how hot the project is, I only allocate the portion I can afford to lose. The rest, I treat as if it’s already gone. That’s it for now.